Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me question the underlying security model.

Specifically, I used a Lifehacker's method that uses an application called "Revolutionary" that first gets the phone into S-Off mode (so you can access the parts of restricted parts of the NAND flash memory). Then it downloads and installs ClockworkMod recovery and installs to the bootloader, from which I can then run to install a superuser.apk (e.g., from here.)

Revolutionary is closed source, so I have absolutely no idea if it does anything extra to my phone; e.g., install a (malicious) rootkit, keylog my activities, using my phone in botnet ddos attacks, etc. I don't keep super-sensitive data on my phone, but I still want my accounts to be safe and stay in control of my phone. I'm also a bit paranoid that Revolutionary needs a key that you get from their website if you submit your serial number.

SuperUser.apk also appears to be closed source, but seemingly vetted by the avgfree anti-virus team as well as Android marketplace. Though I assume I can use tools like android-apktool to re-egineer the apk. I can't figure out whether ClockworkMod is open source.

Have any security experts looked into these tools? I've tried running Revolutionary through a decompiler/disassembler, but couldn't make any headway. Have there been any published accounts of attacks via this method? Am I being overly paranoid? Should I worry that one of these apps did something like DroidDream?

share|improve this question

2 Answers 2

The only thing that makes me wary in this situation is that Revolution is closed source. Especially since it can access your NAND flash storage with no restrictions, and in light of this who really knows what it's doing.

Now, you can also look at this through a different lens. ClockWork is a less popular version of Android. With a less popular version, you're less likely to fall victim to a targeted attack. Conversely, there could be a 0-day with CWM that no one [beneveolent] has found and reported.

In the end, I think it comes down to use education. We worry about keeping our mobile phones virus-free; but the most realistic step you can take is to monitor and be vigilant with an application's permissions that you download from the play store.

share|improve this answer
2  
The link added by you says "Vulnerabilities in NAND flash architecture", but just points to the home page of diy.stackexchange.com –  pnp Sep 10 at 5:18

Non-professional opinion here (not a security guy, more of a software dev), but I'd say in the right hands: more secure, considering how many phone manufacturers are not issuing critical updates to the Android operating system, and how many phones are just running around with giant exploits in them.

Also the source code is available, you, as far as I know, can compile it yourself (download from Google, grab drivers for your phone from one of the various projects providing these drivers, review/compile them together) if you're really paranoid.

Furthermore, people putting hacks into your open-source software is a lot more difficult, being as you have a ton more eyes on the code, and anyone can speak up and reference code that they've forked (hence the original guys can't take it down), and it would pretty much be the end of those guy's professional career.

Edit:

HBoot isn't open source, however they do have alternative open-source bootloaders along with projects analyzing hboot:

http://tjworld.net/wiki/Projects/Bootloader-AP

share|improve this answer
6  
The rooting process is not open source. E.g., the first step (using revolutionary to make get to S-Off) on a HTC phone uses an exploit the devs chose not to make open source (claiming that making it open source will let android close the hole in future versions): unrevoked.com/rootwiki/doku.php/public/revolutionary So basically to get to root, you have to at the bootloader level load closed source code written by random individuals; who in principle could easily attach rootkits. –  dr jimbob Nov 11 '11 at 20:35
    
I knew the rooting process was secret, didn't know the bootloader was. –  StrangeWill Nov 11 '11 at 20:39
3  
Updated, they have open-source bootloaders as I thought. –  StrangeWill Nov 11 '11 at 20:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.