Abusing the Internet of Things

(Rick Simeone) #1

Main.css
A stylesheet definition to control the look and formatting of the application.
Grattafiori and Yavor looked at the Skype app included in the Samsung Smart TV, starting
with the config.xml file:


<widget>
<category>lifestyle</category>
<autoUpdate>y</autoUpdate>
<cpname>Skype</cpname>
<login>n</login>
<ver>2.120601</ver>y
<mgrver>2.305</mgrver>
<emp>empSkype::empCamera</emp>
<fullwidget>y</fullwidget>
<widgetname>Skype</widgetname>
<description>Skype application</description> <runTitle>Skype</runTitle>
<author>
<name>Samsung Electronics Co. Ltd.</name> <link>http://www.sec.co.kr/</link>
<organization>Samsung Electronics Co. Ltd.</organization> </author>
</widget>

It is interesting that the name and organization are listed as Samsung, even though Skype
supplies the code. This signifies that Skype provided Samsung with the binaries and libraries
to support the application, but it was the Samsung engineers who actually developed and inte-
grated the main application.
Here is the index.html file for the Skype app:


<html>
<head>
<meta http-equiv="Content-Type" content="text/html">
<title>2011 MoIP Widget</title>
<script type="text/javascript" src="$MANAGER_WIDGET/Common/API/Widget.js">
</script>
<script type="text/javascript" src="$MANAGER_WIDGET/Common/core.js"></script>
<OBJECT id="pluginObjectAppCommon_Skype" border=0 classid="clsid:SAMSUNG-
INFOLINK-APPCOMMON" style="display:block;width:0px;height:0px;"></OBJECT>
<OBJECT id="EmpSkype" border=0 classid="clsid:SAMSUNG-INFOLINK-SEF"></OBJECT>
</head>
<body>
<script type="text/javascript" language="javascript" src="$MANAGER_WIDGET/Common/
IME/ime2.js">
</script>
</body>
</html>

While analyzing the Skype app, Grattafiori and Yavor found snippets like these in the
JavaScript code:


UNDERSTANDING AND EXPLOITING THE APP WORLD 143
Free download pdf