4 ms·

> has apps that can’t be updated or deleted [edit] sell them rooted [original] Root it. Unless it's something like Triada[^1], in which case, it's f'd. Aroun

by pmlnr 7y ago

> has apps that can’t be updated or deleted [edit] sell them rooted [original] Root it. Unless it's something like Triada[^1], in which case, it's f'd. Around ~2001, everyone at high school knew how to reinstall windows and find cracks for games. Maybe it's time to be at least that "tech savvy" again with smartphones. [^1]: https://forums.malwarebytes.com/topic/200072-trojantriada https://forums.malwarebytes.com/topic/200072-trojantriada

milankragujevic 7y ago
Unfortunately, a majority of new Unisoc (Spreadtrum) chips have bootloaders that cannot be unlocked without a key, which is not provided by the SOC manufacturer, and is beyond the control of the ODM. Many low-end Android smartphones are powered by such chips, and the end result is that root is impossible on those devices, i.e. ZTE Blade A5 2019, Doogee N10, etc. (Unisoc SC9863A) edit: I have obtained the source code of the U-boot bootloader used on those devices, however, the algorithm for the key verification is stored on the Trusted Execution Environment, which means it cannot be extracted (the TEE is a SecureEnclave-like device, with no possible direct access to it's memory or storage, besides de-capping it and reading the bits with an electron microscope) -- more info here: https://source.android.com/security/trusty https://source.android.com/security/trusty
- pmlnr 7y ago
  I wasn't aware of this, for some reason I thought most of the low-ends are mediatek, and unlocking android 6 mediateks was not a hard feat. EDIT I don't think Doogee N10 falls into low end, at least not by specs. Compare it with Moto C, which is indeed low end.
  - milankragujevic 7y ago
    Oh, Mediatek is so-"friendly" to unlocking, with no verified boot and the ability to flash it with the infamous SP Flash Tool. SC9863A and many other SOCs are flashable with Spreadtrum's ResearchDownload Tool. However, Spreadtrum actually does verify the whole boot process, meaning that booting a modified binary is impossible. If you change the boot partition, it will infinitely reboot with a black screen and vibration. If you leave the boot as-is, but change system, it will get to the splash screen and then reboot. etc. It genuinely does cryptographicaly verify the signature and hash of every partition. Which is great for security, in theory, unless the OS has preloaded spyware, but the secureboot process prevents you from removing it. re-edit: Doogee N10 costs 85$. I don't think you can go much lower-end, without basically giving the manufacturer a huge profit margin (i.e. a phone that costs $60, but has 512 MB RAM, has a bigger profit margin than a phone that costs 85$ but has 3 GB RAM.)
    - pmlnr 7y ago
      > SC9863A and many other SOCs are flashable with Spreadtrum's ResearchDownload Tool. However, Spreadtrum actually does verify the whole boot process, meaning that booting a modified binary is impossible. If you change the boot partition, it will infinitely reboot with a black screen and vibration. If you leave the boot as-is, but change system, it will get to the splash screen and then reboot. etc. Been there, and I didn't even realised the cause. I'm sorry if my previous comment seemed light hearted, I didn't want it to be so.
      - milankragujevic 7y ago
        I understand fully. I just want to shine light on the problems of consumers loosing control of their devices that they own and paid for. I would understand that a work-provided device has such protections, and spyware, because it's provided for a single purpose, usually under contract. A device that you buy with your own money cannot "hand-wave" the contract (TOS, EULA, Policies, etc), and say it's OK that you don't own your device or your data.
    - userbinator 7y ago
      I chose MTK because of it being open-by-default and all the leaked datasheets/programming guides/source code available. You can really run whatever you want on those devices, with enough effort. It's somewhat surprising that the other low-end SoCs are locked by default... I wonder if the key is the same for all of them, and just hasn't been leaked yet.
      - milankragujevic 7y ago
        MTK is quite good, but it's becoming worse in the perf/$ ratio, i.e. the SC9863A is a octa core A55 chip at 1.5GHz, while similar MTK devices are dual core A7 at 1.2 GHz. The architecture improvements alone are excellent, not mentioning the extra cores and higher clock speed. The key is most certainly not the same, because I doubt they would go through the trouble of doing actual secure boot verification, and storing the data in the TEE, and just have the same key. Additionally, the U-boot code I obtained lies to the user about commands not being found, if the command doesn't contain a valid unlock key.
phil9987 7y ago
I think we can't assume that these people have access to a computer, which is necessary to be able to root it. In the article the author refers to "smartphone only users" who can barely afford a 17$ smartphone. Even if there was a service available in their region which offers rooting Android devices, a lot of people might not afford to do so.
- pmlnr 7y ago
  Same people who sell it could root it. In the UK, removing carrier lock is legal, and nearly all mobile corners stores can do it.
  - SmellyGeekBoy 7y ago
    To be fair, I don't think most contract phones sold in the UK even have the carrier lock enabled in the first place.
newnewpdro 7y ago
That was before general purpose computers were largely displaced by just another consumer electronics gadget everyone calls the smartphone. You were actually intended to be able to install an operating system and programs of your liking on PCs.
Jonnax 7y ago
Yeah. People know how to download a random file off the internet and execute it. That's not being smart. Malware is more sophisticated today. A lot of "tech savvy" people download random ROMs off XDA developers and then enter their bank details into apps. Also rooting is breaking the security model of the device which is also a dumb thing to do.
- deogeo 7y ago
  > Also rooting is breaking the security model of the device which is also a dumb thing to do. More often than not, that's security against the user, not for.
  - Jonnax 7y ago
    Sure sure. But if you were handed either a Samsung note or a Windows laptop that belonged to someone else. Where you wanted to quickly sign into your bank account. What would you feel more comfortable to use? Arguments of user freedom also includes malware freedom. And for the average user who just wants to consume, that's a decent tradeoff.
    - deogeo 7y ago
      That's why there's tamper-evidence - my phone displays a message stating it's rooted on boot. Getting the best of both security and user-freedom has already been done, but manufacturers prefer to lie that the choice is exclusive - that we can have security or freedom, but not both. And as the article clearly shows, they delivered neither.
    - admax88q 7y ago
      I really wish we'd optimize for me owning my device rather than me entering my bank details on someone else's device. One of these use cases is a lot more important than the other.

by pmlnr 7y ago

milankragujevic 7y ago

Unfortunately, a majority of new Unisoc (Spreadtrum) chips have bootloaders that cannot be unlocked without a key, which is not provided by the SOC manufacturer, and is beyond the control of the ODM. Many low-end Android smartphones are powered by such chips, and the end result is that root is impossible on those devices, i.e. ZTE Blade A5 2019, Doogee N10, etc. (Unisoc SC9863A) edit: I have obtained the source code of the U-boot bootloader used on those devices, however, the algorithm for the key verification is stored on the Trusted Execution Environment, which means it cannot be extracted (the TEE is a SecureEnclave-like device, with no possible direct access to it's memory or storage, besides de-capping it and reading the bits with an electron microscope) -- more info here: https://source.android.com/security/trusty https://source.android.com/security/trusty

pmlnr 7y ago
I wasn't aware of this, for some reason I thought most of the low-ends are mediatek, and unlocking android 6 mediateks was not a hard feat. EDIT I don't think Doogee N10 falls into low end, at least not by specs. Compare it with Moto C, which is indeed low end.
- milankragujevic 7y ago
  Oh, Mediatek is so-"friendly" to unlocking, with no verified boot and the ability to flash it with the infamous SP Flash Tool. SC9863A and many other SOCs are flashable with Spreadtrum's ResearchDownload Tool. However, Spreadtrum actually does verify the whole boot process, meaning that booting a modified binary is impossible. If you change the boot partition, it will infinitely reboot with a black screen and vibration. If you leave the boot as-is, but change system, it will get to the splash screen and then reboot. etc. It genuinely does cryptographicaly verify the signature and hash of every partition. Which is great for security, in theory, unless the OS has preloaded spyware, but the secureboot process prevents you from removing it. re-edit: Doogee N10 costs 85$. I don't think you can go much lower-end, without basically giving the manufacturer a huge profit margin (i.e. a phone that costs $60, but has 512 MB RAM, has a bigger profit margin than a phone that costs 85$ but has 3 GB RAM.)
  - pmlnr 7y ago
    > SC9863A and many other SOCs are flashable with Spreadtrum's ResearchDownload Tool. However, Spreadtrum actually does verify the whole boot process, meaning that booting a modified binary is impossible. If you change the boot partition, it will infinitely reboot with a black screen and vibration. If you leave the boot as-is, but change system, it will get to the splash screen and then reboot. etc. Been there, and I didn't even realised the cause. I'm sorry if my previous comment seemed light hearted, I didn't want it to be so.
    - milankragujevic 7y ago
      I understand fully. I just want to shine light on the problems of consumers loosing control of their devices that they own and paid for. I would understand that a work-provided device has such protections, and spyware, because it's provided for a single purpose, usually under contract. A device that you buy with your own money cannot "hand-wave" the contract (TOS, EULA, Policies, etc), and say it's OK that you don't own your device or your data.
  - userbinator 7y ago
    I chose MTK because of it being open-by-default and all the leaked datasheets/programming guides/source code available. You can really run whatever you want on those devices, with enough effort. It's somewhat surprising that the other low-end SoCs are locked by default... I wonder if the key is the same for all of them, and just hasn't been leaked yet.
    - milankragujevic 7y ago
      MTK is quite good, but it's becoming worse in the perf/$ ratio, i.e. the SC9863A is a octa core A55 chip at 1.5GHz, while similar MTK devices are dual core A7 at 1.2 GHz. The architecture improvements alone are excellent, not mentioning the extra cores and higher clock speed. The key is most certainly not the same, because I doubt they would go through the trouble of doing actual secure boot verification, and storing the data in the TEE, and just have the same key. Additionally, the U-boot code I obtained lies to the user about commands not being found, if the command doesn't contain a valid unlock key.

phil9987 7y ago

I think we can't assume that these people have access to a computer, which is necessary to be able to root it. In the article the author refers to "smartphone only users" who can barely afford a 17$ smartphone. Even if there was a service available in their region which offers rooting Android devices, a lot of people might not afford to do so.

pmlnr 7y ago
Same people who sell it could root it. In the UK, removing carrier lock is legal, and nearly all mobile corners stores can do it.
- SmellyGeekBoy 7y ago
  To be fair, I don't think most contract phones sold in the UK even have the carrier lock enabled in the first place.

newnewpdro 7y ago

That was before general purpose computers were largely displaced by just another consumer electronics gadget everyone calls the smartphone. You were actually intended to be able to install an operating system and programs of your liking on PCs.

Jonnax 7y ago

Yeah. People know how to download a random file off the internet and execute it. That's not being smart. Malware is more sophisticated today. A lot of "tech savvy" people download random ROMs off XDA developers and then enter their bank details into apps. Also rooting is breaking the security model of the device which is also a dumb thing to do.

deogeo 7y ago
> Also rooting is breaking the security model of the device which is also a dumb thing to do. More often than not, that's security against the user, not for.
- Jonnax 7y ago
  Sure sure. But if you were handed either a Samsung note or a Windows laptop that belonged to someone else. Where you wanted to quickly sign into your bank account. What would you feel more comfortable to use? Arguments of user freedom also includes malware freedom. And for the average user who just wants to consume, that's a decent tradeoff.
  - deogeo 7y ago
    That's why there's tamper-evidence - my phone displays a message stating it's rooted on boot. Getting the best of both security and user-freedom has already been done, but manufacturers prefer to lie that the choice is exclusive - that we can have security or freedom, but not both. And as the article clearly shows, they delivered neither.
  - admax88q 7y ago
    I really wish we'd optimize for me owning my device rather than me entering my bank details on someone else's device. One of these use cases is a lot more important than the other.