HD-TIVO exploit bounty

[rc3105]

THE CHALLENGE: - sw only exploit providing bash access

THE DEADLINE: - Jan 1st, 2005


the details:

clueless hordes - vote on how much you're willing to contribute, then paypal your donation (pm for details). if there's no hack by the deadline funds will be returned

multiple votes allowed and they're public. this thread will reflect who's voted / donated / tried to weasel out (weasels will be BANNED)


developers - submit what you have via pm or e-mail. the hack must boot a hd unit to the bash prompt such that an initrd nulled kernel can be used

candidate exploits will be evaluated by qualified community members


to be eligible for the bounty the exploit must be freely available to ddb members for personal noncommercial use. redistribution / resale license restrictions to prevent ebay / hero abuse are acceptable


on Jan 1 the bounty collected will be either:

1) awarded to the first developer that provided a working exploit

2) returned to the contributors


if a working exploit surfaces before Jan 1 the challenge may be closed & the bounty awarded

[rc3105]

notabe contributors

$100, almontebarnes - first person to part with a significant chunk of change

$250, ntesla - largest single donation from a tivo geek

$85 - non-ddb / non-tivo people (thanks slashdot)

~$200 - anonymous, folks willing to donate w/o recieving credit ( allthough some voted in the poll )

if I've left you out PLEASE don't take it as an insult - my inbox is mess at the moment. I'll update as things normalize & am able to verify direct EFF donations

when the dust settles I believe we may top $2k!!!

-----

the challenge donation paypal is jc3105@hotmail.com (no transaction fees) credit card donations should to go rc3105@hotmail.com

please include your ddb handle so I know who donated what. if you're not a ddb member or want to remain anonymous just say so in the paypal comments.

anyone interested in donating hardware please pm

[tivomaster]

I don't have an HD and don't intend on getting one so I voted the $0.. I think you need to change the wording on the $0 to something like "don't care"...

[rc3105]

this isn't a is anybody interested thread

this is a LETS GET THIS DONE thread

presumably anybody that doesn't care won't bother to read/post/vote in the first place


I'd bet $$$ at least 1 of the elder gods has this worked out allready, if not, maybe a tivo insider will leak a signed kernel we can use


just gotta give 'em a reason to share their toys


edit:

bash allows for PLENTY of legit uses like tivoweb, TCS, dailymail, etc

if you want to debate this particular bounty, do so in the sewer

[fixn278]

My vote is more about having options than being afraid to void my warranty.

[rc3105]

"HD TeAm" has submitted a sw only exploit for evaluation

the license is restricted distribution - but only to prevent resale / hero abuse

the HD TeAm position:

"HD TeAm has a solution prepared and authorizes it's distribution via ddb once $1,000 has been collected. We request that all proceeds be donated to the EFF so that research of this nature remains legal in the future."

"It is our position that if the community, particularly the minority with the disposable income for hd-units, is unwilling to come together & donate this token sum to a worthy organization the hack is probably better kept private"


OK, lets open the floor to discussion

[tivomaster]

Originally Posted by rc3105

"HD TeAm" has submitted a sw only exploit for evaluation

the license is restricted distribution - but only to prevent resale / hero abuse

the HD TeAm position:

"HD TeAm has a solution prepared and authorizes it's distribution via ddb once $1,000 has been collected. We request that all proceeds be donated to the EFF so that research of this nature remains legal in the future."

"It is our position that if the community, particularly the minority with the disposable income for hd-units, is unwilling to come together & donate this token sum to a worthy organization the hack is probably better kept private"


OK, lets open the floor to discussion

I want to change my vote. If the proceeds go to the EFF I will gladly donate $10 to the cause even though I do not have an HD unit nor the current means to get one..... Can one of the mods either delete my original vote and I will cast a new one or change it for me?

BTW. What about a bounty to get 4.X running on a RID unit? I would reallly like to see that.

[rc3105]

ok, here's where we're at

got the source this morning & was so excited I couldn't wait to try it out. unfortunatly the s2 compiler box was spread all over the workbench so I ended up compiling the util natively in one of the s1 dtivos (isn't life bizarre sometimes?)

installation requires pulling the drive (duh) + a grand total of about 30 seconds to apply the hack & add bash to rc.sysinit

the 2.4.20 - 3.1.5 kernel boots bash / networking / tivoweb & such with a stock prom!!!

[rc3105]

per HD TeAm's request, I'll be setting up a ddb memership with EFF tomorrow

once we reach the goal EFF gets the bounty & the util, source, instructions & donation transaction details get posted here

[fixn278]

Originally Posted by rc3105

1) $100 - almontebarnes
2) $5 - rc3105
3) $5 - jjbliss


pledged but not recieved yet - updated daily

$10 - Lattis2003
$100 - fixn278
$20 - jodell

OK, I see confirmation of donations, but no donation account or link...

[JJBliss]

Originally Posted by rc3105

the license is restricted distribution - but only to prevent resale / hero abuse

<kerchunk>

"It is our position that if the community, particularly the minority with the disposable income for hd-units, is unwilling to come together & donate this token sum to a worthy organization the hack is probably better kept private"

OK, lets open the floor to discussion

OK, but what about the scumbags on eBay who find this thread, donate $1000 (thereby getting the amount where it needs to be), then use the software that they're "entitled to", and then sell (10)@$1150 Bash enabled HDTivos?

Everything after that is gravy for them.... Technically, they "bought" the exploit.

Your thoughts?

(JJBliss is obviously playing devils advocate to spawn additional conversation on the topic)

[JJBliss]

Originally Posted by fixn278

OK, I see confirmation of donations, but no donation account or link...

It says to PM rc3105 for details in the first post.

[fixn278]

Originally Posted by JJBliss

It says to PM rc3105 for details in the first post.

Grrrr.... I hate it when that happens....

[rewrite]

Originally Posted by rc3105

the HD TeAm position:

"HD TeAm has a solution prepared and authorizes it's distribution via ddb once $1,000 has been collected. We request that all proceeds be donated to the EFF so that research of this nature remains legal in the future."

"It is our position that if the community, particularly the minority with the disposable income for hd-units, is unwilling to come together & donate this token sum to a worthy organization the hack is probably better kept private"

I predict that the EFF is about to get a huge amount of donations, far exceeding the $1000 that HDT would like. One question for HDT: when you reach the desired level of donations, would the hack be released under the GPL?

[SledgeHammer]

Originally Posted by JJBliss

OK, but what about the scumbags on eBay who find this thread, donate $1000 (thereby getting the amount where it needs to be), then use the software that they're "entitled to", and then sell (10)@$1150 Bash enabled HDTivos?

Everything after that is gravy for them.... Technically, they "bought" the exploit.

Your thoughts?

(JJBliss is obviously playing devils advocate to spawn additional conversation on the topic)

People are already selling stock units for more then $1150. I see very few go for less then $1200 to $1250. And drive upgrade units have approached $2000.

Personally I'd like to see a $200 price cut (I think thats a fair price for the HD DTivo... $799) so the people that loaded up on them just to make a quick buck get screwed.

I saw one auction where a guy had a picture of a stack of TEN boxes. All for sale. The fact is that the majority of people that have 'em now never have and never will open them. At $999 a lot of people would be scared to touch them. I know that even if this exploit is closed/not released, etc, I wouldn't be too quick to send a $999 box out to get socketed.