Introduction

This post is about the Android tablets in BT InLink kiosks. You can find many of these on UK streets. They provide internet access, calls, some info about the local area and advertising.

You may also see the newer Street Hubs, which this post is not about. If you’re in the UK and manage to get info on these, please share your findings!

Escaping to settings

To discover much at all, I escaped to the settings app. Your results with this may vary.

Easy method

1. Open the overview/app switcher.
2. Tap and hold the title of any app, then press the back button once the app info opens.
3. Go to the ‘Running’ section on the new screen that you see.
4. Select Hexnode MDM and terminate KioskService (or just all the Hexnode processes)
5. Go back a screen, go to cached processes and stop Hexnode there too.

Now you can use the quick settings (pull down from the top of the screen) to open Settings!

Old and tedious method

This is what I used initially, but it’s far more limited and doesn’t let you see the full settings app:

1. Open a webview, for example by opening the Terms and Conditions or Privacy Policy on the home screen.
2. Select some text by tapping and holding it. Then at the top of the screen, tap Share then choose Messaging.
3. In Messaging, tap the three dots, open its settings, then tap ‘SMS Enabled’. This should take you to another screen.
4. Tap ‘Tethering and portable hotspot’, then the search icon in the top right.
5. Search for the settings you need to!

The settings app proved very useful and taught me a lot about the tablet. And Flappy Droid is fun :)

About device

Here is some information from the ‘About device’ page in settings:

Model number: msm8960  
Processor info: QCT APQ8064 CDP  
Android version: 5.1.1  
Baseband version: Unknown  
Kernel version: 3.4.0-g039ba5c-000444-g610cd13-dirty  
ubuntu@ip-192-168-109-214 #2  
Mon Mar 16 13:56:21 UTC 2020  
Android security patch level: May 1, 2016  
Build number: LMY47V-test-keys  
Release Version: 1.8.5  

Apps

Thanks to the Process Stats page in developer settings, I managed to get some package names.

• BT Dialler (org.linphone) - Self-explanatory, it calls people.
• KioskMaintenance (net.adxba.kioskmaintenance) - I don’t know
• net.adxba.keyboardwatcher - This is an accessibility service, but I don’t know what it does.
• Hexnode MDM (com.hexnode.hexnodemdm) - Manages policty on the tablet. The Hexnode server is adxba.hexnodemdm.com.
• BT Launcher (net.adxba.btlauncher) - This is the app you see first when using the tablet.

ADXBA is the digital signage company that worked with BT on these.

Interesting observations

Here are some things I can’t really turn into a section:

• If you switch/create users, Hexnode MDM will probably pop up first so you can set it up. Please don’t do this, or it becomes difficult to escape back to the main user (opening settings being the only real way to do this).

• The hangup button appears to be the power button, based on the fact that it can lock the screen.

• There are several downloads for blacklist.json on the tablets I checked. The other ones are named blacklist-XXXXX.json where X is a digit.

• No signs of any cellular ability. No IMEI or connection info. The stock dialler doesn’t work for calls. This makes sense given the dialler is probably Linphone.

• When I turned on the developer settings, USB debugging and mock location were already enabled. BT Launcher has a service called MockLocationImpl.

• If you shut down the tablet, it just reboots! By itself!

Information webpages

At least some of the information pages are hosted at streethubreports.bt.com, like the list of charities to call.

As long as the path begins with charity, the server responds, otherwise it sends back an empty reply. I doubt it will go anytime soon, but I put the page into the Wayback Machine just in case :)

I only found this by luck when it failed to load, hopefully I see more!