Set-top box Hacking: freeing the 'Freebox' (39c3)

The French ISP 'Free' was the first to introduce a set-top box in France in 2002, named the Freebox. Four years later, the fifth version of the Freebox was released and distributed to customers. It comprises two devices: a router, and a PVR called the Freebox HD, both running Linux. The Freebox HD had innovative features at the time, such as live television control and HD capabilities. Such a device has a lot of potential for running homebrew, so I decided to hack it. I present how I got arbitrary code execution on the Freebox HD and then root privileges, using a chain of two 0-day exploits, one of which is in the Linux kernel. I then analyze the device, run homebrew software, and explain the structure of the ISP's private network that I uncovered while exploring the device. The Freebox HD is a set-top box with media player capabilities designed and built by the French ISP 'Free' in 2006, and distributed to customers since (including me). It is still in use and will be maintained until the end of 2025. When I got it, I wanted to run homebrew software on it, so I decided to reverse engineer it. The initial goal was to get arbitrary code execution. The Freebox HD being largely undocumented, this talk shows the full process of reverse engineering it from scratch: * Initial visual inspection * Disassembly and inspection of the insides * Attack surface analysis and choice of the target * Search and exploitation of a vulnerability in PrBoom (a Doom source port running on the Freebox HD) * Analysis of the Linux system running on the Freebox HD * Search and exploitation of a Linux kernel exploit to escape the sandbox and gain root privileges * Decryption and dump of the firmware * Analysis of the Linux system and the programs of the Freebox HD * Playing with the remote control capabilities * Reverse engineering of the private networks of the ISP The two exploits used to gain full root access were both discovered for this specific hack, which makes them 0-day exploits. The analysis leads to some interesting discoveries about the device itself, but also the ISP, how their technical support works and accesses the devices remotely, and much more! Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2025/hub/event/detail/set-top-box-hacking-freeing-the-freebox