[{"data":1,"prerenderedAt":421},["ShallowReactive",2],{"i-lucide:menu":3,"i-lucide:arrow-up-right":8,"i-lucide:moon":10,"i-lucide:sun":12,"i-lucide:rss":14,"i-simple-icons:github":16,"i-simple-icons:linkedin":18,"post-\u002F2020\u002Fbuspad-kiosk-bypass":21,"surround-\u002F2020\u002Fbuspad-kiosk-bypass":408,"i-lucide:arrow-left":417,"i-lucide:arrow-right":419},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M7 7h10v10M7 17L17 7\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M20.985 12.486a9 9 0 1 1-9.473-9.472c.405-.022.617.46.402.803a6 6 0 0 0 8.268 8.268c.344-.215.825-.004.803.401\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"12\" cy=\"12\" r=\"4\"\u002F>\u003Cpath d=\"M12 2v2m0 16v2M4.93 4.93l1.41 1.41m11.32 11.32l1.41 1.41M2 12h2m16 0h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M4 11a9 9 0 0 1 9 9M4 4a16 16 0 0 1 16 16\"\u002F>\u003Ccircle cx=\"5\" cy=\"19\" r=\"1\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19,"hidden":20},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"id":22,"title":23,"body":24,"category":394,"comments":395,"date":396,"description":397,"excerpt":395,"extension":398,"image":399,"meta":400,"navigation":20,"path":401,"readingTime":402,"seo":403,"stem":404,"subtitle":405,"tags":395,"wordCount":406,"__hash__":407},"posts\u002F2020\u002Fbuspad-kiosk-bypass.md","Buspad kiosk breakout",{"type":25,"value":26,"toc":382},"minimark",[27,38,41,48,51,54,59,62,67,70,75,78,84,89,92,97,100,105,108,113,116,121,124,129,132,137,140,145,148,153,156,161,164,169,172,177,180,185,188,192,212,215,234,237,257,262,276,284,288,308,312,315,334,338,358,362],[28,29,30,37],"p",{},[31,32,36],"a",{"href":33,"rel":34},"https:\u002F\u002Fwww.luxexpress.eu\u002Fen\u002F",[35],"nofollow","Lux Express"," is a transportation company that operates bus lines in the Baltic region.\nIn their fleet of more modern buses, they offer each passenger\nan in-seat Android multimedia tablet, running in kiosk (restricted) mode. The tablet runs a full-screen custom application,\nthat has menu items for common entertainment options like a web browser, movies and music.",[28,39,40],{},"Due to misconfiguration of the tablet, it's possible to exit this kiosk mode and get full user-level control of the tablet.",[28,42,43],{},[44,45],"img",{"alt":46,"src":47},"","\u002Fcontent\u002F2020\u002Fbuspad\u002F1.jpg",[28,49,50],{},"The welcome screen of the pad is the in-kiosk activity menu: watch movies, browse the web. The kiosk is running in full-screen,\nwith no apparent exit button (there is an exit \"app\" hidden away in the games section, but it requires a password).",[28,52,53],{},"The design goal here seems (rightfully) that random travellers should only be allowed to use the tablet in kosk mode, to entertain,\nbut not reconfigure the tablet or install any apps.",[55,56,58],"h2",{"id":57},"buspad-kiosk-breakout-steps","Buspad kiosk breakout - steps",[28,60,61],{},"Here's how to break out of the full-screen kiosk app and access Android settings. This is not hacking per se, as everything required\nis exposed\u002Fallowed\u002Fenabled by the tablet in it's current configuration. As of 2020-03-22, the tablets should still be vulnerable.",[28,63,64],{},[44,65],{"alt":46,"src":66},"\u002Fcontent\u002F2020\u002Fbuspad\u002F2.jpg",[28,68,69],{},"Select \"internet\" from the kiosk welcome screen. Navigate to any web page.",[28,71,72],{},[44,73],{"alt":46,"src":74},"\u002Fcontent\u002F2020\u002Fbuspad\u002F3.jpg",[28,76,77],{},"Select a word or a phrase on the web page. In Android, selecting text is done by long-pressing on a word. Choose \"SHARE\" from top-right.",[28,79,80],{},[81,82,83],"em",{},"Wikipedia warns us that we are using an old and unsupported browser that will stop working soon. I wonder if this is a nudge to prod operators into finally updating it.",[28,85,86],{},[44,87],{"alt":46,"src":88},"\u002Fcontent\u002F2020\u002Fbuspad\u002F4.jpg",[28,90,91],{},"Android sharing menu opens. In your phone, you'd have a bunch of apps like Twitter or Notes there as a sharing target. We are interested in the Google (launcher) app.\nSelect it as share target.",[28,93,94],{},[44,95],{"alt":46,"src":96},"\u002Fcontent\u002F2020\u002Fbuspad\u002F5.jpg",[28,98,99],{},"The kiosk app moves to the background and we're now in the context of the Google app. There's a meta-search-launcher bar on top, where you can search and launch other apps on the\ntablet - including apps not listed in the restricted kiosk view. We're now effectively out of the kiosk.",[28,101,102],{},[44,103],{"alt":46,"src":104},"\u002Fcontent\u002F2020\u002Fbuspad\u002F6.jpg",[28,106,107],{},"Launch ApkInstaller app. This seems to be a custom thing designed for sideloading new apps to the device, as by default, it isn't running the Google Play app installer.",[28,109,110],{},[44,111],{"alt":46,"src":112},"\u002Fcontent\u002F2020\u002Fbuspad\u002F7.jpg",[28,114,115],{},"We're offered the choice to manage existing apps, or to add a new app.",[28,117,118],{},[44,119],{"alt":46,"src":120},"\u002Fcontent\u002F2020\u002Fbuspad\u002F7.1.jpg",[28,122,123],{},"Select to install a new app; and USB memory as the install source.",[28,125,126],{},[44,127],{"alt":46,"src":128},"\u002Fcontent\u002F2020\u002Fbuspad\u002F8.jpg",[28,130,131],{},"Insert a USB drive into the front-facing USB port of the device. USB should contain .apk file to install.",[28,133,134],{},[44,135],{"alt":46,"src":136},"\u002Fcontent\u002F2020\u002Fbuspad\u002F9.jpg",[28,138,139],{},"From the ApkInstaller, find your .apk file from the USB and choose to install it.",[28,141,142],{},[44,143],{"alt":46,"src":144},"\u002Fcontent\u002F2020\u002Fbuspad\u002F10.jpg",[28,146,147],{},"Android default apk policy applies - sideloading apps is not allowed.",[28,149,150],{},[44,151],{"alt":46,"src":152},"\u002Fcontent\u002F2020\u002Fbuspad\u002F11.jpg",[28,154,155],{},"Use pad \"back\" buttons to exit back to the in-kiosk web browser. Launch Google app again; and from there, launch the Settings app.",[28,157,158],{},[44,159],{"alt":46,"src":160},"\u002Fcontent\u002F2020\u002Fbuspad\u002F12.jpg",[28,162,163],{},"Go to Security and disable \"Verify apps\" setting.",[28,165,166],{},[44,167],{"alt":46,"src":168},"\u002Fcontent\u002F2020\u002Fbuspad\u002F13.jpg",[28,170,171],{},"Try to install .apk file again; this time it succeeds.",[28,173,174],{},[44,175],{"alt":46,"src":176},"\u002Fcontent\u002F2020\u002Fbuspad\u002F14.jpg",[28,178,179],{},"Installed app (Terminal Emulator) is visible from apps list.",[28,181,182],{},[44,183],{"alt":46,"src":184},"\u002Fcontent\u002F2020\u002Fbuspad\u002F15.jpg",[28,186,187],{},"Launch the newly installed app (web -> share -> Google -> search). You're now out of the kiosk and launched an app of your\nchoice - be it file explorer, terminal or anything else.",[55,189,191],{"id":190},"analysis","Analysis",[28,193,194,195,200,205,206,211],{},"Properly kiosking of things is hard; people have been breaking out of kioskes ",[31,196,199],{"href":197,"rel":198},"https:\u002F\u002Fsecurityriskadvisors.com\u002Fblog\u002Fsitekiosk-breakout\u002F",[35],"for a",[31,201,204],{"href":202,"rel":203},"https:\u002F\u002Fblog.kiosksimple.com\u002F2014\u002F11\u002F26\u002Fa-guide-to-hacking-kiosk-applications\u002F",[35],"long"," ",[31,207,210],{"href":208,"rel":209},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=kRFNYws1FF0",[35],"time",".",[28,213,214],{},"In this instance, kiosk breakout was possible, because:",[216,217,218,222,225,228,231],"ul",{},[219,220,221],"li",{},"Android default text context-action was enabled (selecting \u002F sharing text)",[219,223,224],{},"A launcher app (Google) was present and installed on the device and available as a share target",[219,226,227],{},"Device had ApkInstaller present and launchable",[219,229,230],{},"Front-facing USB port had data lines enabled; and Android user had permission to use it as mass-media device",[219,232,233],{},"New app installation was possible",[28,235,236],{},"Advise for fixing this:",[216,238,239,242,245,248,251,254],{},[219,240,241],{},"Upgrade Android versions, if possible. If hardware doesn't support newer Android, consider upgrading the hardware also. It will cost, but\nthese devices were installed (based on the Android version present) in 2012. Enterprises typically have an amortization time of 4...5 years for these types of devices",[219,243,244],{},"Demand more quality from the pad's software-development partner. The pad has numerous quality (UI\u002FUX) issues,\nbut also quite rich attack surface and security misconfigurations",[219,246,247],{},"Contract software partner to provide periodic (~2 times a year) software updates to the pads. This means Android version updates + version updates\n(security patches) to all the software running on it (the tablet has Flash 11.1 installed, released in... 2012)",[219,249,250],{},"Have monitoring and alerts for the pads. If some pad launches system settings app or installs new apps - unusual, unexpected behavior - someone\nshould know; and look into it. I'm fairly certain no human-noticed logs or alerts were triggered from the above activity",[219,252,253],{},"Disable front-facing USB port for data access. At least deny the tablet user to access it. Percentage of users who would find a valid use-case for it is extremely low,\nbut vulnerability it opens - not so low",[219,255,256],{},"Remove APKInstaller from device, if possible",[258,259,261],"h3",{"id":260},"other-observations","Other observations",[216,263,264,267,270,273],{},[219,265,266],{},"Android version is Jelly Bean (released in Feb 2013) - this as reached end of life long ago",[219,268,269],{},"The tablet and software installed there is quite old (2012) - I don't think it has received any meaningful updates since then",[219,271,272],{},"It's possible to export installed .apk-s out of the device",[219,274,275],{},"The custom kiosk app is poorly written. In many, many, many ways.",[28,277,278,281],{},[44,279],{"alt":46,"src":280},"\u002Fcontent\u002F2020\u002Fbuspad\u002Fsettings.jpg",[44,282],{"alt":46,"src":283},"\u002Fcontent\u002F2020\u002Fbuspad\u002Fversions.jpg",[55,285,287],{"id":286},"possible-misuses","Possible misuses",[216,289,290,293,299,302,305],{},[219,291,292],{},"Install keyloger (log everything being typed by next travellers). Imagine if a traveller decides to log in to their Facebook or an internet bank...",[219,294,295,296],{},"Install mic \u002F camera recorder apps (listen in on conversations) ",[81,297,298],{},"(not sure if camera and mic are physically installed to the tablets)",[219,300,301],{},"Install generic malware (botnet node; (very slow) cryptocurrency miner)",[219,303,304],{},"Track the location of the bus",[219,306,307],{},"Take screenshots of the tablet (if someone has logged into any account...)",[55,309,311],{"id":310},"advise-to-travelers","Advise to travelers",[28,313,314],{},"The purpose of this public disclosure is to warn travelers:",[216,316,317,320,328,331],{},[219,318,319],{},"Do not trust the tablet - you didn't provision it; you now know it isn't properly locked; and you don't know what previous travelers have done with it",[219,321,322,323,327],{},"Absolutely ",[324,325,326],"strong",{},"do not"," enter any sensitive data to the tablet. No logging in to Facebook; no logging in to your internet bank",[219,329,330],{},"Use the tab only for entertainment - read news, watch movies",[219,332,333],{},"Do not have sensitive conversations in the bus",[55,335,337],{"id":336},"timeline","Timeline",[216,339,340,343,352,355],{},[219,341,342],{},"2019-12 Initial discovery",[219,344,345,346,351],{},"2019-12-14 Responsibly disclosed to ",[31,347,350],{"href":348,"rel":349},"https:\u002F\u002Fcert.ee",[35],"CERT-EE"," and Lux Express - no response from Lux Express, autoreply from CERT",[219,353,354],{},"2020-03-15 2nd disclosure to Lux Express (alternative e-mail - general info contact - no response)",[219,356,357],{},"2020-03-22 Public disclosure",[55,359,361],{"id":360},"references","References",[216,363,364,370,376],{},[219,365,366],{},[31,367,368],{"href":368,"rel":369},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=vmWXtDtKD9k",[35],[219,371,372],{},[31,373,374],{"href":374,"rel":375},"https:\u002F\u002Friia.luxexpress.eu\u002Fen\u002Fonboard-media-content",[35],[219,377,378],{},[31,379,380],{"href":380,"rel":381},"https:\u002F\u002Figra.luxexpress.eu\u002Fet\u002Fuued-bussid-liinil-tallinn-stpetersburg",[35],{"title":46,"searchDepth":383,"depth":383,"links":384},2,[385,386,390,391,392,393],{"id":57,"depth":383,"text":58},{"id":190,"depth":383,"text":191,"children":387},[388],{"id":260,"depth":389,"text":261},3,{"id":286,"depth":383,"text":287},{"id":310,"depth":383,"text":311},{"id":336,"depth":383,"text":337},{"id":360,"depth":383,"text":361},"Security",null,"2020-03-22","Lux Express is a transportation company that operates bus lines in the Baltic region.\nIn their fleet of more modern buses, they offer each passenger\nan in-seat Android multimedia tablet, running in kiosk (restricted) mode. The tablet runs a full-screen custom application,\nthat has menu items for common entertainment options like a web browser, movies and music.","md","\u002Fcontent\u002F2020\u002Fbuspad\u002Fheader.jpg",{},"\u002F2020\u002Fbuspad-kiosk-bypass","about 6 minutes",{"title":23,"description":397},"2020\u002Fbuspad-kiosk-bypass","Evading kiosk mode in Android tablets in bus entertainment system",1142,"j6aStu8mOHvwnb9Tp2Yp945dGzncNUDQ6Z_NBdG3lJs",[409,413],{"title":410,"path":411,"stem":412,"children":-1},"Secure Christmas","\u002F2018\u002Fsecure-christmas","2018\u002Fsecure-christmas",{"title":414,"path":415,"stem":416,"children":-1},"eCoop open redirect and XSS on login page","\u002F2020\u002Fecoop-xss-on-login-page","2020\u002Fecoop-xss-on-login-page",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":418},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 19l-7-7l7-7m7 7H5\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":420},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14m-7-7l7 7l-7 7\"\u002F>",1790886931244]