4 ms·
Basically every device for which some kind of rooting tool exists is vulnerable. It is not too hard to leverage the same exploit used by rooting tools to circu
by ge0rg 15y ago
Basically every device for which some kind of rooting tool exists is vulnerable.
It is not too hard to leverage the same exploit used by rooting tools to circumvent the UID based sandbox and to access the data of other applications, including the phone book, security tokens / passwords stored in SharedPreferences etc.
- saurik 15y agoHowever, with a buggy kernel, you don't necessarily need native code to perform the exploit: you just need access to whatever part of the kernel that has the bug (which is often something innocuous). If there is a bug in the filesystem driver where attempting to open file descriptor to paths larger than 1024 bytes long will cause a buffer overflow, I can exploit that just as easily from Java as I could from C.
- huggyface 15y agoBasically every device for which some kind of rooting tool exists is vulnerable. Most if not all rooting tools work via the debug interface. One rather clever app -- if you have USB debugging turned on -- would essentially do a localhost debug connection to exploit this, but generally these are ADB exploits. This has nothing to do with native versus managed, and native provides no additional opportunity than managed. I replied to the original post because there is a pretty prolific belief that native=crazy dangerous. Yet of course the iPhone has entirely native apps, and we've had native sandboxing and rights restrictions since...what...the creation of UNIX?