6

I have never used an android phone and so hopefully this is not a bad question to ask.

I know on iOS the kernel itself is signed and so cannot be extended and all applications are signed. Hence I cannot ssh/telnet into it for example and getting a shell. Unless you jailbreak it and disable signature verification and do other stuff you cannot install custom apps as well.

So how does it work on Android? Is the kernel signed? If so is rooting and android device similar to jailbreaking an iOS device? I read some articles saying that you can install custom kernel onto an android device, which kind of indicates that the kernel is not signed. So is this how root access is prevented? The kernel does not allow userid 0? What exactly happens or needs to happen to prevent root access? Or what actually needs to happen to OS functionality to enable root?

Improve this question
2
  • Partly, phones have just an unlocked bootloader and you can do whatever you want with them. There are also some ways to get root access on phones with a locked bootloader, for example privilage escalation exploits.
    – Cube
    Jul 25, 2015 at 0:59
  • It simply... doesn't give you a way to get root. Not all devices allow installing custom kernels.
    – user253751
    Oct 15, 2016 at 11:00

1 Answer 1

Reset to default
2

As already indicated by @Cube in the comment, some (not all) Android phones allow to unlock the bootloader to flash custom kernels and firmware to your device. However, there is only a limited number of models that support it since it is meant for researchers and developers. Also, during the unlocking process you lose all your data, so you cannot use this to silently flash a malicious system or kernel to someone's device without him/her noticing it. But in general, the bootloader is locked, so this is the one line of defense against getting root: disallowing to flash custom software. As an experimental feature, Android recently also introduced dm-verity to make persistent rootkits even harder.

The other way is to use privilege escalation attacks, meaning you actively exploit a vulnerability in Android that allows you to get root privileges. For example, some services need to run as root, so if you can run code in their context you execute your code with root privileges. However, let's get back to your question about the defenses. First, app's processes are isolated from other processes and the middleware by the kernel. More concretely, Android (ab)uses Linux' user seperation by assigning each app a unique userID. So the kernel isolates them the same way as users are isolated on classical Linux systems. So classical viruses where other programs/apps are infected is simply not possible on Android if there is no critical vulnerability at hand. Also, the middleware contains a lot of access control points where the caller is checked and verified. In addition, beginning with Android 4 Google started to integrate SELinux into Android as the so called Security Extensions for Android, or SE for Android. Here, more fine-grained mandatory access control is added to further lower the chance of a successful attack. When it comes to preventing special kinds of attacks, Android also added support for ASLR in the 4.x versions and extended it ever since then. For example, on newer Android 5 versions binaries are only loaded if they are compiled as position-independent executables.

So this is a subset of all the defenses that Android provides against attacks in general or root exploits in particular. This list is not complete but it gives you an idea what attackers need to overcome and how much the Android devs care about security (which I personally appreciate a lot).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .