So you’ve been rooting devices eh? If you get caught you’re headed for the big house, the lockup, the pen, the joint, they’ll send you up the river, you better be careful! Seriously though, if you buy a device and circumvent the security features should that in itself be breaking the law? We’re not talking about stealing intellectual property, like playing copied games on a chipped system (yeah, that’s stealing). We mean unlocking a device so that you can use it for what you wish. Be it your own prototyping, or running open-source applications. Unfortunately if the current Digital Millennium Copyright Act exemptions expire it will be a crime.

Thankfully, [Bunnie] is doing something about this. You may remember him as the guy that found most of the ridiculous security holes in the original Xbox, or the brain behind the Chumby. Now’s he’s got an online petition where your voice can be heard. Speak up and let the US politicians know why unlocking a device isn’t a crime.

[via Twitter]

The Kindle Touch has been rooted! There’s a proof video embedded after the break, but the best part about this discovery is that [Yifan Lu] wrote in-depth about how he discovered and exploited a security hole in the device.

The process begins by getting a dump of the firmware. If you remove the case it’s not hard to find the serial port on the board, which he did. But by that time someone else had already dumped the image and uploaded it. We guess you could say that [Yifan] was shocked by what he found in the disassembly. This a ground-up rewrite compared to past Kindle devices and it seems there’s a lot to be hacked. The bootloader is not locked, but messing around with that is a good way to brick the device. The Javascript, which is the language used for the UI, is not obfuscated and Amazon included many hooks for later plugins. Long story short, hacks for previous Kindles won’t work here, but it should be easy to reverse engineer the software and write new ones.

Gaining access to the device is as easy as injecting some HTML code into the UI. It is then run by the device as root (no kidding!). [Yifan] grabbed an MP3 file, changed its tag information to the HTML attack code, then played the file on the device to exploit the flaw. How long before malicious data from illegally downloaded MP3 files ends up blanking the root file system on one of these?

[via Reddit]

Jailbreaking hacks have come and gone for the Wii, ever changing as Nintendo tweaks their software to prevent homebrew from running. Piracy concerns aside, there is a legitimate Wii homebrew scene, and a  new, easy to use tool has been released for those looking to give it a try.

Many of the previous jailbreaks relied on bugs found within official Wii games, but there’s a new kid on the block that requires nothing more than an Internet connection and an SD card. LetterBomb is the latest jailbreaking tool, which was created by an individual named [blasty]. It seems incredibly easy to use, requiring little more than entering your Wii’s MAC address into a web form. The site generates a customized jailbreak file, which your run on your Wii via the SD card – that’s all there is to it!

If I had a Wii, I would be hesitant to enter any sort of globally-unique number that could identify my console into a random web site, but perhaps I am being overly paranoid. Either way, it would be great to see an open-source version of this tool released so that jailbreaks could be done offline, without any risk of having your MAC address recorded.

[Thanks, blurry]

LG released a line of Internet-connected TVs in both the US and Europe that utilize Yahoo TV widgets to bring interactive content to the living room. While it sounds like a great idea in theory, users have been disappointed to find that LG has approved a measly 15 widgets since the TVs were released.

OpenLGTV.org.ru user [xeros] has started working on a project that aims to enable more useful content as well as homebrew widgets. The project is known as OpenLGTV BCM, and not only covers LG television sets, but all sets based on the Broadcom platform.

A ton of progress has been made already, as they have been able to install their own busybox environment as well as open the sets to accept more widgets via some clever signature spoofing. The ultimate goal for the project is to completely divorce the sets from the Yahoo platform and replace it with their own open marketplace.

It’s a great start, and we can’t wait to see what sort of progress they make as time goes on.

[Thanks, T]

Sony Ericsson recently added a new section to their developer world portal called Unlocking the boot loader. They provide all the information and tools needed to root some of their newer Android phones.

Of course, this information comes from Sony Ericsson dripping with warnings, disclaimers and warranty-voiding rhetoric. Once you’ve waded through all of that, you’ll have to enter your phone’s IMEI number, your name and email address in order to get your phone’s unique bootloader unlock key. Here’s hoping they don’t use the form information to instantly void warranties.

Unlocking doesn’t come without consequences, but from UI tweaks and performance improvements to custom apps and tethering, there are probably more reasons to unlock your Android device than there are reasons to leave it alone. In an age where people are making a fuss about companies adding stumbling blocks for would-be jailbreakers, it’s good to see that at least one of them is doing what they can to help hackers take the plunge. Anyone want to clear up why Sony Ericsson feels like supporting hackers but Sony sues people for doing similar things on the ps3?

Thanks to [flip] | remixed image credit (cc by-sa 2.0): [taka@p.p.r.s]

In the constant battle of manufacturers vs. jailbreakers, the turnaround time between a new software release and a new jailbreak seems to be getting shorter and shorter. [Yifan] noticed that a recent Kindle update broke a previous method of running unsigned code and started the search for a new workaround.

He eventually found a way to force the Kindle to run unsigned code based upon how the software update checked for digitally signed files. With that knowledge in hand, he discovered that he could trick the updater to run any file he wanted by exploiting the standard functionality found in the Unix ‘cat’ command.

On his site, [Yifan] provides more details, source code, and a compiled update file that performs the jailbreak for you. Much like the previous jailbreaks we have featured, it is perfectly legal to do, but you do risk voiding your warranty during the process.

[Picture via Amazon.com]

[Deeper-blue] has released all the files necessary to get Android honeycomb working on your nook color. We had a chance to play with the nook color for a bit, but ours was only on Android version 2.1. It seems like they’ve come a long way with the capabilities of this simple e-reader since then.  While he’s built out the majority of the features, it is still lacking some fundamentals, like sound. As you can see in the video after the break, the scrolling is a tiny bit choppy but the applications themselves see to be fairly snappy. We can’t wait to see how this works after a little improvement.

[via engadget]

The g2 has finally been rooted. Even though a temporary root exploit was found shortly after the phones release, a NAND lock prevented modifying the non-volatile RAM for a permanent root. Some controversy surrounded the g2 when it was erroneously thought to have a rootkit protecting the OS.  Supposedly the rootkit would watch for changes to the file system and then reset the phone to default settings when any unauthorized changes were made.  On the other hand a NAND lock functions by fooling the operating system into thinking there isn’t any memory available, essentially “locking” the memory in key areas.  Once it was discovered to have the NAND lock it was only a matter of time before the g2 was permanently rooted.  NAND locks have become a popular (and unsuccessful) deterrent employed by device makers to stop the jailbreaking comunity.  While this exploit is nothing groundbreaking it is another notch in the belt for the jailbreaking community and a welcome benefit to g2 users.

The newest member of the PS3 jailbreaking tool crowd is the iPod family. More specifically, iPods running the open source media firmware Rockbox. Even better news, theoretically it should be possible to use this same method on any MP3 player running the Rockbox software. Right now the exploit package only works on select generations of the iPod Nano and iPod Classic line, but if the trend set by the PSX-scene forums continues, it would be worth checking back in the near future if your device is not already supported. Thanks to [shuffle2] for providing the hack, and [DanAdamKOF] for the heads up.

If Apple isn’t your device of choice, you can also check out some of your other jailbreaking options.

[Nicholas Petty] has posted a guide to setting up your iPhone as a penetration tester. You already carry it around with you and, although not too beefy, it does have the hardware you need to get the job done. So if you’re not interested in building a drone or carrying around a boxy access point try this out. The first step is to jailbreak your device and setup OpenSSH so that you can tunnel in for the rest of the setup. From there the rest of the setup is just acquiring build tools and compiling pentesting programs like Aircrack-ng, Ettercap, Nikto2, and the Social Engineering Toolkit. You’ll be up to no good testing your wireless security in no time.

It’s finally here, after being declared completely legal to jailbreak your iPhone, JailbreakMe 2.0 is released.

Now, any and all iDevices can be jailbroken by simply visiting the URL above; however, before you start your devious adventure in the land of apps not approved by big brother Apple, there are a few issues.

The webpage is being slammed at the moment so you’ll have to wait. There is a chance the jailbreak will not work, and you could brick your phone. MMS and Facetime are having complications after jailbreaking. And finally, carrier unlock still needs to be done with ultrasn0w.

But beyond those small stepping stones, jailbreaking is just a touch away.

For those living under a rock, the latest ‘greatest’ news to hit hacking front page is the the Copyright Office granting Six Exemptions Regarding the Circumvention of Access-Control Technologies. Of the six the one of the two regarding iPhones is as follows,

“(2) Computer programs that enable wireless telephone handsets to execute software applications, where circumvention is accomplished for the sole purpose of enabling interoperability of such applications, when they have been lawfully obtained, with computer programs on the telephone handset.”

Which (along with section 3) really just means that you can unlock and crack cellphones and companies can no longer fine you $2,500. Not that many ever have but the threat was there. Apple however, can and still will void your warranty if you jailbreak.

The 4 other areas not involving phones are the ability to circumvent DVDs for portions of video, video games in order to better the security of said game, computer programs that require dongles but dongles are no longer available, and literary works that prevent read-aloud or rendering to a specialized format.

One tidbit I keep hearing about in these exemptions is the ability to now break DRM on music, as much as I wish this were true, I can’t seem to find any sources on it, sorry pirates.

Regardless, now that the world is one step closer to an open framework, whats changed? For me, I’ve been jailbroken for years so sadly nothing. If you agree with the ruling, disagree, or just want to tell about your now legal jailbreaking joys, please leave a comment.

Additional Sources: FOXNews and CNNMoney thanks to [Voyagerfan99], [Ryan Knight], and [Steve S.] respectively.

[Image credit: Fr3d.org]

A method to Jailbreak the new 3.1.3 iPhone rom is here and it does away with tethering. Tethering is the problem that arose from the blackra1n exploit requiring a computer to reboot the iPhone. Although we saw a hardware workaround for that, it’s much nicer to do away with the issue completely. The new exploit is called Spirit and we found the site was getting hammered earlier so you should check out the writeup over at Redmond Pie if you can’t get through with the link at the top.

[Thanks Xb0xGuru via iPhone Hacks]

This device can jailbreak an iPhone. It doesn’t require a computer and it can either reboot a phone that was one-time-boot jailbroken using the blackra1n exploit, or jailbreak a factory fresh unit. We wouldn’t say this solves the tethering problem caused by blackra1n (needing to return to a computer to reboot the phone), but it certainly does ease the pain. We saw some info about the board layout but no parts list or firmware. See the demo after the break and leave a comment if you have more information on the parts or code.

[Thanks Juan]

[ZodTTD] has released a Nintendo 64 emulator for iPhone. It is available (for a price) at the Cydia store and can be installed on jailbroken iPhones. The video shows Wii Remote support as a control interface that uses both buttons and the accelerometer, an addition since we last looked at his work. There is no word about nunchuck functionality, a must if you’re going to try to 100% Mario64.