Moritz Strohm

2016-05-11 11:01:38 UTC

Warning: Allwinner kernels have a backdoor!

If you're running an Allwinner SoC based computer (Cubieboard, Cubietruck, OrangePi, BananaPi or OlinuXino for example) you may gain root access easily with a simple echo command. Try the following command to check if you become root:
echo "rootmydevice" > /proc/sunxi_debug/sunxi_debug
You can check with the "id" command if you're root after running the command above. If so, you should switch to another kernel that doesn't have that backdoor.

For server systems you may use the mainline linux kernel if the Allwinner SoC on your computer is well enough supported. The Cubietruck will run fine with a mainline kernel and mainline U-boot when you're using it as a headless server. I tried to gain root access with the command above on a self-built mainline kernel and it doesn't work since /proc/sunxi_debug doesn't exist. You're probably safe when using the mainline kernel.

Resources:

• Twitter post showing the backdoor source code: https://mobile.twitter.com/DaveManouchehri/status/729453383799738369
• GitHub search result for "rootmydevice": https://github.com/search?q=rootmydevice&type=Code&utf8=✓
• Blog post saying linux-sunxi kernels are safe, too: https://olimex.wordpress.com/2016/05/10/how-to-root-any-allwinner-device-running-android-and-most-of-the-chinese-pi-clones-which-bet-on-allwinner-android-linux-kernel/

#Allwinner #SoC #Cubieboard #Cubietruck #OrangePi #OlinuXino #BananaPi

Twitter