In order to prevent cold-boot attacks against an encrypted Android filesystem, it has been recommended to keep your bootloader locked at all times with the original factory recovery installed.

The original question primarily addresses Nexus devices, which use fastboot to control bootloader access and feature a command fastboot oem lock by which to prevent unauthorized flashing.

My workflow on my Nexus devices has been to keep a PGP-signed version of the stock recovery around on the device, flash a recovery to the recovery partition while the phone is still running (dd if=openrecovery.img of=/dev/block/.../recovery), boot into recovery, backup, flash away, then reboot. If everything is well, verify the signature on the stock recovery and flash it similarly to how we flashed the recovery.

This process makes sure that cold-boot attacks are impossible, unless I forget to reflash the stock recovery, which I haven't failed to do yet.

How does this process work with Samsung phones? I have a Samsung Galaxy S5 (G900T) with a custom recovery installed. I can easily get the stock recovery. However, how do I "lock" the bootloader, for lack of a better term? There's nothing I know of in Odin which would allow me to lock the device.

Is this possible with Samsung phones?

  • AFAIK if you don't have a specific carrier's model of the phone (most notably Verizon), the bootloader is always unlocked (very special as Samsung is the only manufacturer I know that is doing so). fastboot also doesn't simply work for Samsung devices, you have to use Odin/Heimdall on order to flash an image to the phone. – GiantTree Feb 5 '15 at 6:37
  • @GiantTree That's exactly what I was thinking. When did insecure by default come into vogue? I understand that locking a bootloader indefinitely is bad (trust me, it's awful), unlocking a bootloader indefinitely is also bad, albeit in a different way. It's strange that they don't have a built-in mechanism which at least factory resets the phone on a flash no matter what. – Naftuli Kay Feb 5 '15 at 6:44
  • You have to manually reset through recovery/the running system. Kies (Samsung's software) uses the flash method to upgrade the software on your phone and it would be bad to reset the phone every update. – GiantTree Feb 5 '15 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.