I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks.

Why don't Android developers fix vulnerabilities that result in root access to a phone?

  • 3
    Because there are many different exploits, and sending out updates is hard – Natanael Jun 30 '15 at 8:12
  • These are 2 false statements. – Croll Jun 30 '15 at 10:31
  • Downvote for what? – Croll Jun 30 '15 at 10:32
  • 5
    Speaking generically, it is impossible to secure a platform that the attacker has physical control over. – gowenfawr Jun 30 '15 at 12:48
  • 2
    What's to fix? Android phones are rootable by design, right? All I had to do to unlock mine was boot into fastboot mode and run fastboot oem unlock from the standard Android SDK on my PC. Do other phones not allow that? – Ajedi32 Jul 2 '15 at 13:34

The underlying issue isn't technical, it's incentives. What's the incentive for the phone makers to protect the device from a customer rooting his/her own phone? Not much.

I'm not sure where you're getting your quote of millions of people rooting android devices, but I'd be surprised if it's in the millions. In any case, the vast majority of people don't have anywhere near the technical capabilities to root a phone, even if it's a simple matter of running a script. The point being, the current protection scheme, despite having holes in it is good enough to prevent the vast majority of people from rooting their phone.

Largely the reason for preventing root access to the phone is to protect the phone from rogue apps changing key settings, not users monkeying with the phone. The phone makers current scheme is "good enough", and playing the cat/mouse game doesn't really help them at all, since the user is already breaking the support contract when they root the phone.

|improve this answer|||||

Android Isn't Android

Android rooting is tough to fix due to the nature of Android. Because Android is open source, each manufacturer (Samsung, Motorola, Nokia, etc) takes the base Android OS and modifies it:

  1. Drivers to work with specific hardware
  2. Custom messaging, call, or system apps
  3. GUI changes to make their phones unique
  4. System backup mechanisms

Then the manufacturer gives it to the Vendor (Spring, Verizon, T-Mobile, etc), and the vendor will make their modifications:

  1. Voice mail
  2. Other backup mechanisms
  3. Over the air update services

By the time you get your phone the original Android OS is twisted into something, almost entirely different than Android. Take a friend's phone from a different network or provider. I guarantee the Settings app is different, and there are different GUI changes to it.

Root Exploits

So how does this affect rooting? Every time Android is added to introduces new attack vectors for vulnerabilities. If you look up "How to Root Android" you'll find that not every phone is supported by every rooting procedure. And by "supported" they mean "vulnerable". A Samsung Galaxy S3 might be rooted with one program, and a Motorola Razr is rooted with another.

Some root exploits work across platforms, some work across Android versions (each version of Android that's released adds new attack vectors). The Android team most likely fixes root vulnerabilities (this is speculation). But do those changes get propagated to the manufacturer and/or vendor? The manufacturer adds so much driver and GUI code that if a vulnerability is found at that level there's nothing the Android team can do about it. It would be up to Samsung, for example, to fix it. Then it would have to push the patch to each Vendor. It could be a year before the users see the patch, and by then most people have new phones with new software.

Rinse and repeat.

Now too be clear, I'm sure that when Android pushes out a security patch the vendors and manufacturers take it seriously. Those changes most likely make it in to their final build. The point I'm trying to make is that there is not a lot of transparency between these stages, and I don't know for sure what actually happens for a patch/version release.

Universal Rooting Procedure for Nexus 7 and Motorola Razr HD by XDA Developers. Notice how this "Universal" procedure only applies to two devices?

|improve this answer|||||

There are many different reasons. Like Natanael says, there isn't just one exploit to patch. If you are refering to a specific exploit, you didn't say so.

And keeping patches up to date for such a huge and diverse ecosystem is expensive. Google does not want to maintain back versions of Android operating system. Yet, millions of these devices running the old OS are in use. Even if they did patch, they have to rely on carriers to issue the patches.

It is a huge problem.

For background, read this article: http://www.pcworld.com/article/262321/over_half_of_android_devices_have_unpatched_vulnerabilities_report_says.html

Manufacturers stop issuing updates for some device models too quickly and even when they do issue updates, some carriers don't distribute them in a timely manner.

For a specific exploit, this article lays the problem on Google: http://hothardware.com/news/google-explains-why-security-exploits-go-unpatched-on-older-android-phones

I see that you refer to the type of exploit that allows users to get root on their own devices, but the answer still applies. A general rule of security is that if the attacker (in this case the owner of the device) has physical access, then the attacker always wins.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.