5 ms·

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture https://github.com/gojue/ecapture

post_break 3y ago
How many normal phones can you root these days?
- modeless 3y ago
  Every Pixel phone purchased from the Google store
  - downWidOutaFite 3y ago
    After wiping all data and losing access to a bunch of features and apps.
    - AshamedCaptain 3y ago
      Including everything I could possibly ever want an Android device for, like my bank's 2FA program. It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)
      - hackermatic 3y ago
        Yup. When I updated my company's secure development requirements, and compared them to others, I was confronted with a lot of choices that would increase security somewhat, but at the expense of user control of their own devices, like refusing to function if the device was jailbroken, or requiring the use of the system keyboard only (which is also an accessibility problem). These are tempting choices, but they go a lot further than, for example, requiring only modern TLS ciphersuites to be used to communicate with my servers. They dictate the state of your entire device, and no one app or company should have that power, unless you work for the company and they issue you the device -- but even then, modern MDM/MAM can and should sandbox company apps from the rest of the device.
        a_t48 3y ago
        When I worked on iOS games, I ended up having to ban all jailbroken devices. I didn’t like doing it, but basically - every cheater we found was using a jailbroken phone, the number of non cheaters with jailbroken phones was tiny, and it would have basically taken up all my time to deal with cheaters rather than implement fun features. I’d have just ignored them if it wasn’t for the fact that they made the leaderboards look really fake.
        _silicon 3y ago
        “I didn’t like doing it” doesn’t make this any better. It’s just hammering another nail in the coffin of device ownership.
        a_t48 3y ago
        Please, our mediocre AA gatcha game did nothing to you nor the overall jailbreaking ecosystem. Don’t you think that’s being a bit dramatic?
        TheHappyOddish 3y ago
        They definitely overdramatised the wording, but their point is valid - the 'normalisation by a thousand cuts' is a real phenomenom, and a bad one.
        a_t48 3y ago
        I'll agree with that, but on my side I wasn't faced with a whole lot of options either.
      - _ea1k 3y ago
        As much as I want to agree with you, I can't blame Google here. Corporate security departments have bought into the idea that mobile is different and you can't trust the user with root. Google has little choice but to provide them with the tools to detect root access.
        ori_b 3y ago
        Why? If Google didn't implement it, what would they do?
        _ea1k 3y ago
        Not allow their cards in Google Wallet, and or only support web access to their functions. Some of the entities that want it do have pull.
      - BlueTemplar 3y ago
        Exactly, you shouldn't waste your time with Android any more than with iOS at this point (same for banks that only provide 2FA on iOS/Android). And while for years the alternatives have been almost nonexistent, we do have at least two now : PinePhone and Librem 5.
    - mintplant 3y ago
      Magisk [0] + safetynet-fix [1] can work around that. [0] https://github.com/topjohnwu/Magisk https://github.com/topjohnwu/Magisk [1] https://github.com/Displax/safetynet-fix https://github.com/Displax/safetynet-fix
      - Dylan16807 3y ago
        It's quite doubtful it will keep working.
        curiousgal 3y ago
        Well people keep saying this for years now. When it stops working we'll make statements like "root breaks access to Netflix and Banking apps". But since it doesn't at the moment, everything is good.
        Dylan16807 3y ago
        But it does break them. That's what happens when you enable root, they break. You have to use pretty shaky workarounds to trick them, and there is a known way to make those workarounds impossible.
      - Novosell 3y ago
        As far as I've understood, the safetynet fix makes use of a feature which only exists for comparability reasons, so that old devices don't get locked out entirely. When there aren't enough old devices around anymore, it will likely stop working.
    - deleted 3y ago
      [deleted]
    - garciansmith 3y ago
      You do have to unlock the bootloader to root a device, hence wiping the data, but that doesn't matter if it's the first thing you do when you get the phone. Features though? Maybe I don't realize all the great things I'm missing out on since I've only ever used rooted phones since I got my first Android device many years ago. As for apps, I've only heard of certain games (I don't play games on my phone) and banking apps (thankfully mine doesn't care, though I'd rather use a desktop web interface for financial stuff).
      - Dylan16807 3y ago
        Netflix is a big one.
- orangepurple 3y ago
  Anything that LineageOS supports https://wiki.lineageos.org/devices/ https://wiki.lineageos.org/devices/
kelnos 3y ago
"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me. Yes, of course, you can do this, but let's not pretend there aren't trade offs.
- jeroenhd 3y ago
  In the context of "changes to Android 14", "just" is right. Android has required root access for modifying random apps since before Android 6, and that's only because many apps didn't bother implementing certificate pinning (which was already known advice at that point). Alternatively, you can use ADB + Frida to pull an APK from the device, inject a binary, and inject code at runtime using Javascript or Python. That's much easier for intercepting traffic than messing with certificate stores or eBPF ever was in my opinion.
  - ungamedplayer 3y ago
    Do you have any kind of docs on doing this. I want to get some stats from a game I'm playing and think that the server fudges the number to keep whales happy. Any quality documentation on how to do this would be great.
    - jeroenhd 3y ago
      https://httptoolkit.com/blog/frida-certificate-pinning/ https://httptoolkit.com/blog/frida-certificate-pinning/ has a detailed blog on it. Frida receives updates all the time, so the exact commands and scripts don't always work with the latest version, but you can start there. As a concept, Frida works by running a gadget on the phone (as root, or as part of an app) and a client on another device (or the same device, I suppose, if you're using a terminal emulator on Android). To install the gadget, you either download the right binary and execute it on the phone as root, or use a tool like https://github.com/ksg97031/frida-gadget https://github.com/ksg97031/frida-gadget to inject the gadget into an APK. Then, use Frida (https://frida.re/docs/Android https://frida.re/docs/Android) to connect to the gadget and load any script you want. There are a bunch of scripts that can be used to patch out certificate validation, or to exclusively use a certificate authority of your choice, or you can write your own. You can download scripts and run them directly, or you can run Frida with a command line flag to open up a remote debugging port; you can connect to that port from the Chrome dev tools and get an interactive code execution prompt. From there, you can patch out Java methods, load native binaries, patch memory, whatever you want. It's a really powerful tool for debugging and reversing applications you don't have the source for.
RockRobotRock 3y ago
Very cool. Does this work better than a Frida hook for capturing encrypted HTTP calls while bypassing cert pinning?
1vuio0pswjnm7 3y ago
https://github.com/gojue/ecapture/releases/expanded_assets/v0.6.1 https://github.com/gojue/ecapture/releases/expanded_assets/v... Anyone know why there is an aarch64 nocore but not an x86_64 nocore.

post_break 3y ago

How many normal phones can you root these days?

modeless 3y ago
Every Pixel phone purchased from the Google store
- downWidOutaFite 3y ago
  After wiping all data and losing access to a bunch of features and apps.
  - AshamedCaptain 3y ago
    Including everything I could possibly ever want an Android device for, like my bank's 2FA program. It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)
    - hackermatic 3y ago
      Yup. When I updated my company's secure development requirements, and compared them to others, I was confronted with a lot of choices that would increase security somewhat, but at the expense of user control of their own devices, like refusing to function if the device was jailbroken, or requiring the use of the system keyboard only (which is also an accessibility problem). These are tempting choices, but they go a lot further than, for example, requiring only modern TLS ciphersuites to be used to communicate with my servers. They dictate the state of your entire device, and no one app or company should have that power, unless you work for the company and they issue you the device -- but even then, modern MDM/MAM can and should sandbox company apps from the rest of the device.
      - a_t48 3y ago
        When I worked on iOS games, I ended up having to ban all jailbroken devices. I didn’t like doing it, but basically - every cheater we found was using a jailbroken phone, the number of non cheaters with jailbroken phones was tiny, and it would have basically taken up all my time to deal with cheaters rather than implement fun features. I’d have just ignored them if it wasn’t for the fact that they made the leaderboards look really fake.
        _silicon 3y ago
        “I didn’t like doing it” doesn’t make this any better. It’s just hammering another nail in the coffin of device ownership.
        a_t48 3y ago
        Please, our mediocre AA gatcha game did nothing to you nor the overall jailbreaking ecosystem. Don’t you think that’s being a bit dramatic?
        TheHappyOddish 3y ago
        They definitely overdramatised the wording, but their point is valid - the 'normalisation by a thousand cuts' is a real phenomenom, and a bad one.
        a_t48 3y ago
        I'll agree with that, but on my side I wasn't faced with a whole lot of options either.
    - _ea1k 3y ago
      As much as I want to agree with you, I can't blame Google here. Corporate security departments have bought into the idea that mobile is different and you can't trust the user with root. Google has little choice but to provide them with the tools to detect root access.
      - ori_b 3y ago
        Why? If Google didn't implement it, what would they do?
        _ea1k 3y ago
        Not allow their cards in Google Wallet, and or only support web access to their functions. Some of the entities that want it do have pull.
    - BlueTemplar 3y ago
      Exactly, you shouldn't waste your time with Android any more than with iOS at this point (same for banks that only provide 2FA on iOS/Android). And while for years the alternatives have been almost nonexistent, we do have at least two now : PinePhone and Librem 5.
  - mintplant 3y ago
    Magisk [0] + safetynet-fix [1] can work around that. [0] https://github.com/topjohnwu/Magisk https://github.com/topjohnwu/Magisk [1] https://github.com/Displax/safetynet-fix https://github.com/Displax/safetynet-fix
    - Dylan16807 3y ago
      It's quite doubtful it will keep working.
      - curiousgal 3y ago
        Well people keep saying this for years now. When it stops working we'll make statements like "root breaks access to Netflix and Banking apps". But since it doesn't at the moment, everything is good.
        Dylan16807 3y ago
        But it does break them. That's what happens when you enable root, they break. You have to use pretty shaky workarounds to trick them, and there is a known way to make those workarounds impossible.
    - Novosell 3y ago
      As far as I've understood, the safetynet fix makes use of a feature which only exists for comparability reasons, so that old devices don't get locked out entirely. When there aren't enough old devices around anymore, it will likely stop working.
  - deleted 3y ago
    [deleted]
  - garciansmith 3y ago
    You do have to unlock the bootloader to root a device, hence wiping the data, but that doesn't matter if it's the first thing you do when you get the phone. Features though? Maybe I don't realize all the great things I'm missing out on since I've only ever used rooted phones since I got my first Android device many years ago. As for apps, I've only heard of certain games (I don't play games on my phone) and banking apps (thankfully mine doesn't care, though I'd rather use a desktop web interface for financial stuff).
    - Dylan16807 3y ago
      Netflix is a big one.
orangepurple 3y ago
Anything that LineageOS supports https://wiki.lineageos.org/devices/ https://wiki.lineageos.org/devices/

kelnos 3y ago

"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me. Yes, of course, you can do this, but let's not pretend there aren't trade offs.

jeroenhd 3y ago
In the context of "changes to Android 14", "just" is right. Android has required root access for modifying random apps since before Android 6, and that's only because many apps didn't bother implementing certificate pinning (which was already known advice at that point). Alternatively, you can use ADB + Frida to pull an APK from the device, inject a binary, and inject code at runtime using Javascript or Python. That's much easier for intercepting traffic than messing with certificate stores or eBPF ever was in my opinion.
- ungamedplayer 3y ago
  Do you have any kind of docs on doing this. I want to get some stats from a game I'm playing and think that the server fudges the number to keep whales happy. Any quality documentation on how to do this would be great.
  - jeroenhd 3y ago
    https://httptoolkit.com/blog/frida-certificate-pinning/ https://httptoolkit.com/blog/frida-certificate-pinning/ has a detailed blog on it. Frida receives updates all the time, so the exact commands and scripts don't always work with the latest version, but you can start there. As a concept, Frida works by running a gadget on the phone (as root, or as part of an app) and a client on another device (or the same device, I suppose, if you're using a terminal emulator on Android). To install the gadget, you either download the right binary and execute it on the phone as root, or use a tool like https://github.com/ksg97031/frida-gadget https://github.com/ksg97031/frida-gadget to inject the gadget into an APK. Then, use Frida (https://frida.re/docs/Android https://frida.re/docs/Android) to connect to the gadget and load any script you want. There are a bunch of scripts that can be used to patch out certificate validation, or to exclusively use a certificate authority of your choice, or you can write your own. You can download scripts and run them directly, or you can run Frida with a command line flag to open up a remote debugging port; you can connect to that port from the Chrome dev tools and get an interactive code execution prompt. From there, you can patch out Java methods, load native binaries, patch memory, whatever you want. It's a really powerful tool for debugging and reversing applications you don't have the source for.

RockRobotRock 3y ago

Very cool. Does this work better than a Frida hook for capturing encrypted HTTP calls while bypassing cert pinning?

1vuio0pswjnm7 3y ago

https://github.com/gojue/ecapture/releases/expanded_assets/v0.6.1 https://github.com/gojue/ecapture/releases/expanded_assets/v... Anyone know why there is an aarch64 nocore but not an x86_64 nocore.