1

I know this question has been asked many times, but I didn't see a clear answer to it from security experts, or it is from several years ago and things might have changed.

My question is double:

  1. first of all, nowadays, how does the process of rooting an android phone work (please detail if there are various alternatives) ? Does it rely on a security hole, or is it a kind of attack (such as physical access to the device) that is not part of the security perimeter of android ? In the first case, why is it that it's not fixed, as there are open bounties for the android system ? Note that I'm just talking about the android system itself (such as a Nexus Phone), with the latest patches.

  2. Second related question: What would be the security risk of rooting an android phone ? If I am not mistaken, these could be grouped in at least two issues: the rooting process itself, and the aftermath.

    a. Regarding the rooting process, is there any open source procedure (or at least closely reviewed) to root a nexus phone that could guarantee that there's no malware installed in the process ? (see also first question)

    b. From what I understand, having a rooted android is no different than having a linux OS with a root account. Are there any (free, open source?) apps that can monitor (what commands have been launched, etc) and prevent apps from getting access to the root account without my agreement ? (so that it is linux OS where any account that requires root privileges must go through 'sudo' and ask the user to enter their password).

Improve this question
2

1 Answer 1

Reset to default
2

First of all, nowadays, how does the process of rooting an android phone work?

By using an exploit in the Android system, a binary file which is named su is added to /system/xbin partition. When an application wants to execute a command with root privileges, it executes the command with an su at the beginning of it. This sends a call to the binary file. Binary file reads a text document generated by the GUI application. If in this text file there aren't any specific information about the app that asks for root access, then the binary checks another text file (again, generated by the GUI) that shows how it should act by default in such a case. Normally in such a case, GUI app will prompt you about an app asking for root access and will ask you if you want to grant it. Depending on your decision, the GUI app will tell the binary to whether or not should it grant that app root access.

Whole process is pretty much that. However, methods of rooting are so many, that I can't fill them all in here. Because they mostly vary across manufacturers.

What would be the security risk of rooting an android phone ? If I am not mistaken, these could be grouped in at least two issues: the rooting process itself, and the aftermath.

Well, we can do so if you want.

For the rooting process itself:

First of all, it voids your warranty. Other than that, even though it is hard to completely brick the phone when only trying to root it, it is still possible when one is not careful enough. But the most common case is usually bootloops, which is not that much of a big problem in the hands of someone who knows what they are doing.

For the aftermath

A rooted phone is pretty much the same, only with more customization for a person who knows what they are doing. But every now and then there are some guys who corrupt their IMEIs, delete the Telephone app or sometimes completely brick their phone by messing up stuff in /system. Also, giving root access to an app with bad intentions, might not (and probably will not) end well.

a. Regarding the rooting process, is there any open source procedure (or at least closely reviewed) to root a nexus phone that could guarantee that there's no malware installed in the process ?

Well, I don't know about Nexus a lot but I don't think a rooting process might actually end up with malwares in your phone. Most su binary creators share their codes at gitHub already. And the popular ones (i.e. Chainfire from XDA) are trustworthy developers that have the trust of the community.

b. From what I understand, having a rooted android is no different than having a linux OS with a root account. Are there any (free, open source?) apps that can monitor (what commands have been launched, etc) and prevent apps from getting access to the root account without my agreement ? (so that it is linux OS where any account that requires root privileges must go through 'sudo' and ask the user to enter their password).

Know this: Apps can make use of the exploits on their own and gain access even on a non-rooted phone. However, the GUI apps like SuperSU or Superuser come with their own su binary that act only as ordered by the GUI app. So if you don't let them, they don't have root access.

Improve this answer
5
  • Thanks for this detailed answer. I would like to point out that I'm only interested about a naked android system, such as the Nexus Phone, without manufacturer specificities. Can you please detail more the "by using an exploit in the android system" part ? I am a bit puzzled as to why there would be known vulnerabilities in the open for the latest versions, seeing as, as mentioned in my question, there is money involved if you find vulnerabilities in a android system.
    – thomasUJ
    Jan 17, 2016 at 16:27
  • @thomasUJ Android system, as a whole, is made of different layers. So there can't be "naked system" without manufacturer-dependent parts such as the kernel. There is a reason the ROMs, the recoveries, the rooting methods etc. are all device specific.
    – SarpSTA
    Jan 17, 2016 at 16:58
  • Also, Android is an open source OS. Therefore, it is much more likely to have its exploits exposed.
    – SarpSTA
    Jan 17, 2016 at 17:00
  • The nexus line contains little to no manufacturer or wireless carrier modifications to Android (wikipedia), that's what I meant. I'm not sure how you relate being open source to having more exploits exposed, it's usually the opposite. In either case, I don't really feel that you answered my question regarding having known vulnerabilities on a up-to-date android system (which I doubt there is, at least publicly available, hence the bounty programs); but thanks for the other infos, I have a better understanding of it now
    – thomasUJ
    Jan 18, 2016 at 18:51
  • @thomasUJ It is kind of hard to explain the details here. What that Wiki page means is about something related to AOSP. Just know that your concept of a naked Android OS is wrong. And for the open source part: It is like looking at the blueprints of a building. A thief can always use it to spot an entrance. Of course, it makes use for bounty hunters to spot and fix them as well, yet it doesn't change the fact that it makes it more likely to have its soft-spots exposed.
    – SarpSTA
    Jan 19, 2016 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .