Having spent some time researching what actually goes behind rooting an Android phone, the main reason that leads to the ability root is an inherent vulnerability on the Linux kernel that leads to the exploit and getting the 'su' binary to be installed.

My question is: How come the OS is not hardened yet? Who is responsible? This is a Linux OS we're talking about, which is considered "secure". Yet, people always find a way to get in and root devices.

  • 1
    Linux isn't exempt from privilege escalation exploits. Code has bugs, and even desktop Linux exploits get discovered periodically. What kind of answer are you looking for here? – eldarerathis Aug 31 '12 at 19:20
  • Compared to a Desktop flavor of Linux, wouldn't you say that the linux versions used for android phones are more susceptible to priv-esc exploits ? Also, I am not aware of ALL the exploits out there that enable privilege escalation.. If you could shed some light on whether these exploits are dense around some specific services/processes running as root already, that would be helpful for me in understanding why people have not been successful in hardening the OS enough to prevent this. – asudhak Aug 31 '12 at 19:31
  • Not really, no. A quick Google search shows sources having a record of at least 200+ kernel vulns found in Linux (since the data started being recorded). The most recent one I see on this site has activity about 2 weeks old (the "Bypass" one). Android ones may perhaps linger longer since carriers are slow to update, but the fundamental answer to your question still seems to be "code has bugs, some are exploitable". Vulns may exist outside the kernel as well. – eldarerathis Aug 31 '12 at 19:34
  • 1
    Rooting is not always possible. – Flow Aug 31 '12 at 19:51
  • I'm not sure about all phones, but isn't rooting possible because of the recovery mode built in? To me, it seems the recovery mode is the analog to a PC Bios. The fact that you can install Knoppix on a PC and have access to the machine isn't really an indictment of Linux security, but a BIOS that isn't constrained (and really doesn't need to be for most purposes). – Chance Aug 31 '12 at 19:57

it's not really the "linux OS", it is the linux kernel. The vulnerability is not necessarily in the OS, or the kernel. There are different exploits that are used. I remember some device being able to load any zip file in the recovery if it was "pre-pended" by a signed zip file. So they used a signed zip and added an unsigned zip to the end of the file. I think this exploit was for the Original Droid.

No software is 100% bug free. if it was, then even a mature product like Windows would not have to do security patch releases every month.

No matter how smart the developer is, or thinks he is, more likely than not, there is probably someone smarter (or at least they may know more about exploiting code).

When exploits are discovered, Google (or the manufacturer) has (usually) patched them. But since a lot of the devices don't receive updates very often, the exploit remains available.

  • Ryan is right. Many exploits don't exploit the kernel but some daemon software which runs as root. – Flow Aug 31 '12 at 19:50
  • Well, then ... its the age old answer that if someone builds something, there will ALWAYS be someone who can break it :) Although, it is still not tangible to me that, these big organizations, (Google, as well device manufacturers) are not capable of preventing this. Well, thats just a personal thought ! – asudhak Aug 31 '12 at 19:59
  • 1
    @asudhak You really think that? I am a software developer for a company and I can tell you, we had a lot of bugs that were found by our QA, but after our last release there were bugs that were reported in production. Also, like I said, if there were not bugs, then Microsoft would not have to have Patch Tuesday. – Ryan Conrad Aug 31 '12 at 21:59
  • I have to agree with Ryan - you seem to be equating the size of a company with some kind of infallibility. Until the perfect human being is born bugs will always exist, as they inherently stem from programming mistakes (and everyone, no matter how skilled they are at some given task, will make mistakes). – eldarerathis Sep 2 '12 at 4:21
  • @RyanConrad - actually, in some phones exploits are NOT being fixed. For instance, the last DROID3 update I got did NOT patch the hole used to root the phones, so I had no problem (and no wait) after the update to re-root my phone. – Michael Kohne Sep 19 '12 at 14:37

Rooting is always possible because rooting, a.k.a. user switching, a.k.a. setuid, is one of the most fundamental feature of Unix and Linux.

For many devices, rooting does not actually involve any security exploits; rooting methods that requires flashing a file through the bootloader and/or ROM updater utility (e.g. Samsung's Odin, HTC's RUU, etc) are not a security breach, as they are legitimate features specifically designed for flashing ROMs. A large number of devices are rooted in this way.

On those devices, rooting are possible because the manufacturers actually provides the facility for it. They certainly do not make rooting an easy one-click process (for good reasons; most people who wanted to root do not actually need root), but they do provide an officially sanctioned method to root under the condition that your warranty voids (official rooting method often leaves a permanent mark to let authorized technicians know if a phone had been rooted).

There are not that many quite a few rooting methods that actually uses a security exploits (e.g. rageagainstthecage, zergRush, gingerbreak, etc), and these exploits are often repackaged into a form that are much easier to use for the masses (e.g. SuperOneClick). Rooting through exploits are often hit and miss since they get patched fairly quickly for devices that are still within update period; but sometimes they provide advantages such as avoiding triggering the warranty marking.

The issue becomes a little complicated when the tech news and blogs reported when a developer wrote tutorials or tools to ease up legitimate rooting process. They often do not understand the nature of the rooting method, and certainly I have never seen them distinguish between legitimate rooting methods and rooting through security exploits, worse they also often report the repackaging of existing exploit and the porting of an existing exploit to a new device as if they're a totally different exploits. Thus the confusion that makes it appear that Android seems to have more exploits than it really does.

Your Answer

