Amazon Fire TV Cube hacked using 4-year old vulnerability

Security researchers at Cybernews have revealed that the Amazon Fire TV Cube (3rd Generation) has been successfully hacked using a four-year-old GPU vulnerability, allowing users to achieve complete control over the hardware.

Rather than causing widespread security panic, the discovery has sparked immense excitement among theatre enthusiasts eager to turn the streaming device into an advanced media player.

The exploit relies on a severe ARM Mali GPU kernel driver vulnerability tracked as CVE-2022-38181 , which carries an 8.8 out of 10 severity rating and enables arbitrary kernel code execution and root access.

Interestingly, ARM had patched the flaw back in August 2022 – two months before the Fire TV Cube 3rd Gen was even released – though the hardware remained susceptible to the legacy backdoor.

Despite the security implications, theatre fans jumped at the exploit to bypass stock limitations. Standard media sticks and streaming boxes lack support for the passthrough of lossless audio formats such as Dolby Atmos TrueHD or DTS:X , and struggle with high-bitrate local files and advanced video containers.

However, significant barriers to entry and security risks remain. Exploiting the flaw is far from a simple automated process. Amazon hasa emphasised that the method requires physical access and a deliberate, multi-step modification process, posing minimal risk to everyday consumers.

Furthermore, malicious actors could theoretically leverage the vulnerability to deploy spyware, steal data, or incorporate compromised devices into botnets, provided they could first establish an initial foothold.

While there is no evidence of active exploitation in the wild, Amazon warned that unauthorised modifications will void warranty coverage and can permanently damage or “brick” the device.

Discover more from Tech Digest