How to Hack the Hudl – We give Rockchip a good seeing to

If you were to have a list of devices that should not go anywhere near a corporate network, or access your Gmail, LinkedIn etc. from, make sure that supermarket Android slabs are on it. They are bad news whether you’re a corporate BYOD user, or a regular homebody who wants a budget tablet. Retrieving credentials is trivial, whether they’re for your Twitter account or your corporate domain.

Why so serious?

There’s no sugar coating this: If you want a device where you can read everything direct from memory (that’s a bad thing BTW) then these babies are the very thing. The device we’re looking at is Tesco’s Hudl tablet, but the problem extends to all mobile gadgets running the Rockchip chipset.

In this post we’re going to show you how easy it is to attack a device that has been plugged into a network, to retrieve all that lovely sensitive data. It involves a slightly fiddly hardware attack to put it in Flash mode, before going straight into memory access and retrieval. We don’t even need to bypass a PIN code.

Basically this attack is all about abusing Flash mode on Rockchip based devices to read the contents of the SSD. If you haven’t already thought “WTF?” I’ll repeat that last bit: Abusing the Flash mode of Rockchip based devices to read the contents of the SSD.

Let’s talk about Rockchip

Rockchip is a series of system on chip integrated circuits that pretty much comprise of an ARM processor and simple interfacing to disparate hardware. This allows hardware manufacturers to quickly create cheap devices that can run Android or similar low powered OSs, including Kali.

Just to show it in use, we can see the main IC, mounted on an MK809 TV dongle:

If you check the Wikipedia page about Rockchip, it lists a selection of devices that use Rockchip, most of these are smaller tablets that I’ve never heard of, but there are some interesting names: HP Slate 7, Toshiba Excite 7 and the Tesco Hudl.

Now, a lot of people own a Hudl, 500,000 people in fact, and I’m one of them, although I mainly use it as a wall mounted clock and music player in my home office. Here it is in a photo showing that I really need to repaint my walls:

So, what’s the problem with Rockchip? This problem is something called Flash mode (and also mask mode, but we’ll talk about that later). This is a special mode of the chip which allows its firmware and the internal NAND of the device to be written to.

Now there’s nothing fundamentally wrong with this, after all Android has fastboot, which is an official server and protocol for Google branded phones; Samsung has Odin which is similar to fastboot; but, there are two problems with Rockchip’s flash mode:

1. It does not have a form of OEM lock/signed only writes.
2. It allows the reading of data from the internal NAND of the device.

The first allows us to take a device and upload a maliciously constructed partition (an evil maid attacker). The second allows us to directly read the contents of the device!

Internally most modern phones have an internal NAND chip which acts as a solid state disk. Android splits this up into partitions that are designed for specific purposes. The one we’re interested in is the userdata partition, which mounts at /data on Android and contains all the device’s apps and data, basically it’s heart, brain, and soul.

How do we read this data?

The first step is to put the device into flash mode. This is usually performed by pressing a button whilst the device is being powered on. On the Hudl this is achieved by holding down Volume Up, while doing a hard reset on the “hidden” reset button. I use a SIM card removal tool as it’s about the right size. The end of paperclip will work too.

These buttons are device dependent, as an example, here are the locations from the three Rockchip devices I own.

The Hudl, press and hold volume up and put a pin in the hole:

For an MK808 (my version actually runs Kali, but that’s a story for later), press and hold the button with a pin whilst inserting the USB cable that provides power:

For an MK809, remove the cover and press the button mounted on the circuit board whilst inserting the USB power cable:

Getting this to work is a bit of a fiddle and it has a habit of stopping working for no obvious reason

What can happen in Flash mode?

Once the device is in Flash mode, it can be accessed using a selection of software tools, including the official Rockchip Batch Tool. I don’t use this as the drivers are quite dodgy and don’t like 64 bit Windows. Fortunately the protocol has been reversed engineered by the community and you can get an open source command line tool for Linux, rkflashtool. Unfortunately its command line interface isn’t the best (I keep meaning to fork it and rewrite it).

The first step is to make sure you’re connected by dumping the parameter block, which is the first block on the NAND and contains the boot command line, which includes the partition table (this sample is from an MK809):

Of most interest here is the partition table listed on the command line, the format is size@offset(name), so for, say the kernel partition:

This means that the partition starts at block 0x4000 and is 0x4000 blocks in size. A block is 512 bytes, this allows us to calculate the partition table:

(The user partition ends at the end of the storage, which is 8 GB on this device, which in 512 byte blocks works out as 0x1000000.)

Without going into too much detail about the internal gubbins of Android; the most important partitions to us are:

1. system – this contains the Android operating system, which is normally mounted as read only. We can use this to read the OS, write custom binaries (such as a copy of su) and then flash it back to gain root access to the device.
2. userdata – as mentioned above, this is the data partition which contains all the apps, their files and all user configured files.
3. user – this is the virtual “sdcard” for the device, which is where Android will store shared data such as photos and music.

The extraction

Once we know where they are we can extract those partitions using rkflashtool to read it to a file:

Android can store file systems in a number of ways, the most common being:

1. yaffs – which can be read through a third party reader, was used extensively prior to Android 4.0.0.
2. ext4 – the standard Linux file system, which can be mounted in Linux.
3. ext4 with reduced sparse files – this is the default in stock Android after 4.0.0. It can be converted to ext4 with easily available tools.
4. FAT32 – for the “sdcard” which can easily be read.

Fortunately all the Rockchip file systems I’ve seen are standard ext4. This means that they can easily be mounted under Linux using the loopback mounting facility:

For further confirmation this is the WPA key extraction:

…and this is the hash of the PIN:

And, there we have it: if I can get your device I can access all your data without even unlocking the screen.

An alternative route

Not all Rockchip devices have a special button for placing the device in flash mode, but they all have something called mask mode. Mask mode is an emergency boot loader where, upon booting,

the device cannot read from NAND. There isn’t much to differentiate mask and flash mode, other than how to get into it.

Most storage chips can be forced to return no information if the ready/busy pins of the chip are shorted out during a read operation (note, this may erase the NAND chip, this depends on the NAND in use).

To do this we need to short out pins 6 and 7 of the NAND chip during the power-on boot, using something small and metal like a paper clip or SIM removal tool. This isn’t easy because we’re talking small contact areas in close proximity to others. Below is an image taken through a microscope showing which pins need shorting out, and the end of a SIM removal tool for size comparison:

Conclusion

Is there anything you can do to secure the Hudl? At the moment I’m not sure that there is. I use mine only for browsing, playing music and as an alarm clock. Suggest you do the same.