My Tether - Tether over WiFi, USB, and BT.

[survivalsounds]

Originally Posted by rlopin

Donation made. Awesome app.

I live in a densely populated area and am nervous about neighboors seeing the free open unsecured network and doing major downloads that get me in trouble with Sprint. Would love some type of encryption -- know you are working on it no doubt since it looks like the #1 most requested feature enhancement.

Confirmation number: 0WM47652UW3758920

Is there any timetable for that... I am also hoping you read my above post requesting the installer since I am too novice to deal with rooting the webosinternals portion of the process.

[northward]

I decided to try My Tether, and in doing so finally break down and gain root access to my Pre. After installing webos-internals I was surprised to see that I could install via the SDK method even without enabling developer mode. That got me concerned about a security hole, so I went into the #webos-internals IRC and asked. Aonic, can you comment on these chat logs?

Jul 18 01:47:08 <northward> Hello! Forgive me if I seem rather clueless regarding root access, Linux, etc. because, well, I am. I just gained root access via the method described at http://predev.wikidot.com/using-novaproxy to install the webos-internals package to enable "My Tether". Now, however, I see that I'm able to use the SDK to install packages without enabling Developer Mode. This seems to me to be a security risk, no? I don't envision mysel
Jul 18 01:47:45 <rwhitby> northward: if you have physical access to a Pre, then you already can do anything you want to it.
Jul 18 01:48:04 <destinal_> you have to have dev mode on to install with the sdk, correct?
Jul 18 01:48:25 <rwhitby> destinal_: I believe so
Jul 18 01:48:36 <destinal_> it uses novacom and novacomd isn't on without devmode IIRC
Jul 18 01:49:00 <northward> @rwhitby: I think that I understand that, I just wonder if I've opened up another security hole. @destinal: after rooting the Pre as described above, I can now install via the SDK without turning on dev mode, which doesn't seem right.
Jul 18 01:49:27 <rwhitby> northward: the webos-internals package is very careful *not* to open up security holes.
Jul 18 01:49:53 <northward> Yeah, but shouldn't I have to turn on dev mode to install via the SDK? It didn't allow me to do that before I accessed the root.
Jul 18 01:49:56 <rwhitby> northward: if you prefer to just use the SDK and novacom to get access to the device, then skip the step where you install dropbear.
Jul 18 01:49:57 <destinal_> northward: you need your passwords to install without dev mode via scp
Jul 18 01:50:17 <destinal_> northward: not different than a standard linux box
Jul 18 01:50:22 <rwhitby> northward: no webos-internals stuff changes what the SDK can and can't do.
Jul 18 01:50:43 <northward> I didn't install dropbear. I didn't do any of the "extra steps," actually. So, you guys are saying that I just shouldn't worry about this?
Jul 18 01:51:03 <rwhitby> northward: can you explain exactly what you have done, what you expected to happen, and what you're seeing happen?
Jul 18 01:52:05 <northward> Absolutely. I gained root access via the method described here: http://predev.wikidot.com/using-novaproxy. I then ran the following commands from the root prompt:
Jul 18 01:52:10 <northward> cd /tmp/
Jul 18 01:52:18 <northward> mount -o remount rw, /
Jul 18 01:52:30 <northward> wget http://vz.aonic.net:8080/~raja/pre/o...es-0.4_all.ipk
Jul 18 01:52:30 <northward> ipkg install org.webosinternals.services-0.4_all.ipk
Jul 18 01:52:48 <northward> mount -o remount ro, /
Jul 18 01:53:09 <rwhitby> northward: do you own vz.aonic.net ?
Jul 18 01:53:31 <northward> and usr/bin/luna-send palm://com.palm.applicationManager/rescan {}
Jul 18 01:53:53 <northward> (last one preceded by a fwd slash). No, vz.aonic.net is the developer who wrote the tethering app.
Jul 18 01:54:39 <northward> I then restarted the device and now I've noticed this change in behavior.
Jul 18 01:55:21 <rwhitby> ah, great. the guy who runs http://mytether.net/ is redistributing org.webosinternals.services instead of just linking to the source site. he's well within his rights to do that (since it's open source), but it's not really the "done thing"
Jul 18 01:55:41 <northward> Understood.
Jul 18 01:56:44 * rwhitby sends him a note ...
Jul 18 01:57:13 <northward> So, what do you think. I shouldn't worry about this behavior, or is there something else I should do? Sorry to be dense...
Jul 18 01:58:01 <rwhitby> northward: installing that org.webosinternals.services ipkg allows any webOS application to run anything on your Pre as the root user without your knowledge.
Jul 18 01:58:45 <northward> So, simply installing that ipkg creates a security risk by itself?
Jul 18 01:59:07 <destinal_> northward: yes I would say so
Jul 18 01:59:35 <destinal_> northward: the proper way to do services is to make a service do just what you want so that it can't be abused for unintended functionality
Jul 18 01:59:58 <destinal_> the problem with a generic command line service is that it's capable of anything and other apps you instal may use it without your knowledge
Jul 18 02:00:29 <destinal_> someone could make a call to it with rm -rf / and poof
Jul 18 02:00:45 <northward> Hmmmm...makes sense to me, destinal. So the developer should have written just the service for his app. OK, thanks folks. Now I have to decide whether I keep it or not to use the tethering app. If so I guess I have to truly trust any apps that I install...scary stuff.
Jul 18 02:00:48 <destinal_> and unless you do source code review of all your apps that seems like a risk to me
Jul 18 02:01:05 <northward> Yeah, like I'm capable of doing that! LOL
Jul 18 02:01:08 <rwhitby> or someone can make an app which snoops all web traffic and sends your bank account login details back to the author of the app
Jul 18 02:01:22 <destinal_> rwhitby: sure, and that's arguably much worse
Jul 18 02:01:51 <northward> May I have your permission to copy/paste this discussion on the developer's app thread at precentral.net to solicit his response?
Jul 18 02:02:07 <destinal_> northward: it's already public on the logs (see topic)
Jul 18 02:02:35 <destinal_> so I don't see an issue
Jul 18 02:02:37 <northward> Gotcha, I'll go look there. Thanks again for your feedback!
Jul 18 02:02:55 <rwhitby> northward: org.webosinternals.services was created by us as a proof of concept, and was not intended for direct use by other applications (due to this security issue)
Jul 18 02:03:15 <northward> Understood completely.
Jul 18 02:03:35 <rwhitby> northward: so whilst we released it as MIT license (and therefore anyone is free to use it for any purpose), we suggest that it should not be used in a real application
Jul 18 02:04:16 <rwhitby> northward: you should also ask the author to provide the source code for the org.webosinternals.services ipkg, so that you (or someone else ) can do a security review on it
Jul 18 02:04:16 <destinal_> it can easily be modified to run whatever commands the developer needs instead and named something else
Jul 18 02:04:44 <rwhitby> destinal_: indeed, it should be named something else if has different functionality from the original
Jul 18 02:04:54 <northward> Will do. Good night y'all!
Jul 18 02:06:06 <rwhitby> northward: since we specifically used the MIT license, we can't stop any of this happening, but we can appeal to the author of mytether.net to recognise commonly accepted open source practices
Jul 18 02:06:53 <rwhitby> I expect he just may not be aware of the security risk and the conventions of linking back to the original site and giving attribution ...

I'm concerned that using the entire webos-internals package creates a significant security risk, rather than just implementing a single service with restrictions that can be called by My Tether. Is that possible to do instead?

[aonic]

Originally Posted by survivalsounds

I looked into what it would take to do the root installation of webosinternals...

I would rather not.

Could you send me a link to the installer. I will gladly donate when I have some cash and can reactivate my paypal account.

The installer is not very easy to use as of right now, its still getting some kinks worked out, ill announce when its ready for the public.

Originally Posted by jsa334

Aonic,
Don't know if this has been asked/answered before but, will Palm be able to break the tether with a new os up date, Sounds as if 1.1 is coming shortly.
Thanks

Unless they block developer mode (unlikely) the tethering should stay fine in 1.1

Originally Posted by erasef301

I've read most of this thread... I'm very interested in getting tether on my Pre. I do have a question for the "brians" of this forum. Does anyone think or know if tethering the pre will EVER be possible without ROOTING the pre? I have successfully installed several homebrew apps. Just wondering if there will every be an easier way to tether the pre.

Thanks.....

The installer being worked on doesnt require you to root the pre. its 80% done. You can follow the progress on the forums in my signature.

Originally Posted by rlopin

Donation made. Awesome app.

I live in a densely populated area and am nervous about neighboors seeing the free open unsecured network and doing major downloads that get me in trouble with Sprint. Would love some type of encryption -- know you are working on it no doubt since it looks like the #1 most requested feature enhancement.

Check your email

That you everyone for donating, check your inboxes as well!

[aonic]

northward

I received an email from Rod, i'll post here what I replied back to him about hosting the webosinternals ipk file:

Hi Rod,

The gitorious link was really long (the download link) it was confusing some people, I tried tinyurl but that confused people further.

I hope it's not a problem, I havent made any changes to it, just hosting it on my server so people dont get scared with the git link.

Thank You,
Raja

To clarify my point about the long url:

http://gitorious.org/webos-internals/applications/blobs/raw/577e8deddf4e24e051e486f10fdb11f4d4a89b8c/org.webosinternals.services/org.webosinternals.services-0.4_all.ipk

And about the snooping, since Mojo SDK is all javascript, anyone can go through my JS code and see I'm not logging any data I welcome anyone to do an md5 match on the file downloaded from gitorious vs my servers to verify the file is indeed untouched.

My long term plan is to make my own service for My Tether instead of relying on webosinternals.services, I used webosinternals initially for a shorter development time, but as My Tether gains traction it deserves its own service.

[northward]

Originally Posted by aonic

And about the snooping, since Mojo SDK is all javascript, anyone can go through my JS code and see I'm not logging any data

I'm by no means suggesting that you are! I'm just concerned that a future app written by someone with less than pure intentions could exploit the installation of webos-internals for nefarious means, whether that be to steal login credentials or even wipe the Pre clean. It seems like an open doorway to the first WebOS viruses. There's got to be a safer way to do this, no?

[rwhitby]

Aonic,

As one of the authors of the org.webosinternals.services code, on which your application depends, I have some questions for you:

1) Why do you redistribute the org.webosinternals.services ipkg from your site instead of just linking back to the original package at WebOS Internals - Gitorious ?

2) Are you aware that the org.webosinternals.services code was done as a proof of concept, and was not intended to be used by other applications, since it opens up a huge security hole (any application can call the service to run any command as root on your Pre) ?

3) Are you intending to put the source code alongside the org.webosinternals.services ipkg that is hosted on your site?

4) Have you made any changes to the org.webosinternals.services code, or is it unchanged ? If you have made changes, will you be releasing those changes to the source code ?

5) Will you be donating a share of your proceeds from your application back to the webos-internals group to help pay for the hardware and hosting fees incurred by the webos-internals.org group when developing the code in org.webosinternals.services which is used by your application?

6) Do you realise that the ipkg control file you include in your tethering app states the maintainer as aonic <palm@palm.com> - assuming you don't work for Palm, are you intending to misrepresent your email address in this way?


Aonic, I ask these questions in the spirit of the open source movement.

Whilst we intentionally released the org.webosinternals.services code as MIT licensed code, and therefore anyone is free to do anything they like with it (except remove the existing copyright notices from the source code), we do want to know what your intentions are regarding this code which we have written and you have reused for your application.

You are well within your rights (according to the MIT license under which we released the code) to redistribute modified or unmodified binaries as you are now doing. We cannot, and would not try to, stop you doing that (since the MIT license allows that). However, there are certain open source community conventions that you are seriously violating in the way you are currently doing things. I'd like to assume you are just unaware of those conventions and would be willing to work with the open source community to address the above questions.

It is important to note that the webos-internals group takes security very seriously (one of our members has already reported at least 4 security vulnerabilities in webOS to Palm, and was credited in the 1.0.4 webOS release notes), and using the org.webosinternals.service proof of concept code in the way that you are using it puts anyone using your application at an immense security risk which cannot be understated. To put it simply, if you install org.webosinternals.services, then any malware application installed afterwards can take complete control of your Pre, including such things as snooping your web traffic and sending your online banking details to the malware author. Whilst I am certainly not implying that your application does anything like that, your installation instructions open the door for any other application to do such things.

We strongly recommend you modify the source code to only be able to run the specific commands that you require, and to disallow any other commands.

We would be happy to discuss all these questions with you directly - please contact 'rwhitby' in the #webos-internals IRC channel, or email me at rod@whitby.id.au

Thanks,
-- Rod Whitby

[gjlowe]

For those concerned about the security risk.... do we need to uninstall just My Tether, or do we have to go find the org.webosinternals.services package and remove it separately?

[aonic]

rwhitby

I replied to your email earlier, and posted answers to most of those questions two replies above: http://forums.precentral.net/1758919-post844.html

As I mentioned in the reply above, I never intended, and dont intent to use the shell service for long, it was used to see if a tethering app is feasible. As My Tether gets more serious I am developing my own service which handles just the tethering stuff and doesn't require the installation of webosinternals.services.

Also as mentioned above, none of the original webosinternals.services code was modified or reused, I merely hosted your open source package on my own servers for a shorter URL.

I did not realize my application was being signed with that email address, I'll work on fixing that ASAP.

I don't see why a big deal is being made about me hosting the open sourced package on my own server, as the license states:

Permission is hereby granted, free of charge, to any person obtaining a copy 
of this software and associated documentation files (the "Software"), to deal 
in the Software without restriction, including without limitation the rights 
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 
copies of the Software

gjlowe you can just remove the webosinternals.services, but unless youre installing random homebrew apps you shouldnt need to worry as nothing can take advantage of webosinternals.shell unless you install it onto your Pre.

[QuarlesLT]

For some reason, no matter which method I use to tether, I can't get speeds above .40-.60Mbs/sec download. Any ideas? I have full bars at my location. I appreciate any info, love the app!

[rwhitby]

Originally Posted by aonic

rwhitby

I replied to your email earlier, and posted answers to most of those questions two replies above: http://forums.precentral.net/1758919-post844.html

As I mentioned in the reply above, I never intended, and dont intent to use the shell service for long, it was used to see if a tethering app is feasible. As My Tether gets more serious I am developing my own service which handles just the tethering stuff and doesn't require the installation of webosinternals.services.

Also as mentioned above, none of the original webosinternals.services code was modified or reused, I merely hosted your open source package on my own servers for a shorter URL.

I did not realize my application was being signed with that email address, I'll work on fixing that ASAP.

I don't see why a big deal is being made about me hosting the open sourced package on my own server, as the license states:

Permission is hereby granted, free of charge, to any person obtaining a copy 
of this software and associated documentation files (the "Software"), to deal 
in the Software without restriction, including without limitation the rights 
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 
copies of the Software

gjlowe you can just remove the webosinternals.services, but unless youre installing random homebrew apps you shouldnt need to worry as nothing can take advantage of webosinternals.shell unless you install it onto your Pre.

Aonic,

Thanks for your reply. I'm glad to see you're willing to work through the security issue.

As you noted, the MIT license allows you to do everything you are doing, and we're not making a big issue out of it. There are normal open source conventions about attribution that open source community members usually follow. You're free to follow or ignore those conventions as you please :-)

-- Rod

[settelma]

All, I recommend you donate and support this effort. The beta software being developed works like a charm. I am sending this to you via my USB connection utilizing the beta install program and have never rooted my Palm. This is a great app lets hope Palm and Sprint continue such development. Thanks!

[lukehale]

Donated 2U645055DL304252N

[dbett]

Originally Posted by aonic

gjlowe you can just remove the webosinternals.services, but unless youre installing random homebrew apps you shouldnt need to worry as nothing can take advantage of webosinternals.shell unless you install it onto your Pre.

Just to clarify...can folks remove the webosinternals.services and leave My Tether installed and working?

If so, are there directions somewhere?

Thanks again for a great program.

[survivalsounds]

I want to thank you.

I conquered my fear and successfully rooted the webosinternals... as soon as I did that, MyTether started working with no further need to install anything.

My advice for anyone doing it, is to go step by step via the Wiki... go slowly. And just copy/paste AONIC's lines and then EXIT when you are done.

The Wiki includes the scripts you need and everything... You will already have the program PUTTY and the Novacom Drivers mentioned in the Wiki if you have downloaded the SDK and have installed any other Homebrew Apps without using the email method.

Good luck and thanks again to Aonic.

I got DL speed of @966kbps and upload of @610kbps right here in Brooklyn, NY...

Thanks again... and I will donate asap.

[roitmanm]

will tethering ever be available without the security risk described above? for us non-developers could someone put the issue at hand in layman terms?

i'd appreciate it.

[northward]

Originally Posted by roitmanm

will tethering ever be available without the security risk described above?

If the developer modifies the app to restrict the services opened to only what it needs, then yes. Aonic says that he's working on that, but I won't install My Tether until then because:

Originally Posted by roitmanm

for us non-developers could someone put the issue at hand in layman terms?

i'd appreciate it.

Well, I'm not a developer either, but the short of it is that the way this app is installed now, it allows any app to do anything without you even knowing it. A maliciously written app could do anything from send out your private banking info to erasing your entire Pre.

Unless you plan to never install another app ever again, the security risk that this poses cannot be understated. It's simply not a risk I'd be willing to take.

[jhoff80]

Personally I think the issue is just slightly being blown out of proportion.

The tether application uses a Linux shell script in order to control the wifidriver and other things. It's not possible to control that from a webOS card normally. However, rlwhitby and a few others have written a service that runs within the Linux part of the Pre that a webOS card CAN make calls to. However, every command run by this service has root privileges, which means basically it can do anything to the files on your Pre.

If someone chose to, they could write a malicious program that told the shell service to really mess up your Pre.

However, it's my personal opinion that one should be careful of what they install anyway, regardless of having this shell service installed or not, just like they should on a computer as well. If you're being careful and only installing things that come from a reputable source, there really isn't any problem.

[jhoff80]

Originally Posted by northward

Unless you plan to never install another app ever again, the security risk that this poses cannot be understated. It's simply not a risk I'd be willing to take.

Do you never install any applications on your computer either? Because malicious applications can do the same thing there.

[northward]

Originally Posted by jhoff80

However, it's my personal opinion that one should be careful of what they install anyway, regardless of having this shell service installed or not, just like they should on a computer as well. If you're being careful and only installing things that come from a reputable source, there really isn't any problem.

And how does a non-developer confirm that it's from a reputable source? We lack the skills to read the code to truly understand what the app is doing. Really, we have no way to even know that any of the homebrew apps posted here are reputable and as this stuff proliferates the odds of someone releasing a malicious app increase exponentially.

Originally Posted by jhoff80

Do you never install any applications on your computer either? Because malicious applications can do the same thing there.

Of course they can. I doubt that there's anyone here who hasn't had a virus or malware infection on their PC. However, there are safeguards available on a PC -- antivirus and anti-malware products, firewalls, etc. -- that aren't available for WebOS.

I can't fathom that anyone would think that this risk is overblown. By installing webos-internals you're simply giving any application root access to your Pre to do what it wants. People immediately raised the issue of the security risks associated with sideloading apps via email, and Palm patched that hole right away. This risk is orders of magnitude greater than that risk was. Note also that after installing webos-internals you can't even truly turn off developer mode -- it says that it's off, but you can still install via the SDK as if it's turned on.

[aonic]

Originally Posted by survivalsounds

I want to thank you.

I conquered my fear and successfully rooted the webosinternals... as soon as I did that, MyTether started working with no further need to install anything.

My advice for anyone doing it, is to go step by step via the Wiki... go slowly. And just copy/paste AONIC's lines and then EXIT when you are done.

The Wiki includes the scripts you need and everything... You will already have the program PUTTY and the Novacom Drivers mentioned in the Wiki if you have downloaded the SDK and have installed any other Homebrew Apps without using the email method.

Good luck and thanks again to Aonic.

I got DL speed of @966kbps and upload of @610kbps right here in Brooklyn, NY...

Thanks again... and I will donate asap.

Good to hear! Enjoy your rooted pre and My Tether!

Originally Posted by roitmanm

will tethering ever be available without the security risk described above? for us non-developers could someone put the issue at hand in layman terms?

i'd appreciate it.

My Tether needs webosinternals.shell service as of right now to enable some things that need to be done for tether to work, the problem is, any other app you install on your Pre can also call webosinternals.shell and execute commands on you Pre. So you need to be careful about what you install. Also see jhoff's comment below.

Originally Posted by jhoff80

Personally I think the issue is just slightly being blown out of proportion.

The tether application uses a Linux shell script in order to control the wifidriver and other things. It's not possible to control that from a webOS card normally. However, rlwhitby and a few others have written a service that runs within the Linux part of the Pre that a webOS card CAN make calls to. However, every command run by this service has root privileges, which means basically it can do anything to the files on your Pre.

If someone chose to, they could write a malicious program that told the shell service to really mess up your Pre.

However, it's my personal opinion that one should be careful of what they install anyway, regardless of having this shell service installed or not, just like they should on a computer as well. If you're being careful and only installing things that come from a reputable source, there really isn't any problem.

I couldn't agree more.