Set-top box Hacking: freeing the 'Freebox'

Set-top box Hacking: freeing the 'Freebox'

Speakers: Frédéric Hoguin

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=V93pNsjgJXA

Overview

This talk, "Set-top box Hacking: freeing the 'Freebox'," presented by Frédéric Hoguin at 39C3, details a comprehensive journey into reverse engineering and exploiting the Freebox HD, a pioneering triple-play set-top box from French ISP Free. The presentation chronicles a multi-stage attack, starting from a user's frustration over restricted features and escalating into a full root compromise of the device, culminating in the ability to reclaim user control over personal video recordings and uncover deep architectural secrets.

The speaker's motivation began with the arbitrary removal of a beloved feature: downloading recorded TV programs via FTP. What started as a personal quest to restore functionality evolved into a deep dive into the device's software and hardware, revealing several critical vulnerabilities across user-space applications and the Linux kernel. This article explores the ingenious techniques employed to bypass security measures, from game save file exploits to kernel privilege escalation and intricate network access bypasses, ultimately demonstrating how determined users can reclaim ownership of their devices and data.

The significance of this research extends beyond a single set-top box model. It highlights persistent security weaknesses in embedded systems, particularly the dangers of inadequate input validation, outdated software components, and insufficient kernel hardening. Hoguin's methodical approach serves as a valuable case study for security researchers and developers, illustrating the importance of comprehensive security postures from application layer down to kernel space, and the persistent challenge of securing devices that remain in deployment for extended periods without adequate updates.

Background

▶ Watch: Introduction to Freebox HD and its features (0:00)

The Freebox HD, released in 2006 by the French ISP Free, was an innovative device for its time, offering triple-play services (internet, phone, TV over IP) and advanced features like a Personal Video Recorder (PVR) with a 40 GB hard drive, time-shifting, and an integrated FTP server for media transfer. Uniquely, it also supported running classic games like Doom and Duke Nukem 3D, and provided a limited Software Development Kit (SDK) for interpreted programs within a sandbox.

The speaker's journey began when Free, under pressure from private TV channels TF1 and M6, disabled the ability to download recorded programs via the FTP server. While recordings were still possible, the inability to easily transfer them to a PC for viewing on a better screen was a significant downgrade. Initial attempts involved physically removing the hard drive, which was found to contain three XFS partitions: two small, encrypted ones and a third, unencrypted partition (private_records) holding the recordings. Analysis revealed that the FTP server simply refused to list files owned by root, indicating a simple permissions-based restriction rather than true encryption on the recordings themselves. This "FTP with extra steps" was deemed unsatisfactory, prompting a deeper investigation.

Frédéric Hoguin, acknowledging that the Freebox legally belonged to Free and was merely lent to subscribers, committed to a soft-mode exploitation without any hardware modifications. His initial research involved checking prior work, leading him to the Open Freebox team, who had explored older Freebox versions but lacked significant findings for the Freebox HD (V5). Reviewing the GPL-licensed software components, he identified a MIPS CPU (SMP 8634) running Linux 2.6.31, BusyBox, and the Doom source port PRBoom. Although common libraries like libjpeg and libpng were present, they had already been extensively audited by Google Chrome and patched, making zero-day discovery impractical. This led the speaker to focus on a less scrutinized entry point: game save files.

Key Findings

▶ Watch: First attempt: physical hard drive extraction (3:30)

The core of Frédéric Hoguin's research uncovered a series of critical vulnerabilities and architectural weaknesses that allowed for full system compromise:

1. PRBoom Save File Vulnerability (Arbitrary Pointer Control): A critical flaw was identified in the PRBoom game's save file loading mechanism. The game saved a P_SPRITE state index, which was then converted back into a pointer to a global states array upon loading. Crucially, there was no bounds checking on this index. By manipulating the save file, an attacker could inject an arbitrary index, leading to the reconstruction of an arbitrary pointer. This allowed control over the state_t structure, including its action member, which was a function pointer called as a callback. This effectively provided arbitrary code execution in user space.

1. Absence of NX Protection and Stack Canaries: The MIPS CPU in the Freebox HD lacked NX (No-Execute) protection, meaning memory pages were not marked as non-executable. This allowed injected shellcode to be executed directly. Furthermore, the Linux kernel on the device did not employ stack canaries, making stack-based buffer overflows a viable method for control flow hijacking.

1. HFS+ Kernel Privilege Escalation (Stack-Based Buffer Overflow): A stack-based buffer overflow was discovered within the Linux kernel's HFS+ filesystem driver, specifically in the HFSPlus_read_inode function. By crafting a malformed HFS+ filesystem image on a USB drive, an attacker could control entry_offset and entry_length variables, overflowing a stack-allocated entry variable. This allowed overwriting the return address on the kernel stack, leading to arbitrary code execution in kernel mode.

1. Chroot Jail Bypass and Root Privileges: The PRBoom application ran within a chroot jail as user 4242. To break out, root privileges were required. After gaining kernel-mode execution via the HFS+ exploit, the attacker could modify the task_struct of the running process to set its effective UID to 0 and enable all capabilities (e.g., CAP_SYS_CHROOT), effectively gaining full root access and the ability to escape the chroot.

1. Weak Default Credentials and Network Segmentation: The device's root password was found to be 42, although it was only present in plaintext in passwd as a joke, and SSH only allowed public key authentication by default. Network access to the SSH server was further restricted by a custom firewall (libFBX_netrap) and required a specific VLAN (100) configuration with IPSec and a narrow IP range (172.16.12.x). The speaker devised a complex gateway computer setup to bypass these network restrictions.

1. Reclaiming Recordings: With root access, the configuration file for the PVR service, located on an encrypted hard drive partition, was modified. The PVR_mode setting for specific channels like TF1 was changed from private to public, restoring the ability to download recordings via FTP. The encryption keys for the hard drive partitions were also easily extracted using device-mapper once root access was established.

Technical Deep Dive

▶ Watch: Hard drive analysis: root-owned recording files (4:20)

The technical deep dive into the Freebox HD compromise unfolds in several intricate stages, each building upon the previous one.

The PRBoom Save File Exploit

The initial entry point leveraged the PRBoom game, which ran on the Freebox HD. The speaker identified a critical vulnerability in how the game handled save files. When a game state is saved, the P_SPRITE structure, which represents the player's weapon sprite, contains a state field that is a pointer to a global array of state_t structures. Since pointers cannot be directly saved and reloaded across different memory layouts, PRBoom converts this pointer into an index into the global states array.

The crucial flaw emerged during the loading process: when the save file is loaded, the stored index is converted back into a pointer without any bounds checking. This means an attacker could modify the index in a crafted save file to point to an arbitrary memory address. The state_t structure, which the attacker could now control, contains an action member, which is a function pointer. This action pointer is called as a callback by the P_MovePsprites function, providing a direct path to arbitrary code execution.

To exploit this, two main challenges had to be overcome:

1. Memory Address Leakage: The attacker needed to know where their crafted state_t structures and shellcode payload would reside in memory. The speaker devised an ingenious technique using WAD files. WAD files are containers for game assets, and PRBoom would load them into memory. By creating two types of large WAD files (one filled with zeros, another with garbage data) and observing the game's behavior (weapon disappearing for zeros, crash for garbage), the speaker could map valid memory regions. This allowed for heap spraying, maximizing the chances of the crafted index hitting a controlled memory region. A 33 MB WAD file was used to contain the first crafted state_t, and another for the second state and the final MIPS assembly payload.

1. NX Protection Bypass: The speaker initially assumed, correctly, that the MIPS CPU might lack NX (No-Execute) protection. This proved to be true, simplifying the exploit development significantly as injected code could be executed directly from data segments.

The final payload was a simple MIPS assembly program designed to create a file (e.g., /tmp/hacked.txt) that could be observed via the FTP server. MIPS assembly is complex, requiring specific instructions (like aui for program counter retrieval) and NOP operations after branch instructions due to the architecture's branch delay slot. The successful creation of the file confirmed the arbitrary code execution and the absence of NX protection.

Chroot Jail Breakout and Kernel Privilege Escalation

While arbitrary code execution in user space was achieved, the PRBoom process ran within a chroot jail as user 4242, severely limiting access to system resources. To break out and gain full control, root privileges were necessary. Standard methods like SUID binaries were not feasible as all mounted partitions enforced noexec and nosuid flags. This necessitated a local privilege escalation (LPE) vulnerability in the Linux kernel.

The speaker focused on filesystem modules, reasoning that USB drives present untrusted data to the kernel. After examining several filesystems, HFS+ proved promising. The vulnerability was found in the HFSPlus_read_inode function, which is called when enumerating files in an HFS+ directory. This function allocates a structure on the stack and then reads data from the USB drive into it. Crucially, the entry_offset and entry_length fields, which control the read operation, were derived from the untrusted filesystem data. By crafting a malformed HFS+ directory entry, an attacker could trigger a stack-based buffer overflow, overwriting the function's return address.

Again, the absence of stack canaries on the MIPS kernel was a critical enabler. The overflow allowed the attacker to redirect execution to an exploit callback function loaded at a known address (e.g., 0x600000) within the user-space program.

However, even with kernel-mode execution, the process's UID remained 4242. The kernel still enforced permissions based on this UID. To truly gain root, the task_struct (which holds process credentials) needed to be modified. In the MIPS Linux implementation, the current_task pointer is conveniently stored in the GP register upon entering kernel mode. The exploit callback could read this register, locate the task_struct, and then determine the offset of the credentials field by analyzing the kernel's disassembly (specifically, the sys_setuid function). Finally, the exploit would set the process's UID to 0 and enable all capabilities (including CAP_SYS_CHROOT) to bypass the chroot jail. This allowed the user-space process to effectively become root and escape its confinement.

Network Access and Configuration

With full root access, the speaker could explore the system. The device ran a custom Linux distribution with a read-only root partition and BusyBox. An SSH server (Dropbear) was running, and a root user existed. The password was humorously 42, but Dropbear was configured for public key authentication only. To gain password-based SSH access, the Dropbear binary itself had to be patched to accept any password.

Network access was surprisingly complex. The Freebox HD used VLAN 100 and IPSec for communication with the Freebox server. A custom firewall, libFBX_netrap, further restricted SSH access to a specific internal IP range (172.16.12.x). The speaker devised a sophisticated gateway computer setup to bypass these restrictions:

1. Allow the Freebox HD to boot and obtain its IP address via DHCP from the legitimate Freebox server.
2. Remove the Freebox server from the network.
3. Introduce a gateway computer configured with:

• VLAN 100 and the Freebox server's IP address.
• IPSec keys (extracted from the Freebox HD).
• VLAN 70 with an IP address in the 172.16.0.1 range.
• IP forwarding enabled.

1. Connect the attacking computer to the gateway computer via VLAN 70.

This multi-VLAN, IPSec-tunneled setup successfully provided SSH access to the Freebox HD, bypassing all network-level restrictions.

Reclaiming Recordings and Further Discoveries

With SSH access as root, the speaker could finally address the initial goal: reclaiming recordings. The PVR service's configuration file, located on one of the encrypted hard drive partitions, was modified. The PVR_mode for channels like TF1 was changed from private to public. This immediately restored the ability to download recorded programs via FTP. The encryption keys for the hard drive partitions were also easily retrieved using the device-mapper interface, ensuring future access even if the device was disconnected.

Further discoveries included a custom HTTP server named "chain" providing an RPC interface, likely used by customer support for actions like rebooting or displaying messages on the panel. The speaker also noted the presence of developer public keys in the SSH configuration, suggesting potential backdoor access for Free's internal teams. While the possibility of accessing other Freebox devices via the IPSec tunnel was theorized, the speaker refrained from testing this beyond his own device due to ethical and legal concerns.

Demo / Proof of Concept

▶ Watch: Leveraging community research and GPL disclosures (7:25)

The talk showcased several compelling demonstrations of the achieved exploits:

1. File Creation via PRBoom Exploit: The initial, simplest exploit involved a crafted PRBoom save file that, when loaded, executed MIPS assembly code to create a file at /tmp/hacked.txt. The speaker demonstrated this by connecting via FTP and listing the newly created file, proving successful arbitrary code execution in user space.

1. Visual Exploit on Front Panel: To make the exploit more visually impactful, the speaker developed a more advanced MIPS assembly payload. This payload leveraged the device's front panel display library to display custom messages and animations, visually confirming the compromise of the Freebox HD's user interface. The audience witnessed the Freebox HD's front panel displaying "HACKED" messages and blinking, clearly indicating the successful execution of arbitrary code.

1. Root File System Access: After achieving kernel privilege escalation, the speaker demonstrated full root access by showing the root file system before and after the exploit. The "after" state clearly displayed access to previously restricted directories and files, confirming the successful breakout from the chroot jail and full system compromise.

1. Reclaiming Recordings: The ultimate proof of concept was the restoration of FTP download functionality for recorded TV programs. A screenshot showed a recording of TF1 now available for download via the FTP server, fulfilling the initial motivation for the entire hacking endeavor.

Defensive Implications

▶ Watch: Discovering CPU and OS details from GPL sources (8:30)

Frédéric Hoguin's research into the Freebox HD provides several critical defensive implications for embedded system manufacturers, ISPs, and users:

1. Rigorous Input Validation: The PRBoom save file exploit underscores the paramount importance of robust input validation. Any data read from external sources, even seemingly innocuous game save files, must be treated as untrusted. Pointers derived from user-controlled indices must always be bounds-checked to prevent arbitrary memory access and code execution.

1. Kernel Hardening: The discovery of a stack-based buffer overflow in the HFS+ kernel module and the absence of NX protection and stack canaries highlights the need for comprehensive kernel hardening. Embedded Linux kernels, especially those in long-lived devices, should incorporate modern security features like Address Space Layout Randomization (ASLR), NX, and stack canaries to mitigate common exploit techniques. Regular security audits of kernel modules, particularly filesystem drivers that process untrusted data, are crucial.

1. Secure Credential Management: The revelation of 42 as a "joke" root password, even if not directly usable via SSH, indicates poor security practices. Default credentials, even non-functional ones, should be avoided. All administrative interfaces should enforce strong, unique passwords or robust public-key infrastructure, and public keys for developers should be managed securely, ideally with per-device unique keys and strict access control policies.

1. Layered Network Security: The complex network setup involving VLANs, IPSec, and a custom firewall (libFBX_netrap) was ultimately bypassed. This demonstrates that network segmentation and encryption alone are insufficient if the underlying device can be compromised. ISPs must ensure that critical device management interfaces are not accessible, even indirectly, to compromised devices or through easily extractable keys. Zero Trust principles should be applied, even within internal networks.

1. Timely Patching and End-of-Life Management: The HFS+ vulnerability, though fixed by the kernel community shortly after discovery, was present in the Freebox HD for years. The talk underscores the challenge of patching long-lived embedded devices. Manufacturers must implement robust firmware update mechanisms and provide extended support for their devices. When devices reach end-of-life, they should be securely retired and replaced to prevent known vulnerabilities from being exploited.

1. User Empowerment and Transparency: The initial motivation for this hack was the removal of a user-desired feature. While security is paramount, manufacturers should consider user needs and be transparent about feature changes, especially for devices users "rent" and expect to have some control over.

Key Takeaways

• Input Validation is Critical: Never trust user input, even from seemingly benign sources like game save files. Lack of bounds checking on indices can lead to arbitrary memory access and code execution.
• Kernel Hardening is Essential: Embedded Linux kernels require modern security features like NX protection, stack canaries, and ASLR to prevent common exploitation techniques. Regular audits of kernel modules, especially filesystem drivers, are vital.
• Layered Security Can Be Bypassed: Complex network security (VLANs, IPSec, custom firewalls) can be circumvented if a device's core software is vulnerable and credentials (like IPSec keys) can be extracted.
• "Security by Obscurity" Fails: The 42 root password and reliance on complex network configurations did not prevent a determined attacker with local access from achieving full compromise.
• User Control Matters: The primary motivation for this extensive hack was the arbitrary removal of a user-desired feature, highlighting the tension between manufacturer control and user expectations for rented devices.
• Long-Lived Devices Pose Risks: Embedded devices with long lifespans often run outdated software components, making them susceptible to vulnerabilities that have long been patched in mainstream distributions.

About the Speaker(s)

Frédéric Hoguin is the speaker for "Set-top box Hacking: freeing the 'Freebox'." Based on his presentation, he is a dedicated and methodical security researcher with a deep interest in embedded systems and reverse engineering. He describes himself as a "geek" and his motivation for this extensive project stemmed from a personal desire to reclaim functionality on his Freebox HD. His approach highlights a strong commitment to soft-mode exploitation and a cautious, ethical stance regarding the broader implications of his discoveries, particularly concerning other users' devices. His work demonstrates a high level of technical proficiency in areas like MIPS assembly, kernel exploitation, and complex network configuration. The talk was his first time presenting this research, which he conducted between 2011 and 2012.