8

What are the security and privacy concerns surrounding using a custom android ROM like that of cyanogen?

  • 2
    One big thing to learn from the recent Ikee worm that spread across jailbroken iPhones, is to make sure that once you're rooted and running a custom ROM, you use a complex root password that no one else knows, and make sure that nothing else in there is left using a default password. – GAThrawn Nov 14 '10 at 12:44
5

I would say the biggest issue with a lot of custom ROMs including Cyanogen's is that the OS and system apps are signed with test keys. These keys are publicly available, meaning that it is possible for someone to write an app that uses "signatureOrSystem" or "signature" level permissions. There are known cases of malware that targets these custom ROMs [1,2].

On a more positive note, if you run a rooted devices, you can do things like set up a host file to block ads, enable a firewall per application, selectively disable permissions, etc. Custom ROMs often ship with newer kernels, so a lot of security vulnerabilities that are kernel-based are dealt with faster than what Google can do.

[1] http://www.cs.ncsu.edu/faculty/jiang/Fjcon/

[2] http://blog.mylookout.com/blog/2011/06/15/security-alert-malware-found-targeting-custom-roms-jsmshider/

4

Well, it is open source so you can look at the code and build it yourself if for any reason you don't trust the binaries that are shared.

I believe the only data they collect is from crash logs, and maybe the number of installs (I can't find a source for this if anyone can help me out here).

Other than that, a lot of people use it as it is probably the most popular rom out there. If there were privacy issues, people would be all over it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.