Slashdot Mirror
Motorola's Sholes Bootloader Unlocked
teh31337one writes "Motorola's locked bootloader for their Sholes-family devices (Droid OG, Milestone, DroidX, Droid 2 etc, not Atrix 4G) has finally been cracked. @nenolod explains on his website: The Motorola Sholes platform uses a trusted bootloader environment. Signatures are stored as part of the CDT stored on the NAND flash. mbmloader verifies the signature on mbm before passing control. mbm verifies all other signatures before allowing the device to boot. There is a vulnerability in the way that Motorola generated the signatures on the sections stored in the CDT. This vulnerability is very simple. Like on the PlayStation 3, Motorola forgot to add a random value to the signature in order to mask the private key. This allowed the private key and initialization vector to be cracked. This comes at the time when HTC are also stepping up their attempts at locking down their phones . The recently released LTE flagship — ThunderBolt is their most locked-down phone to date ... They made signed images, a signed kernel, and a signed recovery. They also locked the memory."
Even with the cracked bootloader, the company's attitude is not good, so I won't buy a phone from them.
... as a programmer is to spend less time trying to hack, tweak, or otherwise add value to platforms owned by companies who want to strip away my rights as a user to modify and operate those platforms as I see fit.
Why do they spend so much money locking down the phone instead of making a competitive, lasting product that the consumer actually wants? "They also locked the memory.", what the fuck.
Disagree != mod troll.
Sorry, but we shouldn't have to fight teeth and nails to get proper access to devices we buy and own.
Being locked out of our own legally purchased devices is NOT normal.
Kind of like buying a computer and not being able to do what you want with it.
Wait, what is this OSX upgrade you tell me about? Sounds great, and only 29.99!
No wit here.
It seems these DRM schemes are getting harder and harder to break as the manufacturers are learning from the unlocking community. The iPhone hasn't had an unlock for iOS 4.1, 4.2, and 4.3 yet due to Apple closing more security holes and implementing new checksums. (Anyone who has an unlocked iPhone for 4.1 and 4.2 is doing a hacked form of upgrade that prevents a full firmware/baseband upgrade, but new buyers are completely out of luck)
It seems like the rooting/jailbreaking/unlocking/modchipping community kinda small; a few geniuses figure it out and publish it in a handy software package for the rest. What does this mean for the future, will the locking/DRM powers outpace them?
With a locked phone they can give the provider control over the phone (read: appstore ), and the telecom provider. I think Motorola hopes to make extra money from the provider instead of the consumer.
You are right, if consumers wanted a closed phone they would have bought a iPhone. an android phone is NOT a closed environment, and locking one part down in an open environment leaves a mediocre (in comparison) product.
Why can't you use your own phone as you please, even more so if it's Android, an open platform?
The only reason I can think of is piracy, which seems to be the justification for everything nowadays.
Seriously, this is a genuine question, not some sort of philosophy.
so... you want the smartphone manufacturers to restrict something, at least?
I had a sig once. It was lost in the great storm of '09.
... so maybe this is a stupid question.
Is it easier to jailbreak an iPhone (or iDevice) than this? I thought Android devices were "open"; if so shouldn't one be able to change their OS more easily?
Or does the openness of the Android platform refer to the fact that there is no restriction on the Apps you can install? Or is there something else I am missing?
*about this issue. I'm quite knowledgeable about a host of others though!
Why do manufacturers restrict the use of their products like this? For me, as a presumptive buyer, it doesn't sound like a feature at all, just silly. What is the purpose?
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
According to the Guys from #milestone-modding (nadlabak, xvilka,...) the keys and the Story is a fake/hoax.
Does nobody check this before releasing News?
Motorola forgot to add a random value to the signature in order to mask the private key.
Forgot? Or didn't want to?
If you post as an AC, don't expect me to spend a mod point on you.
what about radio frequencies? should those be restricted? Do you know how trivial it really would be for a a virus to turn a cell phone into a cell phone jammer? In order to get the most flexibility some things have to be done in software however that flexibility comes at a price. your walking around with a cell phone jammer all it needs to do is a few software tweaks.
should that be allowed too? you don't want anything restricted right?
i thought once I was found, but it was only a dream.
Every phone should offer two modes of operation: One that is locked down by the manufacturer making him liable for any malfunction, and one that removes all the locks and limits and shifts liability to the user. That way everyone would be happy.
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.
This comes at the time when HTC are also stepping up their attempts at locking down their phones . The recently released LTE flagship — ThunderBolt is their most locked-down phone to date.
The submitter should know that the HTC Thunderbolt is just a customized variant of the HTC Desire HD provided for Verizon. Locking it up is almost certainly a Verizon-demanded attribute, and not an initiative from HTC. The Desire HD is unlocked in most of the world, and I doubt if a locked version can be obtained in countries with a more enlightened phone system.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
and if that user(or a virus that was only able to work because of changes the user made) then accidentally turns their phone into a jammer, should he be liable too when someone else can't call emergency services and someone dies as a result?
We expect phones to work as phones 100% of the time.
i thought once I was found, but it was only a dream.
Of course they should be liable! If you tinker with your car and thereby cause an accident you are liable for any damages, not the manufacturer. If your "off-the-shelf" car displays a fault that leads to an accident the manufacturer is held responsible. We already have rules for all possible scenarios.
I am dumbstruck as to why the mere act of adding software to an already existing, well explained and satisfyingly regulated problem suddenly makes everything so complicated and somehow "special". Whether it is online fraud, phishing, liability for software errors, child pornography, terrorism - we already have several cubic LoC in laws and regulations for all of that. It just is not explicitly called online x, or x using a computer.
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.
We're getting to a point where if we don't like how we're being treated as a customer, we can no longer take our money elsewhere. Every option is becoming evil.
Because 99% of the population can't keep viruses off their desktop computers, why do you think they are smart enough to keep them off their cell phones.
if software in a car causes it to crash and kill people liablity goes back to the manufacture, however if your tinkering with your phone and the liablity comes down on you personally because you installed the next version of angry birds free from a random link on a website, and that version contained a trojan. You are now liable for murder for installing a game for your kids(or yourself).
People can't keep their desktop's and laptop virus free. do you really want the equivalnt of the slammer virus going around on cell phones shutting down huge parts of the cell network?
i thought once I was found, but it was only a dream.
I've been running custom roms and kernels on my rooted Droid OG for a while now. What exactly was the locked bootloader preventing me from doing?
What about guns? Do you know how trivial it is to mow down 6 or more people with one handgun? In your worldview I wouldnt even be allowed to have a gun, becasue i MIGHT kill people with it. And yes, if I want to turn my cell phone in to a jammer that should be allowed. What should not be allowed is me USING it.
Good-bye
Grow up. Arguing with you is like talking to a 3rd grader. You have absolutely no clue regarding liability, freedom or tinkering. Take your nanny state ideas and shove them up your ass.
Good-bye
Since when did ElGamal private keys fit into a single tweet? I don't believe for a second that Motorola were using a 240bit key, I call bullshit.
what about radio frequencies? should those be restricted? Do you know how trivial it really would be for a a virus to turn a cell phone into a cell phone jammer?
Not trivial at all. The radio firmware on smartphones - which controls use of the radio transmitter and does all the GSM/UTMS/... protocol stuff - runs on an entirely seperate processor to the operating system, with its own independent tamper protection that doesn't rely on the OS. Usually the protection on the radio hardware is much tighter too. When smartphone manufacturers lock down what OS image software you run, it's not to protect the cell network, it's only to protect their own profits.
In fact, it'd probably be much, much easier to take down the cellphone network with a cheap dumbphone - they run the radio firmware on the same CPU as the OS and don't have nearly as much protection against code modification.
if you go android, go with the current Google reference device. One of Googles base requirements is that you single handedly can unlock the bootloader as you wish (usually via the command adb oem unlock)
Currently the two reference devices are the Nexus One and the Nexus S.
Here's why: In the US, the only way to get a phone is through a carrier.
Correction, for the LAZY that is the only way.
In the United States, the price of 2 years of service includes a discount on a phone. There's no discount on the service for not buying a phone at the same time as the plan. T-Mobile used to offer such a discount, called "Even More Plus", but it'll probably go away in a year once AT&T completes its acquisition of T-Mobile.
A european iphone 4 works perfectly here
On which carrier?
You want something with added functionality? You try to find something that has that functionality included OEM.
It doesn't help if all OEMs refuse to provide such a product to the public. Case in point: I want a set-top video game player that lets me make and run my own games, but the three OEMs of set-top video game players (Microsoft, Nintendo, and Sony) don't provide that. In fact, Nintendo is openly hostile to home developers. So it's a Morton's fork: all products on the market are unsuitable.
do you really want the equivalnt of the slammer virus going around on cell phones shutting down huge parts of the cell network?
Actually, yes, that would be awesome! It certainly would do more for improving the security and stability of our communication networks and devices than any locking down done to a select few handsets.
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.
And you believe anarchy is a good model for the future.
I don't want a nanny state. No one has offered a better option yet. Right now the number of iphone viruses out there only attack jail broken phones. For Android which never get updates(something like 80% of android phone models never get updates) because the manufactures don't care once they have your money. You then become reliant on programmers who don't care that you have a mid level phone, since they don't have it it doesn't matter.
As for liability, independent developers on XDA don't care. the moment you flash on new firmware your warranty is voided and you took responsibility for any and all problems in the future. If I was HTC, or Motorola I wouldn't bother with the expensive lock downs. I would build a small text file that only wrote when the system was flashed, and write down version numbers. a simple reader and anyone who flashes the file with version numbers other than what you published is denied all warranty. That way tinkers can tinker but if they fuck up it is their own fault.
i thought once I was found, but it was only a dream.
Take a look at the Nexus platform for how this is to be handled elegantly with the fastboot oem unlock method. Why is this the best way for handling this I have seen?
1: It requires the user to at least install ADB software. This can be on Linux, OS X, or Windows. Installing this shows at least some competency of unzipping an archive and running a command.
2: The user is presented with a "one cannot simply walk into Mordor" dialog, stating that their warranty is about to go the way of the dinosaurs, and that unless they are deliberately ready to zap every single bit off their phone, to turn around before it is too late. The warning is obvious enough that even Joe Sixpack who is following the directions from a sleazy offshore website in order to download a "porn viewer" onto his Android device would realize that this might not be a good idea, especially losing all the stored info on the device.
3: Once past the dialog, the device erases itself, and the user can do whatever he or she wants with it. No DRM, no signed bootloaders. Just have fun.
Having not seen the technical details of this implementation issue before, I googled it, and found http://rdist.root.org/2010/11/19/dsa-requirements-for-random-k-value/. I don't design my own signature implementations (I just use openssl), but its conceivable that I might need to at some point, so I like to keep up on the technical details behind such cracks; in order to avoid making the same mistakes.
The publisher of the info is a known troll, hasn't ever released anything, and has already been trounced by people that know this stuff. False alarm.
Comes from china as a 'clone'....
---- Booth was a patriot ----
from droid-life.com: Oh Those DROID Bootloaders – Still Locked. Forever Locked. Trolls. (Updated) http://www.droid-life.com/2011/03/21/oh-those-droid-bootloaders-still-locked-forever-locked/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+DroidLife+(droid+life) "About that DROID bootloader unlocking story. Just read the conversation above and move on with your lives. It’s locked, will always be locked, and we’re glad we used a bunch of question marks and “coulds” in our post about it. And you guys call me the hypebeast? Update: Motorola reached out to us to clear up more of this situation. They said as plain as day, “We did not send the C&D letter to Mr. Pitcock [nenolod].” They also did not receive any notice of vulnerability which nenolod claims to have sent. This probably isn’t surprising since the guy admitted to it being one giant scam, but Moto wanted to make sure you all knew."