Does Rooting Exploit a Security Weakness?

Question

According to the Wikipedia page for Android rooting,

The process of rooting varies widely by device, but usually includes exploiting a security weakness in the firmware of the device, and then copying the su binary to a location in the current process's PATH (e.g. /system/xbin/su) and granting it executable permissions with the chmod command. A supervisor application like SuperUser or SuperSU can regulate and log elevated permission requests from other applications. Many guides, tutorials, and automatic processes exist for popular Android devices facilitating a fast and easy rooting process.

Now, I wanted to know what exploits are being used in this process so I started looking around. I did find a couple references to Android exploits (notably RageAgainstTheCode), but a couple questions on here (this one and How does su regulate app permissions?) give me the impression that no actual exploit is being performed.

From what I have gathered the process works like such:

1. Unlock bootloader (wipes device for security concerns)
2. Install custom recovery (will allow flashing arbitrary ZIP files)
3. Flash SuperUser or SuperSU zip file in custom recovery.

As I understand it, the custom recovery is able to flash the ZIP file because it exists at a lower level (so to speak) than the ROM, and as such, can modify the ROM to install the su binary and SuperUser app. That is, no real exploit is being used to attain root.

Am I grossly missing something here? Is some exploit being performed implicitly during one of these steps?

As a note, I'm talking about a user rooting a phone, not about a malicious piece of code getting root access.

Answer 1

First, there's nothing like THE rooting process. You partly answered your question yourself: rooting a device can be done in different ways. The two best known methods include:

• using an exploit (SuperOneClick & Co do this: You install an app, klick it, and get rooted)
• via a custom recovery (which is directly bootable and thus can access the device directly, so you can install any ROM -- which in turn may already be rooted)

So answering your question: Yes and no -- it all depends on how you root your device. Listing up all possible exploits might get a bit lengthy, so better let's skip that part. You might also check the questions in the "related" section of this page for more details (especially What are the steps for rooting an Android device, in general?).