This question already has an answer here:

I know this question has been asked many times, but I didn't see a clear answer to it from security experts, or it is from several years ago and things might have changed.

My question is double:

  1. first of all, nowadays, how does the process of rooting an android phone work (please detail if there are various alternatives) ? Does it rely on a security hole, or is it a kind of attack (such as physical access to the device) that is not part of the security perimeter of android ? In the first case, why is it that it's not fixed, as there are open bounties for the android system ? Note that I'm just talking about the android system itself (such as a Nexus Phone), with the latest patches.

  2. Second related question: What would be the security risk of rooting an android phone ? If I am not mistaken, these could be grouped in at least two issues: the rooting process itself, and the aftermath.

    a. Regarding the rooting process, is there any open source procedure (or at least closely reviewed) to root a nexus phone that could guarantee that there's no malware installed in the process ? (see also first question)

    b. From what I understand, having a rooted android is no different than having a linux OS with a root account. Are there any (free, open source?) apps that can monitor (what commands have been launched, etc) and prevent apps from getting access to the root account without my agreement ? (so that it is linux OS where any account that requires root privileges must go through 'sudo' and ask the user to enter their password).

marked as duplicate by Gilles, Rory Alsop Nov 27 '17 at 7:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    If you are only interested in the information about a specific phone model, this may not be the best site. Perhaps our sister site android.stackexchange.com or even a phone-specific forum (forum.xda-developers.com) would be better. – Neil Smithline Jan 16 '16 at 18:23
  • BTW, what makes you think that all manufacturers want to prevent rooting? As far as I can tell, there's a large range. Companies like Samsung almost encourage rooting while Motorola works hard to prevent it. – Neil Smithline Jan 16 '16 at 18:25
  • Can you please include links to the older answers that you have found. – Neil Smithline Jan 16 '16 at 18:25
  • @NeilSmithline no I'm not asking about a specific phone model, just about android in general (which is why I mentioned nexus, which has no OS addons, such as touchwiz for Samsung). I asked it here because I'm more interested in the security point of view than the android specificities. And as for your second question, I didn't say manufacturers want to prevent rooting, I just talked about security holes, but as my first question states, I don't really know if they are the same thing (which is to say, does rooting imply there's a security hole?) – thomasUJ Jan 16 '16 at 18:50
  • 2a1: Most of the rooting I have done on my phone is not from an app, but using a USB cable to get the ADB shell on the phone. Usually, it involved changing file permissions long enough to replace a binary with the existing shell. In that new shell, bootstrap yourself further to root. In short, Linux scripts are plain text and readable with a text editor, so open source. – rjt Jan 16 '16 at 22:37

I will confine my answers to Nexus phones.

I have rooted my Nexus phone. I am sure that rooting will work on new Nexus phones. ( Samsung phones can also be rooted)

Rooting does not rely on any particular security hole. The broad idea is to be able to execute commands as a root user (as like in the linux system). Rooting a phone in itself cannot be termed as an attack; But the catch is if someone steals a phone and then tries to root it, it can be a problem. Nexus phones will be wiped completely during the rooting process.

Regarding the security risks for running apps on rooted phones. A very simplistic example would be, if an application caches an authenticated session cookie (or password) in an area in the phone that cannot be generally accessed by the user (on non rooted phones), then it can be accessed on rooted phones. (Loosing a rooted phone can lead to password theft or cookie theft quite easily)

A not so simplistic example would be an attacker trying to run an application on a rooted phone and using maybe IP tables on the android phone to redirect traffic to a proxy (for an application that cannot be generally proxyed).

To protect against these kind of threats, applications employ root protection mechanisms that results in applications not running on rooted phones or running in a restricted manner on rooted phones.

There are counter applications that try to hide root capability to bypass root detection defense mechanism. They work at times.

But a really skilled attacker can go upto the level of modifying the source code of the apk and using modified version of the application to suite his purpose.

Hence the best way for an application is to not rely on the client side for protecting sensitive data or on the integrity of the data received ( the source code or the assumption that the application will not work on a rooted phone)

To root the phone, i had used this as a guideline and it had worked for me. http://www.ibtimes.co.uk/root-nexus-5-nexus-7-2012-wi-fi-android-5-1-lmy47d-lollipop-firmware-1491474

You can use the superuser application on to manage the other applications with root access. So if an application is requesting root access, you will have to explicitly allow it via the super user application. https://play.google.com/store/apps/details?id=eu.chainfire.supersu

I am not sure if this has answered your questions completely Do let me know if you have any queries, and i shall try to answer.

  1. The general process of rooting a phone works by exploiting a vulnerability in the respective Android OS to conduct a privilege escalation which in turn makes you (a non-root user) root. You can then install modified firmware. This is, by definition, relying on security holes

  2. There is no guarantee that using the exploit on your phone to root it doesn't include malware unless you know the source code. Also if you download a custom image or kernel, you can easily unintentionally download a backdoored firmware. So if you decide to root your phone, definitely chose a custom kernel from a page like XDA Developers where code is reviewed at least a bit. Just never install a closed source kernel.

You can list processes in Linux fairly easily with ps aux , however, this makes little to no sense with mobile devices. Also the main problem with rooted devices is that you can not simply go back from root to normal user mode. Root access is usually only used temporarily in Linux, so even with a perfectly non backdoored root, your mobile will stay more vulnerable.

  • Apps such as Super SU prompt the user before allowing another app to become root. Doesn't this mitigate the vulnerability in your last paragraph? – SilverlightFox Jan 29 '16 at 14:40
  • Well, all these apps do is implement a directory based Access Control Management. This might prompt a message when you install apps or maybe even if they run, but all the background processes associated with your account which run all the time will still have root privileges, since you are logged in as root. This should be obvious given that the SU-apps only run when you are logged in as a root user. The problem with being root is not that apps might escalate their privileges, but that malware has an easy time. – AdHominem Jan 29 '16 at 14:51
  • I'm not sure how it has an easy time if you don't allow it to escalate. – SilverlightFox Jan 29 '16 at 14:58
  • Unix has a directory based access control. Each process runs either in kernel mode or user mode. Processes which are started during boot and login are started as root on a rooted device, and no matter what you do after login (like starting an own, additional access control), they will remain root processes. If these processes have a vulnerability and get exploited, the shellcode runs with root privileges. It's really simple. – AdHominem Jan 29 '16 at 15:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.