yashsingh1/xdaforums huggingface dataset:
[Off-topic] CloneNum3:
Root Password up through 0.33

It's been great reading this thread! I'm glad to have found some people interested in this.

The root password from early realease 0.01? through 0.33-ish is "keep app"

Later logins appear to simply be blank... so if you have the tty enabled and "keep app" doesn't work, just hit enter at the password.

Idea:

1. Set the DNS server DHCP gives to the wink to your own DNS server.

2. Point wink-hub-images.s3.amazonaws.com to your own web server.

3. Store your own modified .ubi images with respective .xml files and proper md5sums

problem... /etc/ssl/certs/ca-certificates.crt lives locally on the wink and will reject my custom server. The concept is still valid if you can get root on the device at some point in time, should never lose root again if it never receives genuine update file again.

Current as of 1/6/2015 10pm EST

[root@flex-dvt platform]# curl --cacert /etc/ssl/certs/ca-certificates.crt --retry 5 hxxps:slashslashwink-hub-images.s3.amazonaws.com/00.01/upg
rade_00.01.txt
board_id=00.01
group_id=0
sw_pkg_url=hxxps:slashslashwink-hub-images.s3.amazonaws.com/00.01
fparts=4
alt_pkg_url=hxxps:slashslashhub-updates.winkapp.com/00.01
fdest0=/dev/mtd1
fver0=00.01
foff0=0
ftype0=0
fsrc0=updater-uImage
md5sum0=11b29593183c2b94a85b333c03a3b52c
fdest1=/dev/mtd2
fver1=00.05
foff1=0
ftype1=1
fsrc1=updater-rootfs.ubi
md5sum1=3b454483039b456ede6d0dbf019ec2c2
fdest2=/dev/mtd4
fver2=00.01
foff2=0
ftype2=0
fsrc2=app-uImage
md5sum2=11b29593183c2b94a85b333c03a3b52c
fdest3=/dev/mtd5
fver3=00.55
foff3=0
ftype3=1
fsrc3=app-rootfs.ubi
md5sum3=86442e13205e3c493b53e333b6478a7d
[root@flex-dvt platform]#

Something I like to do... lets the update scripts do their thing, but prevents the reboot so you can verify/re-root/etc before a reboot.

sed -i 's/reboot/#reboot/g' /root/platform/*.sh

/etc/shadow decrypted

.qrW7jrXfK1rA:keep app
bVn.vHIoFZcTA:
^^^^^ yes, blank, NULL ^^^^^^^^^

Appears even 0.05 appears to have tty enabled and root with no password. This means anyone who does not already have root but is being prompted for an update should in theory be able to accept the update on their phone, let the device reboot, and connect via the tty before it completes the update.

killall run_upgrade.sh # stops the update but may leave boot partition in an inconsistent state.
killall upgrade.sh # just to be safe
sed -i 's/reboot/#reboot/g' /root/platform/*.sh # Prevents reboot from occurring after the automated update process
/root/platform/run_upgrade.sh # this time, let it do the update
echo "1" > /database/DO_UPDATE # boot back to update partition in case power blinks or a reboot occurs for any reason before we're don rooting the regular boot partition.
### do your rooting of the root FS
echo "0" > /database/DO_UPDATE # boot normal
reboot # and cross your fingers you didn't miss anything

-CloneNum3

P.S. I'll try and post more stuff that I haven't seen in the thread.
[Off-topic] bigdog1155:
I was able to get advanced commands working and was able to enable getty on the serial console.

I can not for the life of me get connected to it with ssh.

no mater what I do I get the no supported authentication method error, I googled and I can't seem to find a good answer to how to fix it. I see others with the same problem. I have even ssh into another Linux machine and tried from it and I get the same error.

Also how can I tell what version of firmware I have ?

I got my Wink app to connect to the hub but it show an update required and won't let me add my light bulb.

Once I know how to connect with SSH I am going to follow the manual upgrade process.

I was able to get a bulb added in with aprontest but it would not turn on or off.

I also see where I might be able to use an older version of the wink app however I would like have new features and devices that they might add.

Can anyone help me ?
[Off-topic] berserko:
Your cerificate is corrupt echoing it in is breaking it. Just enable non certifcate logins and avoid the whole issue.

curl "http://192.168.0.1/set_dev_value.php" -d "nodeId=a&attrId=;sed -i 's/=-sg/=/' /etc/default/dropbear;/etc/init.d/S50dropbear restart;"

Once that is done login with your root credentials that you use in serial console.

When approximately did you upgrade it or did you ever upgrade it? If you haven't the short version is its very old. The didn't start leaving version numbers in the filesystem until later (not sure when) just follow the procedure here get up to 0.55 and then your problems are gone. No app nags and much more fuctionality.
[Off-topic] CloneNum3:
www rootwink com

www rootwink com

Please message me there if you would like to contribute beyond a normal user.

Newly created. I'll add content when I have time, but for now, it's a central place.

-CloneNum3
[Off-topic] bdjohns1:
So, to manually update the updater, I assume the basic workflow on a already-rooted wink hub itself should just be:

1) ssh/TTY login as root while the hub is running regularly.

2) curl to grab the updater fs

3) flash the updater fs to the right partition

4) mount the newly flashed updater fs and preserve root access, neuter the upgrade scripts to prevent reboot, make sure the exploitable php files are still present.

Sound about right?
[Off-topic] anthonylavado:
Agh. I forgot to mention here that I've helped set up a subreddit with a Wiki to come soon:

http://www.reddit.com/r/winkhub
[Off-topic] OuTTaRiCe:
For updater-rootfs. Yeah that's pretty much it.

Honestly, I do not see any advantage in updating the updater image however. There's nothing new that I can see.
[Off-topic] anthonylavado:
So it looks like the 00.55 update is starting to get pushed out to hubs.

I haven't seen the notification come up for mine yet, but when it does, I'd like to catch it during the update if possible.

I'm going to try:

redirecting the update server and text to my own local server, attempting to downgrade to a lower version

running some exploit commands while updating to catch it

It seems like it should be catchable while upgrading from what I've read, and if I don't grab it, it'll hopefully get downgraded.

At any rate, I'll get info about how the update gets signaled to hubs.

Any tips or suggestions?

What exploit commands should I run from my Mac while it's updating?
[Off-topic] wpskier:
I've been thinking about the same thing. I'm just going to try to stall the download as much as I can (rate-limit on my FW, I think), so I can hit the original exploit to add my SSH key, then log in and kill the curl and upgrade processes. From there, I'll root the existing image (I've got 00.47 on there now), then look at applying 00.55 via the upgrade script after commenting out the 'reboot' command at the end.
[Off-topic] OuTTaRiCe:
If you guys have UART, Following the last part of CloneNum3's post #84 should get you root.

Since tty is enabled and root password is blank under update-rootfs.
[Off-topic] anthonylavado:
Definitely don't have UART. I have a Nokia cable I got to get serial on my Pogoplug if things ever went awry. Haven't taken it apart yet. I just want to root to experiment, but I don't otherwise need anything else from it.

EDIT: The cable I have is the Nokia CA-42, I'll see if I can use this. I'd like to avoid opening my Wink hub, but if it comes to it...
[Off-topic] wpskier:
Hahah, nice. I didn't even think about that, to be honest. I have another hub here that I've got UART to, so yeah, that's super simple for me. Now I just need to wait until my Wink App shows the update is available.
[Off-topic] danimal4326:
I use my RasPi as a UART adapter. just ssh into it and then used minicom to communicate to the Wink
[Off-topic] bigdog1155:
It would seem that no mater what I set boot delay to it hangs.

Has anyone thought about or played with any pull up/down resisters on it ?

After I get mine upgraded to the latest version and working I plan on experimenting with it.
[Off-topic] caspiansan:
Rooted update images

A few people have talked about making rooted update images and redirecting the update server's hostnames to a local web server. Has anyone successfully done this yet? If so, could you post images & notes?

I rooted my brand-new wink hub yesterday, but so far I can't add any devices to it. Running aprontest -a -r XXX times out for all my devices, and the Android app says I need a software update before I can add any devices. I'm thinking the solution is to let it update, but force it to update to a rooted image I'm hosting on my network.

Thoughts? Is it better to just manually update the important files by hand from the official update image?
[Off-topic] OuTTaRiCe:
Since you are already rooted, you can manually update it.

however, updating is not necessary.

The workaround for the Update prompting is to do the following (where cf_fver3 is set to the latest firmware version):

echo "00.01" > /database/cf_build

echo "00.01" > /database/cf_fver2

echo "00.55" > /database/cf_fver3
[Off-topic] bigdog1155:
Thank you very much, I am now on version .055 and still rooted.

I used the update instruction you gave above.

They are not as clear as they could be and I added extra safe guards to keep rooted.

I will make some documentation for it later, I kept notes and logs of the system while it updated.

I had one bit of excitement during the process that could have killed it.

***********I had a POWER FAILURE while re rooting the rootfs********

On the first reboot after power up the router still had no power and it went into a loop on isalive.

I think it would have been ok if the router had power, but I killed processes that were flooding the screen with

isalive failure messages, so after I got the router up again I rebooted and everything went on its way.

lucky the upgrade reboot had been disabled already and I still had the serial console with a login

Note the password seemed to be disabled during the upgrade boot.

It booted and did not like something and re-downloaded the rootfs, I was able to go in and make

the rootfs changes when it got done but stopped because the reboots had been turned off.

Now I have a completely rooted hub, on version .055, newest wink app and everything seems to work

Two GE bulbs and 4 TCP connect bulbs, I am going to go get a smoke/carbon alarm in the morning.

Note after version .055 completed it has a completely new and redesigned /var/www directory

It is MISSING all the rooting EXPLOITS!!!!!! :(

I think that if did not have the console port or other root safe guards built in it would have been over.

Also the root password came on after the completed update.
[Off-topic] OuTTaRiCe:
Not true, It still exists under updater-rootfs image. Just mount it and copy the files over.

Not true, root password during update is blank, so just hit enter and you would've gotten in.
[Off-topic] bigdog1155:
Sorry, I guess I was not clear, because when I said password was disabled that to me is the same as blank.

Everyone be warned that after the update step is complete and the rootfs starts the password gets turned back on.

You should still be rooted and able to deal with that if everything goes ok.

And yes I knew that the php files for exploiting are still in the updater-rootfs and I copied them back as a safe guard.

But what this mean is that anyone who updates to .055 will not have any of the new exploits initial rooting if they have not been rooted already and taken precautions. Also any new units that come with .055 will be stuck.

That is until the next new exploit is found, There are a bunch of new php files in a directory name /var/www/Slim

WINK, if you are here listening.

I bought into this system because it could be modified. If you should manage to lock us out I will switch to other more open products.

I can always just scratch all the software off and load open source code on to the hub and repurpose it to something else.

Also I think it awful short sighted on the part of manufactures to use a product, Linux, that was created and brought to maturity by the open source community and then you turn around and try to lock us out. We are just the sort of people who will make your product shine with improvements and identify/fix bugs that you can then give back to the general population.

All you have to do is look around on the web at devices that have been exploited and modified to know that trying to lock it down

is a waste of your resources. That time can be better spend on new features and bug fixes.

---------- Post added at 05:43 PM ---------- Previous post was at 05:33 PM ----------

Has anyone used or setup any of the Kidde smoke/CO2 alarms with a wink hub ?

I only see one that is wink certified, are there any others that will work ?

I see many that will network with each other, I have read where they all have to be the same model, is that true ?
[Off-topic] berserko:
I have tried to get my Kidde working with no joy. Mine is the model that is electric and has battery backup and communicates with other alarms both via third wire and wireless protocols. Walks me through I set the jumpers correctly and press the test button and nothing happens. If others are having more luck I would love to hear about it as well.
[Off-topic] anthonylavado:
Okay, I'll bite.

It's meant to be used as a Home Automation hub, and for that reason, it has to be secure.

Imagine that someone hasn't configured their home network properly, and their devices are exposed to the internet. What if someone got in and modified their Wink hub using one of the above exploits? They could start unlocking doors, setting the thermostat to dangerous temperatures, control anything that's been hooked up.

Wink never said it could be modified on demand, only people deliberately looking for exploits found a way in. I haven't heard of anyone finding a bug for Wink to fix with their rooted Hub. All I've seen are just different ways of accessing direct, local control. For all we know, they could be working on implementing this. I haven't rooted because I've not experienced major issues with the cloud, and I'm using the API for any of the outside integration I want to connect.

One final note - If they didn't patch these bugs up, the average consumer would very quickly lose confidence in Wink's ability to control their home securely and reliably. I know I would.
[Off-topic] zimler:
Strange UART connection text

Has anyone else experienced strange characters while connected via UART that look like TV snow? It's intermittent and sometimes the session freezes. Adapter, solder or Putty? I'm using windows 7.
[Off-topic] bdjohns1:
I'm fine with them taking away the ability to root the device via the webserver. I'm honestly surprised that such simple exploits even made it out in public and lasted as long as they did.

I do think they should leave the ability for enterprising users to locally access their device using the UART interface. If that's left open, it's not going to be casually exploitable - requiring physical access to gain root to a device is a reasonable enough barrier. It's no different than most other computers - if I can get physical access to the average PC, I can get root-level access on it given enough time.

Unless they make dramatic changes to the way they do updates, it will still be possible (although harder) to exploit it that way - if you control the network the Wink is on, you can control the update process. About the only way I know of to really lock a networked Linux device down to anything but a hardware hack is to take the old TiVo approach - you have a boot PROM that checksums critical boot files, and restores them from its own backup if they mismatch. The only way people were able to get around that was again, physically pulling the PROM to modify it.
[Off-topic] anthonylavado:
[MENTION=302088]bdjohns1[/MENTION]

I can agree with that. Thank you for the level headed response.
[Off-topic] zolakk:
I had that problem when I had a poor connection on the board, so I would check that
[Off-topic] zimler:
Thanks. I will desolder it all and start over. I'm probably just rusty on my soldering.
[Off-topic] eperez42:
S3 Cert

The cert that wink-hub-images.s3.amazonaws.com /00.01 /upgrade_00.01.txt uses is for *.s3.amazonaws.com.

Have you tried hosting your custom image on Amazon S3 instance?
[Off-topic] coachclass:
[MENTION=6308979]CloneNum3[/MENTION] and [MENTION=6235795]berserko[/MENTION], do these instructions work for upgrading from a rooted version 0.47 to the current 0.55 too? And for keeping root?

I'd like to keep being able to use those curl commands to turn lights on/off.
[Off-topic] wpskier:
I was able to get root on my cloud-connected hub today by using the UART during the upgrade process to kill the upgrade scripts, comment out 'reboot' in them, re-run the upgrade scripts, then root the 00.55 image on mtd5. However, now when 00.55 boots up, one of the last statements I see via serial is 'Stopping Wink...'

Something is killing the Wink process, but I don't know what is doing it or why. Anyone experience this before?
[Off-topic] wpskier:
After some more investigation, it looked to be because I had put a host entry in for hub-api.winkapp.com, which was stopping the Wink process from communicating, and thus it was stopping. I removed that host entry and it looks to be good now.
[Off-topic] OuTTaRiCe:
Well, if you don't mind me commenting.

The upgrade proceed to 0.55 is the same as 0.47. No major surprises. Minor note that 0.55 leaves a pink LED. So no more blue LED.

I have just tested the new stagetest 0.57 and upgrade is still the same.

0.57 updates ZigBeeHACoord, aprond and hub, which seems to be the main changes in these updates. I assume these daemons are updated to support more devices.
[Off-topic] coachclass:
edit: Can someone give me the MD5 for the 0.55 firmware? Not sure if I have the correct one.

Hey, thanks for the reply. I keep reading about people forgetting to copy over the "php exploit" or the "rooting exploit", and others keep saying "just copy it over from the updater-rootfs image. I followed the instructions to root and I'm able to ssh in and use curl command from the outside to make changes to lights. But I have no idea what people are talking about when they say "php exploit". I don't know if I remember to copy the file over when I manually upgraded from .33 to .47, I just followed the instructions.

If I'm able to do what I'm doing down (use curl to send "set_dev_value"), does that mean I did somehow remember to copy over these files? I used clonenum3's post #87.
[Off-topic] ems4ty:
I'm not rooted. Just using the stock Wink Hub, a bunch of GE Link Bulbs, a couple Schlage Deadbolts, Honeywell Thermostat a (4) Kidde Combo Smoke/CO Battery Operated smoke detectors. All (4) of my smoke detectors are set to the same address (Dip Switch Setting). I've tested all of them and they all set each other off when activated. I've also added to my Wink Hub however the way its designed, only 1 detector can be added to Wink unless each detector has its own unique dip switch address in which case negates the wireless linking of detector to detector communication.

Cheers...
[Off-topic] eerikk2:
Belkin Wemo

Has anyone figured out how to integrate a belkin wemo switch with wink hub? I am on .55 rooted.
[Off-topic] Descention:
I'm trying to find out if it's possible to add additional support for zwave devices that are paired. I've been looking through apron.db and came up with the following queries to add the Aeon Labs Smart Energy Switch 1.43 meter attribute.

INSERT INTO `zwaveCmdClass`(`cmdClass`,`className`) VALUES (50, 'COMMAND_CLASS_METER');
INSERT INTO `zwaveAttribute`(`cmdClass`,`attributeId`,`attr_cmd`,`description`,`dataType`,`read_write`,`commandKey`) VALUES (50,19,'ATTRIBUTE','Meter','FLOAT','R',1);
INSERT INTO `zwaveProfiles`(`cmdClass`,`profileId`,`attributeId`) VALUES (50,2,19);

So far, it's been a no go. Anyone else have any luck?
[Off-topic] coachclass:
I don't have anything to add, but I'm trying to do the same thing. Not as far along as you.

Have you already added the device to the Wink hub? Or are you trying to figure out what type of device to add it as?
[Off-topic] Descention:
My device is already added to my hub. It identified as a POWER_SWITCH_BINARY and more info was found on pepper1.net's zwave db. You can match up the bytes in the implemented command classes to the integer cmdClass field in the apron database. I think I'm missing something from the zwaveCCSupport table. I feel like I should have a row added there.

Edit: My device currently only shows the switch part in aprontest but should have a power meter option to monitor as well.
[Off-topic] coachclass:
Does it work as a switch at least? You can remotely turn it on/off? You're just missing the power consumption data? What does it list when you do a aprontest -mx -l on it?
[Off-topic] Descention:
It does work as a switch.

[root@flex-dvt ]# aprontest -l -m 2
Gang ID: 0x00000002
Generic/Specific device types: 0x10/0x01
Manufacturer ID: 0x0086 Product Type: 0x0003 Product Number: 0x0006
Device has 1 attributes...
New POWER_SWITCH_BINARY
ATTRIBUTE | DESCRIPTION | TYPE | MODE | GET | SET
2 | On_Off | BOOL | R/W | TRUE | TRUE
[Off-topic] rainierez:
Dumb mistake...

While trying to manually update the firmware on my rooted hub I put the ubi in the updater folder before doing the restart into the other partition and it of course updated to .55 now and the shell is no long accessible even through UART. Anyone have any suggestions on this? I have skimmed the 11 pages of this thread and don't see a root for 55 but I could have missed it since I admittedly didn't read it all. Is there a way to set it back to stock?
[Off-topic] CloneNum3:
root

yes, the key pieces are to make sure you touch

/database/ENABLE_SSH and delete

rm -f /etc/default/dropbear # remove this file

touch /database/ENABLE_SSH # create this file

sed -i 's/^#tty/tty/g' /tmp/rootfs/etc/inittab # enable the serial port just in case

I maintain more info over at rootwink dot com
[Off-topic] danimal4326:
Looks like 0.56 is out.
[Off-topic] NarumiHayaashi:
Can't connect

Thanks for posting this, it's a great help to those of us who want control without depending on the cloud. I have been trying to root my wink hub with no luck. The version it is running is 0.33 but everytime I run a curl command I get a Connection timed out or a connection refused message. I'm not sure If I am typing something wrong or if there is something else I need to do. The hub has been connected to my wireless, but I am not going to update it until I have root, just in case wink goes down for good, which I hope not....
[Off-topic] Descention:
We can add support for our own devices. I've been playing around with the apron.db file and added the Wattage readout for my Aeon Labs power switch. It originally didn't report the number of watts used (as seen in an earlier post). I used the following insert and found that the power is reported via the multilevel sensor instead of the meter attribute. This may be due to the meter attribute not existing before I added it and may not be supported in the software. In any case:

insert into zwavedevicestate (nodeid, endpoint,attributeid) select 2, 0, attributeid from zwaveattribute;

You'll then want to run aprontest -e -m#

I then removed all the blank values with

delete from zwavedevicestate where nodeid=2 and value_get is null;

[root@flex-dvt ~]# aprontest -l -m2
Gang ID: 0x00000002
Generic/Specific device types: 0x10/0x01
Manufacturer ID: 0x0086 Product Type: 0x0003 Product Number: 0x0006
Device has 6 attributes...
New POWER_SWITCH_BINARY
ATTRIBUTE | DESCRIPTION | TYPE | MODE | GET | SET
1 | GenericValue | UINT8 | R/W | 255 | 255
7 | On_Off | BOOL | R | TRUE | TRUE
8 | Level | FLOAT | R | 674.033 | 674.033
9 | Unit | STRING | R | Watt | Watt
18 | ConfigurationParameter_1 | UINT32 | R/W | 0 | 0
2 | On_Off | BOOL | R/W | TRUE | TRUE

My attribute 2 is at the bottom as I had to remove the duplicate and add it back in.