8

Some Android anti-virus offer a firewall like Avast or Comodo anti-virus but you need to have a root access to use them.

However rooting an Adroid phone is often presented as a security risk.

So:

  1. Why does the anti-virus tells you to root your device if it is a security risk?

  2. Are firewalls for android devices really worth it? I mean which is more secure:

    • A rooted Android device with a firewall installed.
    • Or a non rooted one with no Android firewall?
Improve this question
6
  • 3
    Root on Android is a security risk for stupid people, as the crap they install (malware disguised as cracked apps, etc) can run with superuser privileges. I assume you aren't stupid so this should be fine as long as you trust whoever made the root exploit to not be malicious (an open-source rooting tool would be great).
    – André Borie
    Jan 4, 2016 at 12:46
  • That's a bit of an overstatement @AndréBorie. For example, making readonly partitions writable opens you up to new phone vulnerabilities.
    – Neil Smithline
    Jan 4, 2016 at 15:16
  • @NeilSmithline does rooting actually make partitions writable ? I believe it only gives you the ability to grant root permissions to apps (through the "SuperUser"/"SuperSU" app) but doesn't do anything else unless you explicitly do it yourself or grant root privileges to an app that will then remount sensitive partitions as read-write.
    – André Borie
    Jan 4, 2016 at 17:31
  • I'm fuzzy on the details @AndréBorie. My understanding is that to root a phone so that rooting holds after a reboot, you need to exploit a vulnerability in the phone that allows you to write into the read-only parts of the firmware. Once you've rooted a phone, you can then remount the key parts of the OS R/W. Many rooting strategies come with the ability to always mount the OS partition R/W. I believe all allow you to remount it R/W. So, after further thought, rooting makes it easier to write to the OS partition, but doesn't necessarily force it.
    – Neil Smithline
    Jan 4, 2016 at 18:35
  • @HenryWHHack - Google's Play store is notorious for having malware. See Malware hits the Google Play Android app store again (and again) for some background.
    – Neil Smithline
    Jan 4, 2016 at 18:38

1 Answer 1

Reset to default
7

1. Why does the anti-virus tells you to root your device if it is a security risk

Basically, as answered here, rooting allows you to give root permissions (let's say to execute sudo) to some applications. The list of these applications with root permissions could be controlled with 'Superuser' app (integrated in the Settings for Cyanogenmod).

Also, you (a phone owner) now have root privileges. So if you will start installing software from third-party forums, noname markets/stores and will give root permissions to all of this applications, this will be bad, because you should not trust these apps. If you want to give a rooted phone to your grandma, and she does not undestand concepts of rooting/apps/app stores/permissions/etc - do not do it.

Next, if you are still careful, and only gives root permissions to 1-2 applications you and other people trust (like firewall or file manager, downloaded from reputable source), then it's ok. However, if this file manager or other software has vulnerability, some malware could use this vulnerability to get root access through this file manager, which now has root permissions. That is what I see as a risk.

However, unrooted devices could also have vulnerabilities like Stagefright, that allow an attacker to get root access to the phone, since unrooted Andriod still has libraries / system apps running with root permissions. So all you do is an increasing number of potentialy vulnerable apps with root permissions, that could be hacked (if you carefully select what and from where you install).

Most antivirus apps very often really need root permissions to be able to actively manage/block other apps, if they find some suspicious activity in them.

2. Does firewalls for android devices really worth it

It depends on what do you want from the firewall. E.g., I'm concerned about my privacy. And I still want to use some apps. However, these apps sometimes require Internet access, even though their functionality has nothing to do with Internet communication in my eyes (e.g., I do not want a music player to access an Internet, but I still want to use this music player, while PrivacyGuard has no functionality to control Internet access for apps). So I installed an AFWall+ to control which applications have Internet access. For me, it is worth it. I have a Cyanogenmod with root on my phone.

However, I do not have an antivirus. Personally, I do not see a much sense in having it, since I try to install apps only from trusted sources, see also this question

So, if you only give root permissions only to the single firewall from PlayStore, and you believe that this firewall has no serious vulnerabilities, then "A rooted Android device with a firewall" is more secure.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.