They Sealed This Prison Tablet in a Red Shell With No Screws or Seams, Someone Still Got Inside.

Prison tablets offer a few basic purposes: to provide approved entertainment, messaging, and limited services to those jailed while limiting access to anything else. Manufacturers go to great pains to reinforce these boundaries through hardware and software decisions.

This particular specimen came from a company named Road Kill Incorporated. The bright red unit has a completely seamless outer shell manufactured through 3D printing. Builders stopped the printing process at critical stages to trap internal components within the plastic. Charging is controlled by four uneven brass rectangles on the upper surface, which connect to a similar dock. The back features a single button. Even the headphone jack appears larger as a result of an earlier change.

Standard ports just go dark when the device is functioning properly, and powering it up needs some real handiness, as you must solder straight wires to those exterior charging pads. A multimeter came very handy for determining the proper connections to employ. Swapping the power and data lines around eventually allowed the tablet to draw a reasonable charge, around 500 milliamps. When it was connected in and turned on, both the Intel and Windows boot menus appeared on the screen, but the battery was reading entirely empty internally from the start.

Tearing open the case was a difficult task, requiring an X-ACTO knife, a new hacksaw blade, and some serious elbow grease to cut through the thick plastic walls. However, you must exercise caution with your fingertips because the design leaves little room for grip. When you open the case, you’ll notice layers of foam padding covering the components, thick goop holding the cables and motherboard in place, and dielectric grease coating all of the connectors. It’s a delicate dance to get all of this out without cracking anything, but with a little persistence, you can get the whole thing. There is also a concealed HDMI port and an SD card slot, albeit both are restricted from routine use.

The technical specifications aren’t particularly impressive, with an Intel Atom CPU clocked at 1.44 GHz, 2GB of memory, and 32GB of storage. The operating system is Windows 10 Home, which was installed in 2018 and has not been updated since, creating a significant security vulnerability on its own. Software-wise, things lock down quite fast. When it boots up, it immediately enters kiosk mode, and the desktop and taskbar seem as if someone has set fire to it. There is only one user account, ‘kiosk’, which logs in automatically and displays a password for a millisecond upon boot. Then it’s straight into a browser on the jail system’s portal, where you may do email, video calls, money transactions, and access allowed websites. All of the standard Windows components are missing, including the desktop, taskbar, and start menu. Registry settings and scripts all work together to prevent you from attempting to leave this walled garden.

Trying to perform real work with a keyboard or mouse and an OTG adapter is not very successful. Control Alt Delete displays a little menu, but none of the standard shortcuts such as Alt Tab or Alt F4 do anything. The EFI shell can only be accessed at boot, however attempting to install software from there will result in a brick wall.

The key to success was twofold: they had left disk encryption turned off, and they used a Windows technique that has been around for a while. Someone managed to find the command prompt on the device and rename it to match one of the tool file names. After a reboot, attempting to activate the accessibility feature from the login screen resulted in a fully-privileged command prompt, from which you can issue commands to reset the administrator password. Getting into that account allows you to examine the entire file system as well as running processes, which includes all of the kiosk-restriction scripts and configuration files.
[Source]