Security News > 2020 > October > Authentication Bug Opens Android Smart-TV Box to Data Theft

The streaming box allows arbitrary code execution as root, paving the way to pilfering social-media tokens, passwords, messaging history and more.

A critical bug in the Hindotech HK1 TV Box would allow root-privilege escalation thanks to improper access control.

The HK1 Box S905X3 TV Box is an Android-based streaming box that plugs into a TV and allows users to access YouTube, Netflix and other streaming content "Over-the-top," i.e., without a cable subscription.

At issue is a lack of authentication when it comes to the debugging functions of the set-top - specifically, when connected to the device through the serial port, or while using the Android Debug Bridge, as an unprivileged user.

"A local attacker using adb, or a physical attacker connecting to the device through the UART serial debugging port, is dropped into a shell as the 'shell' user without entering a username or password," researchers explained.

News URL

https://threatpost.com/authentication-bug-android-smart-tv-data-theft/160025/