2

If for example your super user app is compromised(for real life example, supersu app was bought by an unknown company a while back, which could have malicious intentions) is there any way to make the phone secure again? Will flashing a new ROM remove all traces and make the phone safe again? Or does root go deeper?

TIA

Improve this question
3
  • 3
    Root can go deeper by overwriting the bootloader with a malicious one that will compromise any future firmware installed on it. Whether that's actually the case is up to debate of course. – André Borie Sep 15 '16 at 0:13
  • Even if the bootloader is locked? – Lorenzo Sep 15 '16 at 16:03
  • As far as I know a locked bootloader would prevent booting an unsigned firmware, but wouldn't protect against someone already having root and overwriting the /dev/mtd* device nodes where the bootloader resides. – André Borie Sep 15 '16 at 16:20
1

When malware has root access it basically means it capable of modifying system files and bootloader. If you trust custom firmwares such as Cyanogenmod you can consider wiping partitions and installing Cyanogenmod alongside with some custom recovery and bootloader. After reflashing /system /boot and /recovery I see no reason to be worried.

Improve this answer
0

This is the same set of problems as dealt with in the seminal 'trusting trust' paradox https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

i.e. how can you ever trust a compiler not to compile something malicious when specific circusmtances trigger it, given that compilers are too complex to examine easily, and everything you deal with was made with a compiler.

I'd take the easy way out: it's too hard, and for things that matter its worth the cost to just get a new phone. If you're paranoid about someone with nation-state resources they could've affected firmware in a way where even with a clean-os it can't be trusted.

Improve this answer
4
  • That is an interesting way to view it, but in a more practical matter, would you not trust the device? The adversary would not be someone with nation-state resources but the company that bought SuperSu. – Lorenzo Sep 15 '16 at 16:10
  • I think you miss my point - the device is like a compiler - once it's trust is in doubt, there's no easy way to verify it's trustworthy again; once a phone has been rooted, you can never trust it again if you don't know what resources were within reach for whoever wrote the code to root it - if they had a level of access which could've reflashed bootloaders/firmwares/os/drivers it's very hard to verify it's all safe. You know what's easy? Buying a clean phone. – pacifist Sep 27 '16 at 3:33
  • Oh really... Is there a stronger reason to trust the new device? – Alex Cohn Feb 12 '17 at 21:48
  • Yes. A new device is more trusted than one which has been compromised. Doesn't mean new devices can be trusted either, but they can be trusted more than one that's known to have been compromised. – pacifist Mar 8 '17 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.