Rooting the Amazon Echo

[dj_skully]

Hey all, I posted to reddit a paper that I worked on that details 3 possible methods of rooting the Echo. Please let me know if you want more information or are interested in trying one of the 3 methods.

Thanks.

https://www.reddit.com/r/netsec/comments/4inesj/rooting_the_amazon_echo_pdf/

Edit: Check the reddit link above. We were successful in rooting the device and getting a firmware image!
Direct link to the GitHub wiki:
https://github.com/echohacking/wiki/wiki

[fstbusa]

what things can I do with a rooted echo?  I am a somewhat savy android user with multiple rooted devices so I understand the basics

[dj_skully]

what things can I do with a rooted echo?  I am a somewhat savy android user with multiple rooted devices so I understand the basics

Anything you want really. At that point it is just an embedded computing device (ARMv7 processor). You can install other programs, have more granular control over your IoT devices, etc. From a reverse engineering standpoint it is gold too. You'd have access to binaries to RE (Ida Dbg), be able to see traffic the devices is sending out, what information it collects on people (privacy concerns), etc. The sky is the limit.

[DParker]

Anything you want really. At that point it is just an embedded computing device (ARMv7 processor). You can install other programs, have more granular control over your IoT devices, etc. From a reverse engineering standpoint it is gold too. You'd have access to binaries to RE (Ida Dbg), be able to see traffic the devices is sending out, what information it collects on people (privacy concerns), etc. The sky is the limit.

Or turn your $180 Echo into a brick. 

[dj_skully]

There really is not harm in attempting to solder to the bottom pads of the device. It will not brick your Echo though you wont be able to read the boot logs from UART if you screw up really badly.

[vegasguy]

In my opinion rooting the Echo offers few benefits. But to certain other demographics it could be a make or break deal.

Some possibilities are:

- Change Echos name to anything, not limited to Alexa, Echo, or Amazon.

- Set to local time zone that's not in the USA.

- Get local weather not in the USA.

- integrated support for IoT devices that are not currently supported.

So if these are important to you, you might want to lend a hand to be one of the first hackers to root  an Echo.



Sent from my iPhone using Tapatalk

[additude]

There really is not harm in attempting to solder to the bottom pads of the device. It will not brick your Echo though you wont be able to read the boot logs from UART if you screw up really badly.

How do you know this?
Have you physically looked at the connections or locations where the soldering should occur? Are you positive that there are "Bottom Pads" to solder to?
Are you familiar with different types of soldering irons and their specific applications? If someone uses the incorrect soldering iron for this application they could destroy something.
Are you familiar with the different types of solder, solder sizes, ratio contents and fluxes?
Are you familiar with ESD and the damage that ESD can cause to sensitive semi-conductor components?
Yea, not knowing what you are doing, or even thinking that you know what you are doing can "Brick" your Echo if you try this operation.
I do not advise anyone to try this, except other than the OP because it is their idea, I suggest the OP use their own Echo....

[dj_skully]

There really is not harm in attempting to solder to the bottom pads of the device. It will not brick your Echo though you wont be able to read the boot logs from UART if you screw up really badly.

How do you know this?
Have you physically looked at the connections or locations where the soldering should occur? Are you positive that there are "Bottom Pads" to solder to?
Are you familiar with different types of soldering irons and their specific applications? If someone uses the incorrect soldering iron for this application they could destroy something.
Are you familiar with the different types of solder, solder sizes, ratio contents and fluxes?
Are you familiar with ESD and the damage that ESD can cause to sensitive semi-conductor components?
Yea, not knowing what you are doing, or even thinking that you know what you are doing can "Brick" your Echo if you try this operation.
I do not advise anyone to try this, except other than the OP because it is their idea, I suggest the OP use their own Echo....

You can completely disconnect the debug pads on the bottom board and the Echo will still boot and function as normal. Hell, you might even get away with disconnecting the whole bottom board.

[DParker]

I certainly wouldn't presume to tell anyone else what they should/shouldn't do with their own stuff.  But speaking strictly for myself, when I feel the urge to experiment with this sort of customized consumer-oriented tech stuff (and I do...a lot) I have a box full of $4-$35 Arduino clones and Raspberry Pi units to play with.  It's what they're made for.  In fact there are already published Pi-based projects for Alexa service utilization, so when I get the time I'm going to pull out one of the $5 Pi Zeros and use it for my own customized Echo-like device.

[Jean]

Exactly. although amazon has source code released here, https://www.amazon.com/gp/help/customer/display.html?nodeId=201626480   it's still quite difficult to figure out how to port these code into an existing device.
Raspberry Pi will be a good alternative for DIY purpose.

[TT KH]

In my opinion rooting the Echo offers few benefits. But to certain other demographics it could be a make or break deal.

Some possibilities are:

- Change Echos name to anything, not limited to Alexa, Echo, or Amazon.

- Set to local time zone that's not in the USA.

- Get local weather not in the USA.

- integrated support for IoT devices that are not currently supported.

So if these are important to you, you might want to lend a hand to be one of the first hackers to root  an Echo.



Sent from my iPhone using Tapatalk

I'm trying to root this so I can change the name of the wake word to Kevin, Christine or what have you.

[dj_skully]

Did you check out the white paper from reddit?

[dominique]

In my opinion rooting the Echo offers few benefits. But to certain other demographics it could be a make or break deal.

Some possibilities are:

- Change Echos name to anything, not limited to Alexa, Echo, or Amazon.

- Set to local time zone that's not in the USA.

- Get local weather not in the USA.

- integrated support for IoT devices that are not currently supported.

So if these are important to you, you might want to lend a hand to be one of the first hackers to root  an Echo.



Sent from my iPhone using Tapatalk

This alone is reason enough to experiment with it.

[dj_skully]

I agree! Keep a close eye on these forums for a status update in the coming week or two.

In my opinion rooting the Echo offers few benefits. But to certain other demographics it could be a make or break deal.

Some possibilities are:

- Change Echos name to anything, not limited to Alexa, Echo, or Amazon.

- Set to local time zone that's not in the USA.

- Get local weather not in the USA.

- integrated support for IoT devices that are not currently supported.

So if these are important to you, you might want to lend a hand to be one of the first hackers to root  an Echo.



Sent from my iPhone using Tapatalk

This alone is reason enough to experiment with it.

[samd]

Hey @dj_skully,

I have read the paper. It looks like you boot a custom operating system into the Echo. Correct?
That means you don't have access to the linux environment currently running on the Echo? So it is not possible to sniff the incoming and outgoing traffic, right?

Thanks,
Sam