Prior to updating to firmware 7.0, it was possible to use the ECP launch command to open the channel store to the channel page of a specific private channel. For example, this command would launch the device to a channel store screen showing the channel’s description and star rating, with an option to “Add Channel”:
However, it now does nothing after the firmware update. I have observed that this command still works for public channels in 7.0. But no longer for private channels. I see nothing in the documentation that indicates this was an intentional change, so I presume it to be a bug. Can Roku confirm it was unintended and will be fixed?
The current ECP guide still mentions this specific example also:
“EnTerr” wrote:
Seems to be a bug, yes!
I’m not so sure… note that the OP is trying to launch to a private channel in the channel store, which aren’t typically installable directly on the device. It still works with public channels, so it’s possible Roku just patched something that wasn’t intended to be a feature in the first place.
“TheEndless” wrote:
It still works with public channels, so it’s possible Roku just patched something that wasn’t intended to be a feature in the first place.
It doesn’t - i tried Netflix, Amazon, Pandora, YouTube - nuh-uh. Curiously, previous time there was such bug it was bouncing a 404 - now it says 200:
$ curl -i -d "" http://192.168.1.28:8060/launch/11?ContentID=12
HTTP/1.1 200 OK
Server: Roku UPnP/1.0 MiniUPnPd/1.4
Content-Length: 0
$ curl -i -d "" http://192.168.1.28:8060/launch/11?ContentID=13
HTTP/1.1 200 OK
Server: Roku UPnP/1.0 MiniUPnPd/1.4
Content-Length: 0
$ curl -i -d "" http://192.168.1.28:8060/launch/11?ContentID=28
HTTP/1.1 200 OK
Server: Roku UPnP/1.0 MiniUPnPd/1.4
Content-Length: 0
$ curl -i -d "" http://192.168.1.28:8060/launch/11?ContentID=837
HTTP/1.1 200 OK
Server: Roku UPnP/1.0 MiniUPnPd/1.4
Content-Length: 0
Do you have those channels already installed? I think it only works if you use a channel that is not currently installed on your box.
Also I don’t think it was ever intended to work for private channels, but I’ll check on this. You can’t get to the Channel Store page for a private channel through the UI, so it doesn’t seem right that you could do it via ECP.
Note it was working for private channels for at least the last 2-3 years. I don’t see why it wouldn’t work for private channels too. It displays the ratings and provides a description of the channel that is useful for someone interested in installing it. And there are ECP programs out in the wild that were built to use this feature which are now broken.
“roquoonewbie” wrote:
EnTerr, I think your public channel issue is because you capitalized contentID.Makes no difference. “Channel 11” is case-insensitive on contentID
“RokuMarkn” wrote:
Do you have those channels already installed? I think it only works if you use a channel that is not currently installed on your box.
Also I don’t think it was ever intended to work for private channels, but I’ll check on this. You can’t get to the Channel Store page for a private channel through the UI, so it doesn’t seem right that you could do it via ECP.
It was working before for any channel - public or private - installed or uninstalled. And the functionality was very neat and self-contained, without semantical leaks*.
See for example my “Remote for Roku” iOS app where a “long tap” on an icon from the channel list would pop the channel details page on TV screen (by calling /launch/11?ContentID=). It makes for a very nice integration and without stealing any Roku thunder - conversely, it re-focuses the user from the mobile device to the TV screen.
(*) Meaning that for any channel it brings a single, self-contained “app info” screen with a short description, average rating, screenshots and choices to add/remove/launch/rate the channel. Which screen is rather elegant and i’d argue it is the screen that should pop when Options is pressed on an icon (or at least should be accessible from the current “move” menu). When invoked with ECP, exiting it with Back did not link to Channel Store, so there couldn’t be an implication that say a private channel is endorsed in any way by the Co. That’s what i mean by “no leaky semantics”
The business or use case for being able to install private channels via the ECP is the same as the case for doing so with public channels. ie: It is an easy/seamless user experience for a customer using an external app or device to install a companion channel on the Roku with a couple of clicks.
For eample, a PC media server app can present an option to the customer to “click here to install the companion player on your Roku”. Then the customer can click on the PC, go to their TV, and click “Add Channel”. Super easy and a wonderful user experience.
The same could be true of (for example) an iOS app that relies on a companion Roku channel to “cast” media to it. Installing it with a couple of clicks is vastly easier than logging into a web browser and adding it there, then going to the Roku and going to Home…Settings…System…Update.
I also don’t see how it is any more of a security hole to enable this for private channels than it may be for public channels. What is the security risk?
Before clicking “Add Channel” button on Roku, i can see the rating, descrption of privated channel to determine whether or not to install it.
It’s very inconvenient for me if i need to log-in my Roku Account everytime to install each privated channel.
Without ECP launch command, there is no easy way to install privated channel. User cannot install privated channel even from Roku directly. (like entering an channel id by remote.)
“roquoonewbie” wrote:
I also don’t see how it is any more of a security hole to enable this for private channels than it may be for public channels. What is the security risk?
I’ll take a stab/guess at that… since private channels aren’t reviewed by Roku, it’s possible someone could develop a malicious channel (e.g., a fake Netflix or Amazon channel with the sole purpose of capturing usernames and passwords.. or worse). Allowing a user to install those channels easily via a screen that makes it look like it’s officially available in the channel store could lead to very bad things, for both unsuspecting users and Roku.
“TheEndless” wrote:
I’ll take a stab/guess at that… since private channels aren’t reviewed by Roku, it’s possible someone could develop a malicious channel (e.g., a fake Netflix or Amazon channel with the sole purpose of capturing usernames and passwords.. or worse). Allowing a user to install those channels easily via a screen that makes it look like it’s officially available in the channel store could lead to very bad things, for both unsuspecting users and Roku.
If such a malicious channel existed, and an attacker had gained access to the victim’s PC (or other device), couldn’t they just as easily launch the user’s browser to the add channel screen there (eg: https://owner.roku.com/Add/ACETV)? ie: whether the malicious code launched the Add Channel screen on the Roku/TV, or launched the Add Channel screen on the PC/Browser, the risk is the same as far as I can tell. I don’t see how launching the channel store screen poses any more of a risk. In both cases, the attacker has to first gain access to run code on a device on the user’s network, present an Add Channel option to the victim, and get the victim to agree to do so.
“TheEndless” wrote:
I’ll take a stab/guess at that… since private channels aren’t reviewed by Roku, it’s possible someone could develop a malicious channel (e.g., a fake Netflix or Amazon channel with the sole purpose of capturing usernames and passwords.. or worse). Allowing a user to install those channels easily via a screen that makes it look like it’s officially available in the channel store could lead to very bad things, for both unsuspecting users and Roku.
If such a malicious channel existed, and an attacker had gained access to the victim’s PC (or other device), couldn’t they just as easily launch the user’s browser to the add channel screen there (eg: https://owner.roku.com/Add/ACETV)? ie: whether the malicious code launched the Add Channel screen on the Roku/TV, or launched the Add Channel screen on the PC/Browser, the risk is the same as far as I can tell. I don’t see how launching the channel store screen poses any more of a risk. In both cases, the attacker has to first gain access to run code on a device on the user’s network, present an Add Channel option to the victim, and get the victim to agree to do so.
Your example is more malicious than the one I suggested, which was more of a phishing attempt. But to answer your question, your use-case above where a mobile app is used to install private channels directly on the device could very easily be used to do the same, so the app is already running on the user’s network. How can you be sure that every private channel installable via that app can be trusted? You and I are likely much more diligent in reviewing apps before we install them, but there’s a large user population out there that isn’t. Presenting the channel to the user via a channel store screen gives that user the impression that it’s an official public channel, as there’s nothing on the screen or during the install process that indicates otherwise. Presumably, your desire to have the feature available to you is for completely legitimate reasons, but that doesn’t mean Joe Hacker won’t use it more nefariously, and it only takes one bad apple…
“TheEndless” wrote:
Your example is more malicious than the one I suggested, which was more of a phishing attempt. But to answer your question, your use-case above where a mobile app is used to install private channels directly on the device could very easily be used to do the same, so the app is already running on the user’s network. How can you be sure that every private channel installable via that app can be trusted? You and I are likely much more diligent in reviewing apps before we install them, but there’s a large user population out there that isn’t. Presenting the channel to the user via a channel store screen gives that user the impression that it’s an official public channel, as there’s nothing on the screen or during the install process that indicates otherwise. Presumably, your desire to have the feature available to you is for completely legitimate reasons, but that doesn’t mean Joe Hacker won’t use it more nefariously, and it only takes one bad apple…
What about my example was more malicious than the one you suggested? I was just demonstrating how an attacker could get a phising channel installed on the Roku. You were saying that could be done by abusing the ECP launched channel store page. That can only be done if there is malicious software already running on the network. And if that is the case, that software could just as easily launch to the channel store add page of the private channel in the web browser (see this link: https://owner.roku.com/Add/ACETV). Both the web page to add the private channel and the channel store screen can give the user the impression it is a public channel. There is nothing on the web page that indicates it is a private channel either. So I again make the point that the channel store method of adding the channel is no less secure than the web method. It is just a little bit easier for the user.
And let’s not forget that the ECP launching of a private channel store screen has been available for at least 2-3 years until this most recent 7.0 firmware update. If it was really a security hole, wouldn’t there have been issues by now?
“roquoonewbie” wrote:
What about my example was more malicious than the one you suggested?
You talked about “gaining access to the victim’s PC (or other device)”. I thought you were suggesting the channel could do that, but I think I may have misinterpreted what you were suggesting.
“roquoonewbie” wrote:
You were saying that could be done by abusing the ECP launched channel store page. That can only be done if there is malicious software already running on the network.
Not necessarily. Your perfectly harmless ECP app could unknowingly allow the install of such a malicious channel. Have you reviewed the code of every private channel that your app installs? There’s no way for you to know if a developer has hidden something in their channel that looks completely innocuous on the surface.
“roquoonewbie” wrote:
So I again make the point that the channel store method of adding the channel is no less secure than the web method. It is just a little bit easier for the user.
That’s exactly why it’s less secure. The fewer steps it requires, the more likely it is to be done by accident, or unknowingly. The ECP app that’s launching the channel store screen could just as easily send additional ECP remote commands to force the install and launch of the channel with no user interaction.
“roquoonewbie” wrote:
And let’s not forget that the ECP launching of a private channel store screen has been available for at least 2-3 years until this most recent 7.0 firmware update. If it was really a security hole, wouldn’t there have been issues by now?
Bugs and security holes can exist for years in software and websites before they’re found. Heck, there are people who have made a career of finding find such holes (Google even offers sizable bounties to people who find security vulnerabilities in their software). Just because it was available and not exploited before (as far as we’re aware) doesn’t mean it’s not a security risk.
I should reiterate that this is complete conjecture on my part. I don’t know Roku’s reasons for patching/removing the feature aside from RokuJoel’s “security fix” comment above, but I did previously work for a company that developed security software, where regular security audits and a deeper respect of potential security issues was critical.
“roquoonewbie” wrote:
If such a malicious channel existed, and an attacker had gained access to the victim’s PC (or other device), couldn’t they just as easily launch the user’s browser to the add channel screen there (eg: https://owner.roku.com/Add/ACETV)? ie: whether the malicious code launched the Add Channel screen on the Roku/TV, or launched the Add Channel screen on the PC/Browser, the risk is the same as far as I can tell. I don’t see how launching the channel store screen poses any more of a risk. In both cases, the attacker has to first gain access to run code on a device on the user’s network, present an Add Channel option to the victim, and get the victim to agree to do so.
You are right, TheEndless’s example is not a real security concern. In his niceness, he’d creatively apologize (Canadian much? :P) for most anything RokuCo may do. In this case he ummm, “embellished the truth” by conjecturing that showing info screen on a channel somehow places it in the official Channel Store context. Which it doesn’t - just like having a “private” channel installed on the Home screen does not imply it came by the means of teh “Streaming Channels” section.
However: there is a security risk in that “Details” screen, in light of this August’s “indecent exposure”: viewtopic.php?f=34&t=88160
A possible intrusion scenario can go like this: scanning the internets, Mallory (or “Malice”, an automated agent) discovers Alice’s Roku and using ECP commands, brings the Details screen and installs a malicious app. Which through cunning use of the “hidden” flag turns the Rokus into a “sleeper cell” without Alice ever being able to detect - or for that matter, even remove said app. And when the time comes, said malicious apps can be launched by Malice via remote ECP for the purposes of say DDoS attack
So, does that mean that ECP install is doomed? Not at all, there are ways to tackle the real issue - instead of shooting the DetailsScreen messenger. The real concern is NOT to allow an automated agent to install channels - ANY channel - without an explicit HUMAN approval. How? Say by implementing a “PIN feedback loop” on “add channel” menu item, where there is no universally-known key sequence. For example:
Ask the owner to type the security PIN code (which is used for purchases)
Ask the viewer to type a random code, akin to a Bluetooth handshake or Roku channel-device linking. (This btw was recently implemented in fw7:) [spoiler=var-PIN:3k3b0efo]
[upload|UfdP27rDT//r9KSJ3dXJ7g==]
[/spoiler:3k3b0efo]
