7 ms·

So, 'jailed' is a reason to mark it as 'requires attention'? Well played, well played.. Honestly, I won't run a non-rooted device (although I admit that the cu

So, 'jailed' is a reason to mark it as 'requires attention'? Well played, well played.. Honestly, I won't run a non-rooted device (although I admit that the current way to root a device is questionable in parts). But here's a real, honest question: Why would services stop working because of root access? Why can't Android Pay work on a rooted device. Samsung's crappy equivalent (I use neither, but I think those are often considered examples for 'stops working if rooted' issues)? I also own my credit card. Just like my mobile. What is the danger that these services try to protect against, why is root a problem in these cases?

nl 10y ago
Rooting can allow software to elevate privileges enough so it can see outside its sandbox and access other software's private storage. That means (for example) spyware has one less thing stopping it form manipulating (eg) Android Pay to steal money.
thefifthsetpin 10y ago
Services like Android Pay quite reasonably elect to not work if the device appears like it may have been compromised. It's not easy to tell if a device is rooted because the user wanted root access or because a virus got in. But suppose you established that the user intentionally rooted the phone (somehow). It'd still not be clear whether the rootkit that the user used was trustworthy. Even if you established that it was trustworthy (stretching the bounds of reasonableness; who is auditing these?), you couldn't assume that the user hadn't run other malicious programs. That last point is true for non-rooted phones, of course, but since this user had root access those hypothesized malicious programs become much more dangerous. (Also, I doubt you own or have root access to your credit card. But what would you do with it if you did? All I can come up with is to consolidate a few of them onto one piece of plastic.)
- garaetjjte 10y ago
  It's easy: just ask the user.
  - lern_too_spel 10y ago
    As if the user knows if they've been rooted by a malicious third party.
- darklajid 10y ago
  Re: Credit card: I own one, I can hand it out. Most of the information necessary to use it (name, number, CSC) are available if you hold that card for a second. My (honest, I'm not trying to pull your leg or anything) question is: I have a phone. I own it. You (payment provider) cannot control it and I might do stupid things. I have a credit card. I own it. You (card issuer) cannot control it and I might do stupid things. Where's the difference? How can CCs work, but Android Pay/Samsung WhateverWhyWouldIUseIt doesn't, given my current impressions above. Can you correct my errors?
  - kodroid 10y ago
    It's a lot harder to attack at scale when targeting credit cards than an attack that targets mobile devices.
  - ac29 10y ago
    Credit cards don't have radios in them with 24/7 internet connections and software vulnerabilities. I think it is reasonable to assume, as mentioned elsewhere, that rooted devices are more prone to data-compromising attacks. And, due to security bugs, devices that are rooted may not have been rooted with the owners knowledge or permission.
  - senectus1 10y ago
    its actually against the banks ToS to give your credit card to anyone else... even at the register. but everyone ignores that :-P
  - notafurry 10y ago
    The difference is, you don't actually own your CC. You have physical possession yes, you can manage various aspects of it yes, you can even turn it off if you desire - but you don't own it. The bank does. The bank controls the card far more thoroughly than you do, including rights to create, replace, remotely destroy, cancel transactions, etc. You have the physical card and you can use it, but all of the permissions you have are rights granted to you by the true owner of the card - the bank.
kiallmacinnes 10y ago
As another reply to your post says, paraphrased, allowing applications to escalate privileges is absolutely less secure than not allowing applications to escalate privileges. This really has nothing to do with services not working because root is enabled, instead it has everything to do with companies (Netflix in this case, or Google for Android Pay in your example) preventing widespread theft of employee/customer data. Even the most cautious users can accidentally click "allow" by mistake. Here's a example of how that might happen: Build an app that some user wants - maybe a game. Make the user click a "Start" button to play. Time how long between presenting the button and receiving the click, after a few rounds of this, wait a fraction of a second less than the average time and trigger the sudo call which in turn usually triggers an allow/deny popup. Did it register with you in time, or did you click allow? Did you even notice it if the game starts anyway? Probably not! Netflix just gave an attacker an entry point, and Google just lost the confidence of their banking partners, who are likely looking for any excuse to avoid working with Google (and Apple etc) anyway. A good IT department has to protect the company from risks like this, and nothing the company requires you to do will require root (There are obviously exceptions, but the number of employees worldwide who fit this bill, outside of phone OS development, is likely less than a 5 or 6 figure number). If you need root for personal tasks, and the company isn't happy with root, then they are entirely within their right to deny that device access to company systems.
- darklajid 10y ago
  Listen, I'm with you. Root is special and granting root to ~stuff~ should be something you don't do on a whim. That said: I question that services should stop working if I have the ability to grant root. Reasons: 1) Maybe I know what I'm doing (honestly .. I consider myself capable and still have cringe while writing this) 2) Your software isn't immediately compromised in its core functionality if _I_ own my _own_ device. For Netflix, this feels like another failed attempt to close the analog hole. Android Pay and whatever else might try to be your wallet (I'm a huge fan, as you might notice in this thread) should be able to withstand that. Otherwise it's just a crappy payment system. I can pay stuff from my PC (various operating systems) and I do have root (or the equivalent permissions). I also own - as I stated in my original post - a CC that allows me to spend money freely. I don't know how hard it would be to copy it physically, but you'd be able to strip the core details (name, number, CSC) in a couple seconds/with two pictures. Why is the CC secure, but a rooted phone isn't. Ignore Netflix, they're brain-dead and content related DRM isn't what I'm going for. I'm asking why random legitimate services refuse to work on a phone, because .. the owner actually seems to own the device?
jaimex2 10y ago
It's the usual security theater. Custom roms do a good job of securing root access for apps, what I find hilarious is a sideloaded app can do a lot more damage yet Android Pay works if you have sideloading enabled... go figure. You can get Android Pay to work on a rooted device using systemless Xposed framework and root cloak, it basically just lies to the dumb checks.
- lern_too_spel 10y ago
  A side-loaded app cannot access another app's storage.
bsder 10y ago
> So, 'jailed' is a reason to mark it as 'requires attention'? Well played, well played.. Yeah, that's pretty dumb security theatre. If the device is rooted, it can fake your root checks. Just ask Blizzard. Better to figure out how to operate even when that happens.
- chipperyman573 10y ago
  >If the device is rooted, it can fake your root checks. Just ask Blizzard What happened with Blizzard and rooting?
  - bsder 10y ago
    Blizzard is continuously playing cat and mouse games to see if you are using bots or cheats for their games. Blizzard comes up with a bunch of anti-cheating checks and within days they all get defeated. It's a never-ending task.
rthille 10y ago
But if you have root, then why would any software you don't want to know you have root, know you have root? That is, if you control the device, have it lie about the control you have to things that care...
LeifCarrotson 10y ago
You don't own Netflix content. You pay for temporary access to it. If you could use root access to compromise the app and pirate their content, that could cost them licensing deals and lots of money. If you can't use root, that costs them little. You don't own your credit card either. The piece of plastic is actually owned by the bank. As they will likely be the ones that take a loss in the event of fraud from malware breaking into Android Pay, but similarly they gain nothing from letting you root your device, so their behavior makes sense.
37 10y ago
>So, 'jailed' is a reason to mark it as 'requires attention'? Well played, well played.. I must be reading the image wrong. Jailed has a green check mark beside it, and Up-to-date has a red negative sign. Presumably, this is why the device would require attention?
lumberingjack 10y ago
But you don't own your CC if you read the back it normally says "property of (whatever bank)"

nl 10y ago

Rooting can allow software to elevate privileges enough so it can see outside its sandbox and access other software's private storage. That means (for example) spyware has one less thing stopping it form manipulating (eg) Android Pay to steal money.

thefifthsetpin 10y ago

Services like Android Pay quite reasonably elect to not work if the device appears like it may have been compromised. It's not easy to tell if a device is rooted because the user wanted root access or because a virus got in. But suppose you established that the user intentionally rooted the phone (somehow). It'd still not be clear whether the rootkit that the user used was trustworthy. Even if you established that it was trustworthy (stretching the bounds of reasonableness; who is auditing these?), you couldn't assume that the user hadn't run other malicious programs. That last point is true for non-rooted phones, of course, but since this user had root access those hypothesized malicious programs become much more dangerous. (Also, I doubt you own or have root access to your credit card. But what would you do with it if you did? All I can come up with is to consolidate a few of them onto one piece of plastic.)

garaetjjte 10y ago
It's easy: just ask the user.
- lern_too_spel 10y ago
  As if the user knows if they've been rooted by a malicious third party.
darklajid 10y ago
Re: Credit card: I own one, I can hand it out. Most of the information necessary to use it (name, number, CSC) are available if you hold that card for a second. My (honest, I'm not trying to pull your leg or anything) question is: I have a phone. I own it. You (payment provider) cannot control it and I might do stupid things. I have a credit card. I own it. You (card issuer) cannot control it and I might do stupid things. Where's the difference? How can CCs work, but Android Pay/Samsung WhateverWhyWouldIUseIt doesn't, given my current impressions above. Can you correct my errors?
- kodroid 10y ago
  It's a lot harder to attack at scale when targeting credit cards than an attack that targets mobile devices.
- ac29 10y ago
  Credit cards don't have radios in them with 24/7 internet connections and software vulnerabilities. I think it is reasonable to assume, as mentioned elsewhere, that rooted devices are more prone to data-compromising attacks. And, due to security bugs, devices that are rooted may not have been rooted with the owners knowledge or permission.
- senectus1 10y ago
  its actually against the banks ToS to give your credit card to anyone else... even at the register. but everyone ignores that :-P
- notafurry 10y ago
  The difference is, you don't actually own your CC. You have physical possession yes, you can manage various aspects of it yes, you can even turn it off if you desire - but you don't own it. The bank does. The bank controls the card far more thoroughly than you do, including rights to create, replace, remotely destroy, cancel transactions, etc. You have the physical card and you can use it, but all of the permissions you have are rights granted to you by the true owner of the card - the bank.

kiallmacinnes 10y ago

As another reply to your post says, paraphrased, allowing applications to escalate privileges is absolutely less secure than not allowing applications to escalate privileges. This really has nothing to do with services not working because root is enabled, instead it has everything to do with companies (Netflix in this case, or Google for Android Pay in your example) preventing widespread theft of employee/customer data. Even the most cautious users can accidentally click "allow" by mistake. Here's a example of how that might happen: Build an app that some user wants - maybe a game. Make the user click a "Start" button to play. Time how long between presenting the button and receiving the click, after a few rounds of this, wait a fraction of a second less than the average time and trigger the sudo call which in turn usually triggers an allow/deny popup. Did it register with you in time, or did you click allow? Did you even notice it if the game starts anyway? Probably not! Netflix just gave an attacker an entry point, and Google just lost the confidence of their banking partners, who are likely looking for any excuse to avoid working with Google (and Apple etc) anyway. A good IT department has to protect the company from risks like this, and nothing the company requires you to do will require root (There are obviously exceptions, but the number of employees worldwide who fit this bill, outside of phone OS development, is likely less than a 5 or 6 figure number). If you need root for personal tasks, and the company isn't happy with root, then they are entirely within their right to deny that device access to company systems.

darklajid 10y ago
Listen, I'm with you. Root is special and granting root to ~stuff~ should be something you don't do on a whim. That said: I question that services should stop working if I have the ability to grant root. Reasons: 1) Maybe I know what I'm doing (honestly .. I consider myself capable and still have cringe while writing this) 2) Your software isn't immediately compromised in its core functionality if _I_ own my _own_ device. For Netflix, this feels like another failed attempt to close the analog hole. Android Pay and whatever else might try to be your wallet (I'm a huge fan, as you might notice in this thread) should be able to withstand that. Otherwise it's just a crappy payment system. I can pay stuff from my PC (various operating systems) and I do have root (or the equivalent permissions). I also own - as I stated in my original post - a CC that allows me to spend money freely. I don't know how hard it would be to copy it physically, but you'd be able to strip the core details (name, number, CSC) in a couple seconds/with two pictures. Why is the CC secure, but a rooted phone isn't. Ignore Netflix, they're brain-dead and content related DRM isn't what I'm going for. I'm asking why random legitimate services refuse to work on a phone, because .. the owner actually seems to own the device?

jaimex2 10y ago

It's the usual security theater. Custom roms do a good job of securing root access for apps, what I find hilarious is a sideloaded app can do a lot more damage yet Android Pay works if you have sideloading enabled... go figure. You can get Android Pay to work on a rooted device using systemless Xposed framework and root cloak, it basically just lies to the dumb checks.

lern_too_spel 10y ago
A side-loaded app cannot access another app's storage.

bsder 10y ago

> So, 'jailed' is a reason to mark it as 'requires attention'? Well played, well played.. Yeah, that's pretty dumb security theatre. If the device is rooted, it can fake your root checks. Just ask Blizzard. Better to figure out how to operate even when that happens.

chipperyman573 10y ago
>If the device is rooted, it can fake your root checks. Just ask Blizzard What happened with Blizzard and rooting?
- bsder 10y ago
  Blizzard is continuously playing cat and mouse games to see if you are using bots or cheats for their games. Blizzard comes up with a bunch of anti-cheating checks and within days they all get defeated. It's a never-ending task.

rthille 10y ago

But if you have root, then why would any software you don't want to know you have root, know you have root? That is, if you control the device, have it lie about the control you have to things that care...

LeifCarrotson 10y ago

You don't own Netflix content. You pay for temporary access to it. If you could use root access to compromise the app and pirate their content, that could cost them licensing deals and lots of money. If you can't use root, that costs them little. You don't own your credit card either. The piece of plastic is actually owned by the bank. As they will likely be the ones that take a loss in the event of fraud from malware breaking into Android Pay, but similarly they gain nothing from letting you root your device, so their behavior makes sense.

37 10y ago

>So, 'jailed' is a reason to mark it as 'requires attention'? Well played, well played.. I must be reading the image wrong. Jailed has a green check mark beside it, and Up-to-date has a red negative sign. Presumably, this is why the device would require attention?

lumberingjack 10y ago

But you don't own your CC if you read the back it normally says "property of (whatever bank)"