Can a screen-locked Android phone be rooted?

Question

By locked I mean a phone that has been locked with a standard PIN code, password or pattern.

I'm not meaning to break into somebody's phone, merely wondering to what extent applying any of the standard screen lock methods to my phone would protect my data in case of theft.

In case a locked phone can easily be rooted, I assume the lock can then also be bypassed, and locking the phone is then really of little value for protection (since rooting techniques are common knowledge these days), and I would then have to consider other protection mechanism, such as encryption.

Please keep your answer concise, and don't give general security advice. I just want to know if there are known (widespread) methods to root locked Android devices.

Note this question is with regard to Android phones with factory default settings (i.e. no developer options, USB debugging enabled).

I'm specifically interested in Nexus devices running Android 4.4 KitKat.

Answer 1

Short answer: no.

Long answer: not usually, but there some exceptions.

In general, to root the phone, you first have to unlock the bootloader. This wipes the internal storage, keeping your data safe. (It doesn't usually wipe the SD card, but you have to assume an attacker will just remove the SD card if he wants to read it). You'd almost think it was designed this way!

You can easily get past a screen lock using ADB, but you've already specified that that's disabled. Even if USB debugging is enabled on the phone, newer Android versions have a "confirm the debugging key" prompt when you use ADB from a new PC, which requires the attacker to unlock the screen anyway.

Some phones have low-level security vulnerabilities that aren't part of Android. For example, you used to be able to root any exynos4 device (such as the Samsung Galaxy S3) by running an app that abused the camera interface to exploit the way the camera driver works. (This flaw has now been fixed in OTA updates.) In this particular case, you'd need to install a special app of your choice onto the phone and run it to exploit the vulnerability. It's likely that any future errors like this will also need the attacker to run a special app, so can't be used on a locked phone with USB disabled, but it's conceivable that some flaw might be added that could be exploited from the lock screen (perhaps using MTP or USB-OTG).

The last exception is, of course, if the bootloader is already unlocked. In this case, the attacker can flash anything he likes to the system. He wouldn't even need to root the phone: he could simply disable the lock screen and reboot the phone to get to the home screen. Some users think that bootloader locking is just to make things harder for users, but it's an important part of Android's security mechanism.