Introduction

This post is about the Android tablets in BT InLink kiosks. You can find many of these on UK streets. They provide Wi-Fi connectivity, calls, some info about the local area and advertising.

You may also see the newer Street Hubs, which this post is not about. It’s about the ones with a silver-coloured housing (instead of all black).

Escaping to settings

To discover much at all, I escaped to the settings app. This doesn’t seem to work for all of them, but I happened to try an abnormal one.

1. Open a webview, for example by checking the Terms and Conditions or Privacy Policy.
2. Select some text by tapping and holding it. At the top of the screen, tap Share then choose Messaging.
3. In Messaging, open the settings, then tap ‘SMS Enabled’.
4. Tap ‘Tethering and portable hotspot’, then the search icon in the top right.
5. Search for the settings you need to.

Note: As long as you reach the Settings app and can search, any option goes for step 4.

The settings app proved very useful and taught me a lot about the tablet. And Flappy Droid is fun :)

About device

Here is some information from the ‘About device’ page in settings:

Model number: msm8960  
Processor info: QCT APQ8064 CDP  
Android version: 5.1.1  
Baseband version: Unknown  
Kernel version: 3.4.0-g039ba5c-000444-g610cd13-dirty  
ubuntu@ip-192-168-109-214 #2  
Mon Mar 16 13:56:21 UTC 2020  
Android security patch level: May 1, 2016  
Build number: LMY47V-test-keys  
Release Version: 1.8.5  

Interesting apps

Thanks to the Process Stats page in developer settings, I managed to get some package names.

• BT Dialler (org.linphone) - Linphone???
• KioskMaintenance (net.adxba.kioskmaintenance)
• net.adxba.keyboardwatcher (package name and name shown are the same)
• Hexnode MDM (com.hexnode.hexnodemdm) - During the setup, the domain adxba.hexnodemdm.com is filled in already.
• BT Launcher (net.adxba.btlauncher) - This is the app you see first when using the tablet.

ADXBA is the digital signage company that works with BT on these.

Interesting observations

Here are some things I can’t really turn into a section:

• If you switch/create users, Hexnode MDM will probably pop up first so you can set it up. Please do not ever set up Hexnode on a new user, you won’t be able to switch back to the main user, leaving you stuck with no real launcher.

• The hangup button appears to be the power button, based on the fact that it can lock the screen.

• There are several downloads for blacklist.json on the tablets I checked. The other ones are named blacklist-XXXXX.json where X is a digit.

• No signs of any cellular ability. No IMEI or connection info. The stock dialler doesn’t work for calls. This makes sense given the dialler is probably Linphone.

• When I turned on the developer settings, USB debugging and mock location were already enabled. BT Launcher has a service called MockLocationImpl.

Information webpages

At least some of the information pages are hosted at streethubreports.bt.com, like the list of charities to call.

As long as the path begins with charity, the server responds, otherwise it sends back an empty reply. I doubt it will go anytime soon, but I put the page into the Wayback Machine just in case :)

I only found this by luck when it failed to load, hopefully I see more!