Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me question the underlying security model.

Specifically, I used a Lifehacker's method that uses an application called "Revolutionary" that first gets the phone into S-Off mode (so you can access the parts of restricted parts of the NAND flash memory). Then it downloads and installs ClockworkMod recovery and installs to the bootloader, from which I can then run to install a superuser.apk (e.g., from here.)

Revolutionary is closed source, so I have absolutely no idea if it does anything extra to my phone; e.g., install a (malicious) rootkit, keylog my activities, using my phone in botnet ddos attacks, etc. I don't keep super-sensitive data on my phone, but I still want my accounts to be safe and stay in control of my phone. I'm also a bit paranoid that Revolutionary needs a key that you get from their website if you submit your serial number.

SuperUser.apk also appears to be closed source, but seemingly vetted by the avgfree anti-virus team as well as Android marketplace. Though I assume I can use tools like android-apktool to re-egineer the apk. I can't figure out whether ClockworkMod is open source.

Have any security experts looked into these tools? I've tried running Revolutionary through a decompiler/disassembler, but couldn't make any headway. Have there been any published accounts of attacks via this method? Am I being overly paranoid? Should I worry that one of these apps did something like DroidDream?

share|improve this question
    
How did you option this revolutionary root/jailbreak and in what form (an apk file? It was surely '11 when this question, yet it would be nice if there was a chance to add how you tried to decompile/disassemble the revolutionary. – humanityANDpeace Feb 23 at 19:27

I comprehend this very interesting question to have 3 major parts

  1. Is the state of having the root powers to you device positive to security?
  2. Is the way to get this root priveledges something that jeopardizes the security (i.e. because the way of rooting involves untrusted code)
  3. Can risks of (2.) be prevented or mitigated?

With regard to (1.) my conviction is that for having ultimatively the responsability for your device, it requires the absolute control, which with regards to the underlying OS kernel (linux) means root priveledges. By no means should having those root access imply to use it unwisely, i.e. even though often spoken as "the device is rooted" it does not imply that now everything (every app) has root and even less should have root priveledges. Considering the challange and security issue of often delayed/slow updates to the Android OS it is sensible to me to use root to adjust the system manually by adding updates earlier. Also using root power would allow to reduce the tcb (trusted code base) when bloatware and spyware is removed.

The next point and a very valid one in the question is with regards to the security aspects of the way to get such desirable root access to your device. The manufactorer's are mostly ill-advised in limiting what users can do with their property, and perceive the product as being still theirs which makes them use locked down bootloaders and withhold them access to the bough devices. The first thing to consider (in terms of safety) is that in no way is it desirable to use a product which does not grand you rights to see as much as possible. The argument that the user must be protected from his/her own stupidity cannot trump the aspect that essentially not having root allowing trickery from sides of the manufactorer right from the start. "Buying devices which cannot be rooted implies mostly buying a device that cannot be proberly checked either".

Bottom line to point 2 is that with some common sense one can prefer to buy devices that allow root without the need for untrusted software to achieve that goal.

With respect to the third and last derived aspect of the question I would like to suggest the apktool software that might help to support the way that was already laid out in the question, i.e. to look into the apk used to gain root access.

By buying a root power granting the security aspect is imho much helped. It sets a trust anchor/signal to me if the manufacturer allows most transparent display of the tcb and allows to use users own/adjusted free software code. If by mistake a devices was bought whose producers belittle's users into accepting a jail, a jailbreak-tool that is open source is to be prefered. Eventually root priveledges can be used for good and bad, i.e. do not guarantee to improve security. But without root access to the device on the other hand it is guaranteed that no security improvenment is possible in the first place.

share|improve this answer

The only thing that makes me wary in this situation is that Revolution is closed source. Especially since it can access your NAND flash storage with no restrictions, and in light of this who really knows what it's doing.

Now, you can also look at this through a different lens. ClockWork is a less popular version of Android. With a less popular version, you're less likely to fall victim to a targeted attack. Conversely, there could be a 0-day with CWM that no one [beneveolent] has found and reported.

In the end, I think it comes down to use education. We worry about keeping our mobile phones virus-free; but the most realistic step you can take is to monitor and be vigilant with an application's permissions that you download from the play store.

share|improve this answer
4  
The link added by you says "Vulnerabilities in NAND flash architecture", but just points to the home page of diy.stackexchange.com – pnp Sep 10 '14 at 5:18

Non-professional opinion here (not a security guy, more of a software dev), but I'd say in the right hands: more secure, considering how many phone manufacturers are not issuing critical updates to the Android operating system, and how many phones are just running around with giant exploits in them.

Also the source code is available, you, as far as I know, can compile it yourself (download from Google, grab drivers for your phone from one of the various projects providing these drivers, review/compile them together) if you're really paranoid.

Furthermore, people putting hacks into your open-source software is a lot more difficult, being as you have a ton more eyes on the code, and anyone can speak up and reference code that they've forked (hence the original guys can't take it down), and it would pretty much be the end of those guy's professional career.

Edit:

HBoot isn't open source, however they do have alternative open-source bootloaders along with projects analyzing hboot:

http://tjworld.net/wiki/Projects/Bootloader-AP

share|improve this answer
7  
The rooting process is not open source. E.g., the first step (using revolutionary to make get to S-Off) on a HTC phone uses an exploit the devs chose not to make open source (claiming that making it open source will let android close the hole in future versions): unrevoked.com/rootwiki/doku.php/public/revolutionary So basically to get to root, you have to at the bootloader level load closed source code written by random individuals; who in principle could easily attach rootkits. – dr jimbob Nov 11 '11 at 20:35
    
I knew the rooting process was secret, didn't know the bootloader was. – StrangeWill Nov 11 '11 at 20:39
3  
Updated, they have open-source bootloaders as I thought. – StrangeWill Nov 11 '11 at 20:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.