2

Once an Android device has been successfully rooted, are there any additional security risks created (besides telling SuperUser to trust a rogue root app)?

For example, on a rooted Android device, can apps that aren't given root permissions through SuperUser (SU) ever perform root actions?

For all answers, please assume that the user has not, and will not, approve any apps in SuperUser without properly vetting them.

  • The implications of a malicious app with root access and a vulnerable app with root access are quite similar. When vetting an app for root access, are you vetting both intent and secure coding practices? – apsillers Mar 19 '15 at 16:55
2

The SuperUser app acts as a gateway to running things as root, which should prevent apps from becoming root directly without your approval. However, if an app you approve to run as root has a vulnerability, a malicious app might be able to exploit it to gain root.

Other security concerns include:

  • Taking advantage of the more lax side-loading abilities (i.e. loading non-Play Store apps) which are not vetted in the same way that Play Store apps are.
  • Leaving USB debugging enabled by accident, after the rooting process, may allow a host device to attack your Android device after rooting.
  • Leaving "Unknown Sources" enabled after rooting may also lead to malicious applications being launched, though this still (usually) requires user interaction.
  • Thank you. Do you have a reference or details to support the statement "However, if an app you approve to run as root has a vulnerability, a malicious app might be able to exploit it to gain root."? – RockPaperLizard Mar 19 '15 at 21:06
  • @RockPaperLizard Any standard Android pentesting guide would cover it, but your primary threats are likely to be from poor IPC code. – Polynomial Mar 20 '15 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.