According to the Wikipedia page for Andorid rooting,
The process of rooting varies widely by device, but usually includes exploiting a security weakness in the firmware of the device [emphasis added], and then copying the su binary to a location in the current process's PATH (e.g. /system/xbin/su) and granting it executable permissions with the chmod command. A supervisor application like SuperUser or SuperSU can regulate and log elevated permission requests from other applications. Many guides, tutorials, and automatic processes exist for popular Android devices facilitating a fast and easy rooting process.
Now, I wanted to know what exploits are being used in this process so I started looking around. I did find a couple references to Android exploits (notably RageAgainstTheCode), but a couple questions on here (this one and How does su regulate app permissions?) give me the impression that no actual exploit is being performed.
From what I have gathered the process works like such:
- Unlock bootloader (wipes device for security concerns)
- Install custom recovery (will allow flashing arbitrary ZIP files)
- Flash SuperUser.apk app
As I understand it, the custom recovery is able to flash the ZIP file because it exists at a lower level (so to speak) than the ROM, and as such, can modify the ROM to install the
su binary and SuperUser app. That is, no real exploit is being used to attain root.
Am I grossly missing something here? Is some exploit being performed implicitly during one of these steps?
As a note, I'm talking about a user rooting a phone, not about a malicious piece of code getting root access.