2

Once an Android device has been successfully rooted, are there any additional security risks created (besides telling SuperUser to trust a rogue root app)?

For example, on a rooted Android device, can apps that aren't given root permissions through SuperUser (SU) ever perform root actions?

For all answers, please assume that the user has not, and will not, approve any apps in SuperUser without properly vetting them.

Improve this question
1
  • The implications of a malicious app with root access and a vulnerable app with root access are quite similar. When vetting an app for root access, are you vetting both intent and secure coding practices?
    – apsillers
    Mar 19, 2015 at 16:55

1 Answer 1

Reset to default
2

The SuperUser app acts as a gateway to running things as root, which should prevent apps from becoming root directly without your approval. However, if an app you approve to run as root has a vulnerability, a malicious app might be able to exploit it to gain root.

Other security concerns include:

  • Taking advantage of the more lax side-loading abilities (i.e. loading non-Play Store apps) which are not vetted in the same way that Play Store apps are.
  • Leaving USB debugging enabled by accident, after the rooting process, may allow a host device to attack your Android device after rooting.
  • Leaving "Unknown Sources" enabled after rooting may also lead to malicious applications being launched, though this still (usually) requires user interaction.
Improve this answer
2
  • Thank you. Do you have a reference or details to support the statement "However, if an app you approve to run as root has a vulnerability, a malicious app might be able to exploit it to gain root."?
    – End Anti-Semitic Hate
    Mar 19, 2015 at 21:06
  • @RockPaperLizard Any standard Android pentesting guide would cover it, but your primary threats are likely to be from poor IPC code.
    – Polynomial
    Mar 20, 2015 at 9:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .