Security implications of rooting Android

Question

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me question the underlying security model.

Specifically, I used a Lifehacker's method that uses an application called "Revolutionary" that first gets the phone into S-Off mode (so you can access the parts of restricted parts of the NAND flash memory). Then it downloads and installs ClockworkMod recovery and installs to the bootloader, from which I can then run to install a superuser.apk (e.g., from here.)

Revolutionary is closed source, so I have absolutely no idea if it does anything extra to my phone; e.g., install a (malicious) rootkit, keylog my activities, using my phone in botnet ddos attacks, etc. I don't keep super-sensitive data on my phone, but I still want my accounts to be safe and stay in control of my phone. I'm also a bit paranoid that Revolutionary needs a key that you get from their website if you submit your serial number.

SuperUser.apk also appears to be closed source, but seemingly vetted by the avgfree anti-virus team as well as Android marketplace. Though I assume I can use tools like android-apktool to re-egineer the apk. I can't figure out whether ClockworkMod is open source.

Have any security experts looked into these tools? I've tried running Revolutionary through a decompiler/disassembler, but couldn't make any headway. Have there been any published accounts of attacks via this method? Am I being overly paranoid? Should I worry that one of these apps did something like DroidDream?

Answer 1

Non-professional opinion here (not a security guy, more of a software dev), but I'd say in the right hands: more secure, considering how many phone manufacturers are not issuing critical updates to the Android operating system, and how many phones are just running around with giant exploits in them.

Also the source code is available, you, as far as I know, can compile it yourself (download from Google, grab drivers for your phone from one of the various projects providing these drivers, review/compile them together) if you're really paranoid.

Furthermore, people putting hacks into your open-source software is a lot more difficult, being as you have a ton more eyes on the code, and anyone can speak up and reference code that they've forked (hence the original guys can't take it down), and it would pretty much be the end of those guy's professional career.

Edit:

HBoot isn't open source, however they do have alternative open-source bootloaders along with projects analyzing hboot:

http://tjworld.net/wiki/Projects/Bootloader-AP

Answer 2

I comprehend this very interesting question to have 3 major parts

1. Is the state of having the root powers to you device positive to security?
2. Is the way to get this root privileges something that jeopardizes the security (i.e. because the way of rooting involves untrusted code)
3. Can risks of (2.) be prevented or mitigated?

With regard to (1.) my conviction is that for having ultimately the responsibility for your device, it requires absolute control, which with regards to the underlying OS kernel (linux) means root privileges. By no means should having those root access imply to use it unwisely, i.e. even though often spoken as "the device is rooted" it does not imply that now everything (every app) has root and even less should have root privileges. Considering the challenge and security issue of often delayed/slow updates to the Android OS it is sensible to me to use root to adjust the system manually by adding updates earlier. Also using root power would allow to reduce the tcb (trusted code base) when bloatware and spyware are removed.

The next point and a very valid one in the question is with regards to the security aspects of the way to get such desirable root access to your device. The manufactorer's are mostly ill-advised in limiting what users can do with their property, and perceive the product as being still theirs which makes them use locked down bootloaders and withhold them access to the bough devices. The first thing to consider (in terms of safety) is that in no way is it desirable to use a product that does not grant you rights to see as much as possible. The argument that the user must be protected from his/her own stupidity cannot trump the aspect that essentially not having root allowing trickery from sides of the manufacturer right from the start. "Buying devices which cannot be rooted implies mostly buying a device that cannot be properly checked either".

The bottom line to point 2 is that with some common sense one can prefer to buy devices that allow root without the need for untrusted software to achieve that goal.

With respect to the third and last derived aspect of the question I would like to suggest the apktool software that might help to support the way that was already laid out in the question, i.e. to look into the apk used to gain root access.

By buying a root power granting the security aspect is much helped. It sets a trust anchor/signal to me if the manufacturer allows the most transparent display of the tcb and allows to use users' own/adjusted free software code. If by mistake a device was bought whose producers belittle users into accepting a jail, a jailbreak-tool that is open source is to be preferred.

Eventually root privileges can be used for good and bad, i.e. do not guarantee to improve security. But without root access to the device on the other hand it is guaranteed that no security improvement is possible in the first place.

Answer 3

The only thing that makes me wary in this situation is that Revolution is closed source. Especially since it can access your NAND flash storage with no restrictions, and in light of this who really knows what it's doing.

Now, you can also look at this through a different lens. ClockWork is a less popular version of Android. With a less popular version, you're less likely to fall victim to a targeted attack. Conversely, there could be a 0-day with CWM that no one [beneveolent] has found and reported.

In the end, I think it comes down to use education. We worry about keeping our mobile phones virus-free; but the most realistic step you can take is to monitor and be vigilant with an application's permissions that you download from the play store.