Nexus devices can be unlocked using the fastboot command fastboot oem unlock to install a custom firmware. For security reasons, the phone is wiped when this command is executed. However after this is done, most people leave the boot loader unlocked.

Devices that support unlocking the boot loader: SonyEricsson (now Sony), Sony, newer HTC devices, ??

Is there a security problem with an unlocked bootloader?
If this is the case, what can be done?

1 Answer 1


A permanently unlocked boot loader (BL) on a Nexus device is a big security risk.
It's only recommended for a pure developer phone.

An insecure BL enables all sorts of fastboot commands that can be used for e.g. doing the following:

  • Conduct a cold boot attack to recover the key for Android's full disk encryption
  • Make a copy of the device
    E.g. by booting a custom image (adb boot boot.img), then copying partition dumps
  • Erase data using fastboot erase
  • Flash arbitrary Android firmware, recovery images or radio firmware
    fastboot flash radio|recovery|boot|...
  • Install a root kit (boot custom recovery, then modify system files)
  • Steal Google/Facebook/whatever accounts stored on the phone
  • etc.

In case someone has their device encrypted, full access is not immediately possible. However there exists cracking software to brute force the used encryption PIN/passphrase. Altering the firmware is always possible (i.e. an evil maid attack, aka. installing a rootkit/password logger/etc.)

This is the normal process of modding a Nexus device:

  • unlock the bootloader (fastboot oem unlock)
  • boot/install insecure/open custom recovery
  • install custom firmware

To secure your modded device you should do this afterwards:

  • install a safe recovery image again (custom recoveries like TWRP/CWM are unsafe)
    use the extracted recovery.img from Google's factory firmware file, available here
  • relock the bootloader (fastboot oem lock)

This breaks the usual update mechanisms like RomManager. In case you need to upgrade, you can run flash_image recovery recovery.img (as root on the regular Android OS, it bypasses the BL lock) to install a temporary custom recovery again and use this once to upgrade the firmware and then remove the custom recovery again by doing a flash_image recovery stock.img. I know, this is not very user friendly right now, but let's hope the situation improves at the custom recovery front.

Some background on what's possible: http://hak5.org/episodes/hak5-1205 and http://www.youtube.com/watch?v=uM2_CpuzQ0o

  • The problem with having to re-lock the bootloader, and reinstall the "stock" recovery image, is that you will wipe all your sdcard data when you want to update. You also could not install CM and use their update tool as their packages are not signed and will not install with the stock recovery. which means you would have to unlock the bootloader and reinstall CWM. I feel having an unlocked bootload is moot, I have not had a device (since my ADP1) that had an unlocked bootloader, but there are still exploits that allow me to flash a CWM and CM. Jan 4, 2013 at 1:24
  • only if you do it via fastboot. On a rooted and modded Nexus device you have the flash_image command that can be used to flash a custom recovery from within the regular running Android OS which bypasses the locked bootloader. After that you can enter the custom recovery and flash normally. After that either flash_image or the CWM can be used to reinstall the stock recovery. The recent Nexus devices are safe regarding fastboot + stock recovery (not counting if you have a screen lock or not).
    – ce4
    Jan 4, 2013 at 1:31
  • 1
    Can you summarize why CWM is unsafe if the bootloader is locked? Jan 10, 2013 at 16:36
  • 4
    In short: All(?) current 3rd party recoveries are unsafe i.e., they offer to install update.zip's without checking their signatures. Plus they run a root adbd process, that can subsequently be used to pull/change data without authentication. Stock recoveries only allow signed update.zip's and don't offer adb. Ah, and they sometimes don't let you downgrade to a (maybe insecure former version) even if the singature of the .zip is OK. Ah, btw: You can enter the recovery by restarting the phone by pressing some button-combination.
    – ce4
    Jan 10, 2013 at 16:42
  • 3
    One important info: Unrooted adb backup doesn't back up key telephony features (contacts, call log, sms, …) as I tested. The question is whether rooted adb backup pulls more than unrooted. Else I need Nandroid backups, and the question is whether these can be made from the live rooted system or only within recovery mode? The latter would mean, flashing a temporary custom recovery, backup to external medium, than reboot and restore stock recovery and locked bootloader. Quite an effort.
    – porg
    Oct 14, 2013 at 1:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .