Slashdot Mirror
Researcher Unlocks Galaxy S4 Bootloader For AT&T, Verizon Phones
Trailrunner7 writes "Those of you who like to tinker and jailbreak Android phones should take notice of some new research conducted on Samsung Galaxy S4 Android devices shipped by AT&T and Verizon. Both devicemakers ship the Galaxy S4 smartphones with a locked-down bootloader that prevents users from uploading custom kernels or from making modifications to software on the phone. Azimuth Security researcher Dan Rosenberg has found a vulnerability in the manner in which the devices do cryptographic checks of boot image signatures and was able to exploit the flaw and upload his own unsigned kernel to the device."
Your comment makes no sense in relation to the article. The article is not about what unlocking is.
Unfortunately this is not a bootloader unlock, it allows you to load unsigned kernels and recovery images but the bootloader must be exploited each time you install a new image. Further it's easily fixed and the next OTA from at&t/vzw is expected to patch it.
It is the same device maker.
The real news to me is that the Galaxy S4 is not already easily unlocked. I would have assumed that with the S3 being easily unlocked that the S4 would be similar.
I would think the best strategy for the phone companies and the handset makers would be to make it just difficult enough that most people wouldn't bother, but easy enough that people who really care wouldn't avoid the phones.
Samsung is the device maker.
When the phone powers up, there is usually a watchdog circuit that holds a pin low (ground) for a short time, usually 50-100ms, then it allows the pin to rise, and that pin then allows firmware to be loaded which starts the bootloader process (or is the bootloader process). Usually you can short that pin, and after the amount of time required to load the OS, the firmware can be updated (reflash the chip with new bootloader/os). I realise finding the pin and reflashing the chip can be a bit of a job, but its not impossible (I've used techniques like this to unbrick/reflash bootloaders in routers and other devices, and likewise upload new firmware).
The summary seems wrong, the researcher did not exploit a cryptography weakness. I understand he managed to have its custom kernel loaded at specific memory address, overwriting a bootloader function.
My S4 clone may not be quite as fancy as a samsung, but it's damned close and its *mine* out of the box. No carrier lock, no bootloader lock.. Nothin. Oh and it was 1/3 the price.. ( not out of pocket for a subsidy extension, but actual cost of the phone )
Why would I buy a brain damaged piece of crap? Also I'm not likely to buy Samsung again due to their abandoning the Galaxy S which I'm still using.
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
Why do articles like this say attacker. I guess if i own a S4 i would be the "attacker". At no point in the article did I read that if I clicked on a link i would be attacked. I think people that use the word "attacker" should be beaten till there bloody. There is no "attacker" cause it would be me doing the work, yet current user agreements they have i guess i would be the "attacker"...? Last time I rooted my phone or change something I didn't 'ATTACK" my phone neither did any one else "attack" my phone. I think or I hope i did it my self.
I find this sentence from the article interesting:
"I flash this image by leveraging root access in the Android operating system to write to the boot block device"
Isn't it usually rooting you want to achieve when you unlock the bootloader?
Or is there already a root exploit available, and this will allow you to not only root a stock image, but instead load custom images?
As a non-American, I find it quite fascinating that telcos in America can get away with 'exclusive' phones. Exclusive to AT&T! Exclusive to T Mobile! Exclusive to Verizon!
And within each cocoon of exclusivity, each telco adds unwanted stuff on top of the software to 'differentiate' themselves from their competing rivals.
Time for the American telco industry to grow up and the regulators to step in. If a phone launches in America, all the carriers get it. No exclusive bootloaders
Shouldn't they have been published?
Oh, My Fucking God!
Will you absolute morons stop calling these people "researchers"? You sound like Nancy Pelosi talking about "Revenue enhancements" instead of taxes or Obama talking "extremism" instead or terrorism.
We all know what you do and why you do it. And it's not for the benefit of mankind.
So if I buy a brand new unlocked S4 from Amazon. Can I put my verizon sim in it and will it work the same as if I bought it from verizon but still be able to use it with metro pcs or t mobile simms?
so a new phone came out and someone unlocked it?
No.
The phone is only locked if you bought it directly from AT&T or Verizon.