Slashdot Mirror
T-Mobile G1 Rooted
An anonymous reader writes "T-Mobile's G1 phone, the first commercially available Android based phone, has been rooted. The exploit is extremely simple to execute, just requiring you to run telnetd from a terminal on the phone, and then connecting to the phone via telnet."
I claim this first root post for Spain!
Apparently, so has the server. Or was this story a trick to get us to stress test the new Apache on Android app?
Learning HOW to think is more important than learning WHAT to think.
This just in, all machines that you have root access on rooted! If you have access to run telnetd you already have root.
...wasn't this supposed to be an open platform anyway? I don't quite get it.
Coral Cache
On a side note... a hyphenated domain name! How retro...
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Waiting to see how many non-Linux types try this and get in trouble. Its not a good idea to change permissions on sh. All other apps you run on your phone and use sh are now running as root [:)] I would be very scared of this setup. Going to enjoy this
The user...has to run telnetd...as root...how...how is this an exploit? Maybe its more complex than this but the site is currently 503ing for me.
Obligatory blog plug: http://www.caseybanner.ca/
I don't know much about android or phones or anything, how is this a exploit? I mean, it requires you to physically get to the phone and open a terminal...
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
What don't you get? Someone ran a network service on an open platform, the service was buggy, the device got exploited (in theory, anyways).
Why cant they come out with a $100 android WITHOUT the phone capabilities? It would be a great and useful platform without having to switch your mobile provider.
Apple has the touch, why can't Google do the same?
This is like saying something is "bricked" when it's just a bad firmware flash that can be fixed.
The phone isn't rooted. Rooted means someone gained root access through an exploit and/or installed a root kit. Running telnetd and then connecting as root is a normal method of logging in, no exploits required.
Or are they saying every UNIX system that has a method of remote access is rooted?
Are you sure that it isn't running Windows?
...a "hacker" was questioned today when it was discovered at the Genius Bar that he had set his own root password on his Macbook.
Give me a break. It was bound to happen.
It appears to be mostly open apparently they are following the Tivo model. This means that you won't be able to build a custom kernel that will run on the device because the public doesn't have access to the signing keys.
Why cant they come out with a $100 android WITHOUT the phone capabilities? It would be a great and useful platform
A smartphone without the phone is called a PDA. And yes, there is a Linux PDA; you will just have to wait for the next preorder.
i think the poster is asking- why is it necessary to use a work-around to gain root access on an open device you own
What???
Telnetd is one of those things that should just be deleted from every system that it is on.
Just use SSH folks.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
Sorry, I fail for not RTFA. They are misusing "rooted", which confused me. "rooted" in the popular [geek] vernacular means that a remote non-admin user can gain root access, such as through a buffer overflow exploit. It has nothing to do with the practice of gaining root access on your own devices.
It's apparently weirder than that. Running "telnetd" as an ordinary user apparently allows remote logins as root. This happens even though the "telnetd" executable does not apparently come with permissions set-UID to root. If that's correct, there's a security hole somewhere else that's being used by accident here. Is "login" a set-UID program on Android phones?
(As a robotics guy, I hate the name "Android" being used for a telephone. It's the worst choice since "U.S. Robotics" which ended up as a modem company.)
That depends on your expansion of "PDA." Have you seen the Apple fanboys making out with their devices in public? I think that counts as PDA as well.
Why is telnetd installed in the first place?
Ungh
Historically, other closed systems rely on running security/lockout things in some kind of root such that should the user elevate their privileges to root, they can screw around with the closed system.
I don't know enough about the platform in question to know if getting to root gives you the freedom to defy the carrier's wishes.
Even if getting root privileges opens the phone up in ways Google did not plan, what are the actual long-term benefits? I don't see any.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Sorry, I fail for not RTFA. They are misusing "rooted", which confused me. "rooted" in the popular [geek] vernacular means that a remote non-admin user can gain root access, such as through a buffer overflow exploit. It has nothing to do with the practice of gaining root access on your own devices.
I think they're using it to imply that you're renting access to Google's OS instead of gaining ownership of it, so you're gaining root access against the owner's intent.
"I zero-index my hamsters" - Willtor (147206)
This in theory means any trojan app that requests "internet access" can telnet in and root the device it runs on.
That's a sizable risk
Better get used to it. First was the "hacker" word, now "rooting".
What's next, "open"?
Extreme Programming - Redundant Array of Inexpensive Developers
... everyone ready? one... two... three... *gasp*!!!
[signature]
I use the data capabilities far more than the phone capabilities.
The fact that it's only EDGE here until next week isn't really a big deal because i'm scarcely ever off wifi.
Sure you will. I know people are working on it (guess I'm going to be guinea pig for this again). Most HTC Windows Mobile devices this has been done long ago (and usually takes only a couple of days after a new one comes out).
Not having the signing keys is usually not that much of an issue (just disable the key check).
Calling it an exploit is a stretch; perhaps it's just a vulernability, or dare I say, "working as intended"? I doubt google left such an obvious "security" flaw by mistake.
The point of this exploit isn't so you can remotely hack other people's phones, it's so mobile hackers can get to a lower level than Android permits users to do, which will allow them to flash the phone with unsigned custom updates and what not and customise their phone more.
People should really read the articles and smarten up.
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
This telnetd didn't ask for a login or password - it just went straight to a root shell prompt.
I have a small LAN with 2 machines at home behind a hardware firewall thats generally not connected to the internet anyway. Why do I need to run sshd on them when telnetd does me fine?
Silly me , this is /.
Carry on...
When I found this I didn't even bother posting it to xda for a couple days thinking it was so obvious that it had to be intentional/known.
Guess other people were in fact interested!
Don't forget "bricked".
Bricked used to mean you took the piece of equipment out to the firing range for its final trouble "shooting".
Now it means you just press the reset button.
Where is the -1: WTF? mod?
Comment removed based on user account deletion
-1: Inbred
I thought "bricked" mean't that the device was altered in such a bad way it is no longer usable, even with a hard reset, and its only use now is a brick...
Insert funny smart-ass comment here.
Which is why it makes an excellent shooting target.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
He IS risen...
People should really read the articles and smarten up.
You must be new here.
Comment removed based on user account deletion
Seriously... it makes the news, when a device is rooted, that you OWN? I mean, isn't that the point of owning a device? That you can do whatever you want with it?
Else it is not sold but leased. If they say they sold it, but do not give you root access, to me that is deliberate fraud and should be followed by a billon-dollar class-action lawsuit to sue them out of business.
How long before such news come out on the newest PC (eg from Dell)?
Oh, I forgot... that was a major "feature" of Vista, called TCPA.
Thank god all my friends and I never ever have to buy a complete PC in one piece, because of me. :)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Ok, I read the entry and it looks like someone is installing Telnetd and it's doing what it is supposed to do. This is a "rooting" just like turning on terminal services on Windows allows remote access.
Little silly to setup with root access but this is not a flaw as such, just telnetd running as root without login.
What so cool about this. Any good Unix book on telnet would tell you the same thing?.
Great! Now I finally have a use for that VT100 in the garage.
OMG I just totally rooted my Linux box by logging in as root! Shh, don't tell!
Wow. Somebody with mod points got it.
And it's not even Monty Python.
Faster! Faster! Faster would be better!
I agree. Root was obtained on a device that was locked to prevent it. The term rooted was thrown in there to sound harsh ("we rooted it" sounds better then "we obtained root"). Stop getting caught up on semantics and read the story. A phone that was locked down (by tmobile, not google) is now completely open.
The much better question is: why is there a telnetd on the phone in the first place?
/. in order to get free advertisement. Mission accomplished!
Well, duuh. Isn't it obvious? That is to make sure the phone can be rooted, the story be posted on
I think people are misunderstanding this exploit. The G1 is locked down so that a user normally can't get root access on the phone. This severely restricts the modability of the phone. Sure, you can install your own android apps.. but you can't change the android system in any way.
This exploit allows a user to get root access on the device, and thus opens a new world of modding possibilities. You are no longer restricted to what the android SDK allows you to do.
Maybe the term "rooted" isn't quite the right term, but that's debatable. In any case, this a great find, that allows us G1 owners to have *much* more control over our phones.
So are Terms and Conditions.
Terms are the things around your pluses and minuses.
Conditions (in my interpretation) are expressions of an integral type inside a conditional statement.
I wouldn't want to handle volatile chemicals or long johns or union jacks if I'm about to get struct bylightning. Happened to me once, a long long time ago.
You could always send them a POST request to their "contact us" page, explaining them about the problem.
They are likely to believe that you are sending them an email when in fact they're sending themselves an email.
They're also likely to not know the difference between a million datagrams and a ton of data.
Of course the contact us page rejects the address you enter into the address field.
Fortunately, they're competent enough to know that clients can always be trusted, so you can just post your complaint with socat (or netcat, or telnet) to get around their checks which they only did in javascript.
Don't you just love incompetent hackjobs? ;)
"Brick" was one too I think.
Where is the -1: WTF? mod?
What are you talking about? That could be a great reason for +1, too!
When is Slashdot going to add a -1 moderation option for people who actually RTFA?
Looking at his UID it is lower than yours. newbie
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
That's like saying that a Tivo is an open platform because it runs Linux. Sorry, it ain't so.
Android is an open platform. It's released under open source licenses, and anyone can make Android-based devices.
The G1 happens to run Android, but is not open. It contains a lot of stuff that is not part of the open-source Android platform. It will not run firmware that is not signed, so even though you can build your own version of the Android firmware, you can't run it on a G1, and even if you did, it would only have a subset of the G1 functionality.
If you build your own Android-based firmware, it would be no problem to get root access, but you're not supposed to be able to get root access on a G1, and especially not by starting a telnetd as a non-root user.
I want complex moderations.
(+i, Imaginative)
DRM: Terminator crops for your mind!
Does this mean that telnetd is setuid root, or does it mean that you already have to have root to get root?
Physical access is always root access with, perhaps, a time delay.
Question everything
I agree that "bricked" use to mean the electronic gadget was as useful as a brick. Nowadays it seems, however, that it doesn't mean you need to simply push the reset button, but it often is recoverable.
For example, the router installs of DD-WRT will occasionally "brick" a router (the term used on the FAQ and forums). And yet, some fancy work with short circuiting, or soldering iron or other non-trivial tweaking may be necessary to get it going again. The router isn't a brick, but for all intents and purposes to most newbies it still is. It isn't hitting a reset button for sure, but may be recoverable.
See also: hacker, cracker, root, nerd, geek
This post brought to you by your friendly neighborhood MBA.
%110 Agreed
Did you mean aleph--aught?
If opportunity came disguised as temptation, one knock would be enough.
3^2 * 67^1 * 977^1
And here I was thinking they "rooted" the G1 to keep it safe from garbage collection.
The point of this exploit isn't so you can remotely hack other people's phones, it's so mobile hackers can get to a lower level than Android permits users to do.
FYI, the people replying here know that. If they really thought it was a remote exploit then they wouldn't be complaining about the use of the word "rooted" to describe it, because that would be a legitimate use of the word. It is exactly because they do know that this is a way to unlock a phone and not a way to root it that they are complaining.
In other words, this has nothing to do with stupidity or lack of understanding of slashdotters, but the fact that they would rather nitpick semantics then discuss the issue.
* OMFG break out your "I rooted you box and didnt even use a trojan" leet t-shirt.... Lame!
News Reporters Make Tasty Polar Bear Treats!
Yes. Microsoft is working on that one: http://www.microsoft.com/opensource/licenses.mspx
Before commenting on the Bible, please read it first
Rooted means you get root access you were not supposed to get. A local root exploit (local user becomes root) is less annoying than a remote root exploit. But it is still considered rooted. And yes, it counts if it is just due to a configuration error.
So here we have a device for which you, the buyer, does not have root access. Someone found a way, via a (most probably forgotten) setuid telnetd to access the device as root. You did not have root access before. You have root access now against the will of the manufacturer. The machine has been rooted.
``...wasn't this supposed to be an open platform anyway? I don't quite get it.''
As far as I know, it wasn't really. That's what they are screaming from the rooftops, but really, the only thing you get access to is Java. That's nothing worth getting excited about. Now, if this "exploit" actually allows you access to the *nix system, that's a whole different story. So maybe someone can shed some light on whether it does that or not.
Please correct me if I got my facts wrong.
Those are hardly the same. Hacking is a perfectly legal activity but the majority of people think the word means illegally breaking into a computer system. Rooting means you break into a system and gain administrator access, which in most places is illegal unless you have permission from the owner of the system. But now it seems people start to think of the word as covering places where you gain access to a device that you already own. So it seems like we are almost at the point where people think rooting means hacking and hacking means rooting.
I said no text :P
I teach a DB class, and make my students do a simple web app (in php); I teach the version of functions with no placeholder since it is easier to debug (just print the string you're sending); this is also what you see in most examples (just googled pg_query, 143K hits, pg_query_params got 9K hits, ~ 14 to 1 ration !)
Of course, I'm changing my ways now, but unless we start teaching the beginners right, we're in trouble :)
Wrong.
Here in the UK breaking and entering does mean breaking in the conventional sense. That is why you cannot be prosecuted for gaining entrance to a property if you do not have to break the locks, doors, windows etc. and why squatters, once they are in, and having secured the property, are safe until the court give the police permission to "break in" to kick them out.
If someone leaves a house empty and the window open, you are not breaking and entering by climbing in through the window... not that I am encouraging it.
Apple, in conjunction with their fanboys, rewrote the definition to put people off from trying to jailbreak the iPhone.
Phillip.
Property for sale in Nice, France
Or perhaps 'beta'?
That is not at all what happened. Idiots have been misusing the term since before the iPhone was even announced, about everything from home internet routers to video game systems.
Thanks for being obsessed enough with Apple and their users to mention them, though. Non sequiturs like this must make them feel great, what with all of them being such trendy emo attention whores and all, right?
I prefer the Australian interpretation of "rooting". Apparently the Canadian olympic team caused something of a stir at the Syndey games, since their uniforms bore the logo of their sponsor clothing chain "Roots". Might have well read "fucks" or "cocks"
War as we knew it was obsolete
Nothing could beat complete denial
- Emily Haines
I was gonna suggest that, actually. +1 WTF
Also, +1 mindreading
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Actually, the local user(s) (is/are) the tiny Google Gnome(s) inside the G1. You, the remote user, are gaining root access.
Thus, rooted.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Nonsense. Rooting is someone who shouldn't be root gaining root. It can be local root exploit or a remote root exploit, it matters not. What do you claim the popular geek vernacular for a local root exploit is, if it's not rooting?
Also FatPhil on SoylentNews, id 863
[ Car anology ]
I am sitting inside my car with the radio on. AHA! My car has been stolen.
1. The summary plain sucks, it barely mentions words like "rooted" or "exploit".
2. By the time most people posted their messages, there was no FA... It was severely slashdoted.
3. Now that it is available, the "article", turns out to be a random forum post that just explains how to do it. Still no explanation on why this was needed, so I'll take your pretty statement as proof you did not RTFA...
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
When I saw the heading I was thinking something very different to what the actual story was about. In Australia rooted == fucked ie... "Hey, wanna root?" "I'd root her." "Fuck, the car's rooted." "She's definitely rootable." "They are rooting like rabbits."
open as in 'you can see/mess with the source code'
not open as in 'when the software is built and installed on your device, you can do whatever you like with the device'.
the devices are less locked down then the iPhone - but apps aren't allowed to do just any old thing.
VLC Remote for iPhone and Android
I think that in some places "breaking" actually does mean breaking, but there is an equivalent crime, "illegal entry". In my state, (I think) they carry approximately the same penalty.
Aren't ridiculous comments like this intercepted by the staff at Slashdot? Come on! I'm depending on you guys!