I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example the password lock? Any other precautions I should take or disable some services such as the notorious USB Debigging (adb)? How does iOS and Android platforms compare in terms of what can they expose, should the development/debugging profiles have been enabled?
The problem raises that when an attacker is able to establish a shell or run code on your phone, he has access to all internals. From here he could just unlock the device by overriding commands in the screen lock application or even more easy would be to just start extracting data through the shell.
A problem specifically with jailbroken devices is that you abuse a security weakness to get it jailbroken. The problem is that as long as you don't update your phone, because you want to keep your phone jailbroken, the security vulnerability remains in your device and could potentially be abused by attackers to gain access to your phone.
With android a rooted device is actually a feature, but depending on how you root the phone you need to take care of a few things. Some android rooting programs automatically enable a telnet host without authentication on it. Others automatically enable adb.
The biggest issue is that the sandbox in which your apps run when you have a rooted device becomes obsolete. The App will run as root and will be able to access data stored within other apps. Because of this you become a lot more exposed should you, by accident, install a malicious app.
Superuser access is not a security vulerability per se, nor does it weaken the security of the device. On the contrary, a good implementation of the superuser prompt allows applications to bypass OS security measures and perform more actions.
There are two factors to consider:
- First, is that security is relative. An application faking GPS position may be a privacy enhancement to the owner of the device, but can be a security violation to the owners of Pokemon Go (Niantic corp) or any other game relying on player's physical location
- Except for trusted and audited open source application, you can't know what a superuser application is really doing. While you run a device's overclock, the app can silently install a kernel module to proxy TLS traffic and sniff your bank account PIN
According to your question:
how could potential adversaries compromise for example the password lock?
An adversary can turn you into running a superuser app and grant it superuser privileges. Once granted, and they are likely granted forever, it can listen on a GCM (Google Cloud Messaging) notification for the app owner to remotely unlock the device.