Rabbit R1 hacked using old vulnerability avoid second-hand devices
17-July-24
Rabbit R1 runs on the MediaTek MT6765V SoC, which has eight Arm cores in a big.LITTLE configuration, similar to the ones used in budget phones a few years ago.
The exploit allows an attacker with physical access to the device to obtain the highest privileges, access and edit storage contents, and modify the device’s firmware.
“Such a vulnerability allows a third party with physical access to modify the device firmware to add malicious code. That includes not only applications but malicious code could also be injected into the kernel or system processes,” researchers said.
Kamakiri is a widely used exploit to hack and modify Android devices. It allowed researchers to dump Rabbit R1’s original firmware, modify it, disable Android Verified Boot, install and run the altered firmware.
Tinkerers use such exploits to gain root privileges, change settings, install custom OSes, and add features or apps. For example, a jailbroken Rabbit R1 could be overclocked, run the TikTok app, NES emulator, or any other code. However, malicious actors can also find many uses.
“The vulnerability effectively bypasses owner protections and allows thieves to erase, factory reset and resell the device, negating the ‘Mark as lost’ functionality. Buying the device secondhand comes with great risk, as users won’t be able to check if the device has been tampered with and what software is running on it,” researchers warn.
Hackers could quite easily modify the device with backdoors tracking all user activity on the device, remotely access the microphone, camera, and inputs, scan the home network for other devices and vulnerabilities, carry out DDoS attacks, or use the AI in the box for other nefarious purposes.
Although tech reviewers may not have given the Rabbit R1 favorable feedback, the developers at Rabbit Inc. are adding new features and claim that it’s the best-selling AI device, with more than 100,000 units sold. An initial review of the device revealed that Rabbit OS runs on Android 13, released on August 15th, 2022. Its most recent security patch is dated May 5th, 2023.
The firmware contained a largely unmodified Mediatek Board Support Package, with a handful of apps installed. The user primarily interacts with the RabbitLauncher APK, which acts as a user interface and handles the connected experiences with Rabbit’s servers. This app handles all the logic and functionality of the device.“While trying to interact with the device, we discovered that a USB connection can be established when the device is turned off. Public Kamakiri exploits allow bypassing of authentication and security checks, as well as accessing the storage of the device. Dumping the original firmware took over 24 hours using specialized tools. However, it was needed for an analysis and backup,” the report reads.The exploit enabled options for factory resetting the device and deleting user data and metadata.Together with MediaTek’s application suite, the device includes additional apps such as “RabbitLauncher,” “RabbitIme,” and “R1SystemUpdater”. The “Build.prop” file revealed system variables and configuration.
Sources on the internet suggested that changing the “ro.secure,” “ro.adb.secure,” and “ro.debuggable” variables enable ADB (Android Debug Bridge) on boot. The device firmware had ADB originally disabled. ADB is often used by developers to access various system functions that are not accessible to ordinary users.
“Once these changes were flashed onto the device, it loaded the fastboot mode and refused to boot the unsigned image. With some extra steps, we were able to disable Android Verified Boot and make the device boot to the new firmware. Other developers shared similar jailbreaks on GitHub,” researchers noted.
It demonstrates that it’s possible to install a regular Android Open Source Project on Rabbit R1, like on any other Android device, with any modifications. The Cybernews research team was able to add new apps and modify system settings. The device is also capable of running malicious code.
