Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example the password lock? Any other precautions I should take or disable some services such as the notorious USB Debigging (adb)? How does iOS and Android platforms compare in terms of what can they expose, should the development/debugging profiles have been enabled?

share|improve this question

The problem raises that when an attacker is able to establish a shell or run code on your phone, he has access to all internals. From here he could just unlock the device by overriding commands in the screen lock application or even more easy would be to just start extracting data through the shell.

A problem specifically with jailbroken devices is that you abuse a security weakness to get it jailbroken. The problem is that as long as you don't update your phone, because you want to keep your phone jailbroken, the security vulnerability remains in your device and could potentially be abused by attackers to gain access to your phone.

With android a rooted device is actually a feature, but depending on how you root the phone you need to take care of a few things. Some android rooting programs automatically enable a telnet host without authentication on it. Others automatically enable adb.

The biggest issue is that the sandbox in which your apps run when you have a rooted device becomes obsolete. The App will run as root and will be able to access data stored within other apps. Because of this you become a lot more exposed should you, by accident, install a malicious app.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.