Collected research

Kindle Touch (5.0) Jailbreak/Root and SSH

@yifanlu · Yifan Lu · 10 December 2011

Much of the Kindle Touch interface is HTML and JavaScript backed by a native bridge, and one exposed function, nativeBridge.dbgCmd(), runs any shell command as root. Injecting HTML and script through an MP3's ID3 tags reached it, so a single crafted MP3, carrying the shell payload in the comment field and a splash image appended raw, installs a developer key and SSH.

Record

Researcher

@yifanlu

Published by

Yifan Lu

Date

10 December 2011

Topic

Other

In the archive

• Collected in the 2011 research round

Tags

• javascript
• rce
• injection
• privilege-escalation
• sandbox-escape
• case-study
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of @yifanlu, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.