Slashdot Mirror
Ask Slashdot: Can I Trust Android Rooting Tools?
Qbertino writes After a long period of evaluation and weighing cons and pros I've gotten myself a brand new Android tablet (10" Lenovo Yoga 2, Android Version) destined to be my prime mobile computing device in the future. As any respectable freedom-loving geek/computer-expert I want to root it to be able to install API spoofing libraries and security tools to give me owners power over the machine and prevent services like Google and others spying on me, my files, photos, calendar and contacts. I also want to install an ad-blocking proxy (desperately needed — I forgot how much the normal web sucks!). I've searched for some rooting advice and tools, and so far have only stumbled on shady looking sites that offer various Windows-based rooting kits for android devices.
What's the gist on all this? How much of this stuff is potential malware? What are your experiences? Can I usually trust rooting strategies to be malware-free? Is there a rule-of-thumb for this? Is there perhaps a more generic way for a FOSS/Linux expert who isn't afraid of the CLI to root any Android 4.4 (Kitkat) device? Advice and own experiences, please.
What's the gist on all this? How much of this stuff is potential malware? What are your experiences? Can I usually trust rooting strategies to be malware-free? Is there a rule-of-thumb for this? Is there perhaps a more generic way for a FOSS/Linux expert who isn't afraid of the CLI to root any Android 4.4 (Kitkat) device? Advice and own experiences, please.
http://forum.xda-developers.co...
A bullet may have your name on it, but artillery is addressed to " Whom It May concern"
I have had Android devices from Cupcake onward and have always rooted them. That being said, I don't presume that rooting will work and I always presume that I may end up with a bricked device. A reminder that as soon as you start rooting, you have voided your warranty. I have also bricked devices. I learned how to make a jtag that way.
Your milage may vary.
I've been running rooted for about 4 years on various phones.
There are quite a lot of tools that you can run while rooted that are impossible otherwise.
This includes the ROMs themselves which don't usually come with the normal Google tools at all.
Then you can leverage tools like AppOps (integrated into many of the custom ROMs) to control granularly what info apps can get.
You can run things like AdAway, which basically block ads systemwide (including in apps).
The F-droid app repository has quite a lot of open-source software, and you can build a perfectly functional phone without Google apps.
As already mentioned, XDA-developers is a good place to start, even just to find info about your specific device, and guides for rooting, etc.
On balance, my opinion is that, if you do your diligence and set things up correctly, a rooted phone can absolutely be more secure than not.
As a small suggestion, if you decide to jump in, I highly recommend using ClockworkMod (Koush) superuser manager, because it's open-source and let's you set a pin for SU without paying for an upgrade.
On the PC, typically Odin is the only Windows executable involved with rooting an Android phone. Standard security best-practices should keep you "safe" here. Obtain Odin from trustworthy sites such as XDA. Use a bi-directional firewall package that tells you when your PC tries to make an outbound connection. Odin shouldn't.
On the phone, if you're just rooting, you're trusting the manufacturer of your phone, which isn't necessarily wise, but I see that's WHY you're rooting. So, you can get the XPosed Framework and XPrivacy, and set permissions for the various packages on your phone. Both are open-source.
If you don't actually read the code, then by definition you're trusting, period. So what's the issue?
"Oh no... he found the
Most root exploits I've seen have two components to them: the attack vector, and the payload.
The attack vector is usually a series of commands that have to be run to get the payload onto the device. This part is fully auditable and usually "open source" in the sense that you can perform these commands yourself. If someone sends you a .bat script with a bunch of adb commands, you can always open up the script and read it and make sure nothing is malicious in there.
The real problem is that 99% of the root exploits out there have to upload some kind of a binary file to the device, which is then executed. In MOST cases, the source code to this binary is not disclosed, perhaps to make it harder for the manufacturers to fix the exploit, or to keep their attack methods secret, in case the code might expose some more general pattern of attack that would enable the manufacturers to close a whole series of root exploits.
So basically you are trusting someone who compiled a Linux binary *whose job is to obtain escalated privileges on your device* to then not use those privileges to install some kind of tracking malware, data siphon, or cookie exfiltrating software, or even just a rootkit providing them a backdoor, which initially does nothing but can be activated at any time when the author feels they need something from your device (like participating in a botnet, perhaps?).
I'm a little surprised that the comments so far haven't really tackled the crux of your question, which was NOT "how do I find root exploits", but "are they trustworthy". Remember, folks, just because it's posted on XDA, doesn't mean it's trustworthy. Anyone can register an account on XDA; absolutely anyone.
I've read statements from root exploit authors who've said in plain language that they have no motivation to bundle malware in their root exploits and thus don't ever do so, but that's like the NSA saying they don't spy on Americans. We have no way of verifying the statement, and several reasons to suspect the contrary.
If you are in doubt, I would suggest that you forego root exploits altogether. Instead, you should simply refuse to buy any Android device where the manufacturer does not provide you a means to unlock the bootloader. Once you have a (legit) unlocked bootloader using official tools from the manufacturer, you can then proceed to install any ROM you want -- even an open source ROM that you could audit yourself -- which then gives you root access. Remember, on an Android device, root is far less powerful than an unlocked bootloader, so that's really what you should be aiming for anyway, to have a truly "open" device as an enthusiast.
1) Most of the important functionality (including the WebKit/Blink browser engine) are now embedded in Google Play Services, which you can't manage.
2) Total ownership of a device with a proprietary radio isn't realistic - even if you managed to install straight Linux on the thing (unlikely) the underlying firmware is in the bag.
3) Better to return that machine and go with a Yoga 2 Pro honestly. You'll have the ability to install Linux on it and have far greater control over your data.
4) A rooting tool is inherently untrustworthy as it exploits flaws in the target system. How can you truly know whether an oft-used method is trustworthy?
If you're not interested in the above, you don't really care about your data and shouldn't bother rooting it.
// -- http://www.BRAD-X.com/ --
Here's an idea. If you are uncomfortable with Google and such, eyeing them as a big brother of some sorts and do not want any Google Play Services or anything Google touching the device... you should return that tablet. Buy a Nexus 9, or a used Nexus 10 or Nexus 7 (2013). This may look counter intuitive, however Nexus devices have pretty much some of the strongest following and modding community behind them and since Google releases the full source for these devices, they are the first to get AOSP variant roms such as CyanogenMod, SlimROM, and Paranoid Android. Once you get them, you can easily follow guides on XDA Developers ( http://www.xda-developers.com/ ) to Unlock the bootloader (Via Google released ADB/Fastboot tools), install a custom recovery (I recommend TWRP which is open source as well so you know what you're getting). Then, depending on your level of paranoid, you can sync the AOSP tree from Google itself and build the entire ROM from scratch yourself, or build or download a flashable zip file of any custom ROM such as CyanogenMod, SlimROM, Paranoid Android etc, and then load it onto the device. AOSP based roms such as these DO NOT have Google's Proprietary API's and Google Play Services. Straight Android. Plus, will full open source, you know what's in it. You will still have to deal with the proprietary blobs left in for display, modem, wifi, etc, however it's as close to full control as you can get for Android with a 100% fully functional Android device.
Yep, if you have any qualms about doing stuff on Android, feel free to get a cheap Android tablet to experiment on, like the old $200 Nexus 7. Then you can feel free to fill that one with games and crapware and wipe and reload it regularly like a Windows gaming box. This lets you play without too much risk without compromising your primary Android device. If you use the same google Play account, you don't even have to buy your paid apps twice (though of course then you're exposing your google account that you use to pay for Google apps, but if you're like me, that's separate from your personal gmail account)
My primary Android device is my phone, and I just keep a bare minimum of essential apps on it so it runs fast and lean. After the Android 5 update, haven't even felt compelled to root it.
The XDA-Developers forum is full of tinkerers and developers themselves. They get a lot of traffic so proposed roots and mods will have quite a bit of feedback allowing you to judge the quality before you attempt to do something.
Additionally the XDA guys have a known history of calling out other people's shit. They are the ones who find questionable security practices, back to base datalogging and basically nearly everything negative or questionable you have heard about an Android manufacturer you'll have heard it on XDA first.
I wouldn't trust any shady site for any kind of root exploit, just links from the XDA-Developers forum.