4 ms·

I value your insights a lot. But who the hell relocks the bootloader after flashing a new ROM? I've never met anyone doing that, and I'm surrounded by Android

I value your insights a lot. But who the hell relocks the bootloader after flashing a new ROM? I've never met anyone doing that, and I'm surrounded by Android fanboys (myself included, at times). For all I know, everyone that unlocked the bootloader once will keep it that way. That's still a limited group of people, of course. But you seem to have a very different estimation on the number of devices that might be affected. Can you help me see where I'm wrong or provide some more details about your rationale?

moxie 14y ago
Totally, but remember that this is about recovering FDE keys. I'm sure that there are plenty of people who leave their bootloaders unlocked, but they're probably also not encrypting their device, so they're out of luck in the case of a physical compromise anyway (and they're probably also running apps as root, so they're out of luck even when it's not a physical compromise). I don't know of any way to measure this, but my anecdotal experience is that those who encrypt their devices also lock their bootloaders. Maybe I'm wrong, in which case the lesson is: if you're bothering with FDE, lock your bootloader.
- ce4 14y ago
  A locked bootloader is just another hurdle which those guys didn't opt to attack, but might not stop others. It's been shown that it is possible to bypass locked bootloaders: -> Shortcut specific pcb pins to force USB booting on Exynos devices (c.f. unbrickable mod and similar, http://www.xda-developers.com/android/explaining-and-advancing-the-unbrickable-mod/ http://www.xda-developers.com/android/explaining-and-advanci...)
  - moxie 14y ago
    Or for that matter, just remove the internal MMC and stick it in a reader (most Android devices don't use MTD anymore). This was what was so shocking about the case with the FBI and the pimp, since that device wasn't even encrypted: http://arstechnica.com/tech-policy/2012/03/fbi-stumped-by-pimps-androids-pattern-lock-serves-warrant-on-google/ http://arstechnica.com/tech-policy/2012/03/fbi-stumped-by-pi...

moxie 14y ago

Totally, but remember that this is about recovering FDE keys. I'm sure that there are plenty of people who leave their bootloaders unlocked, but they're probably also not encrypting their device, so they're out of luck in the case of a physical compromise anyway (and they're probably also running apps as root, so they're out of luck even when it's not a physical compromise). I don't know of any way to measure this, but my anecdotal experience is that those who encrypt their devices also lock their bootloaders. Maybe I'm wrong, in which case the lesson is: if you're bothering with FDE, lock your bootloader.

ce4 14y ago
A locked bootloader is just another hurdle which those guys didn't opt to attack, but might not stop others. It's been shown that it is possible to bypass locked bootloaders: -> Shortcut specific pcb pins to force USB booting on Exynos devices (c.f. unbrickable mod and similar, http://www.xda-developers.com/android/explaining-and-advancing-the-unbrickable-mod/ http://www.xda-developers.com/android/explaining-and-advanci...)
- moxie 14y ago
  Or for that matter, just remove the internal MMC and stick it in a reader (most Android devices don't use MTD anymore). This was what was so shocking about the case with the FBI and the pimp, since that device wasn't even encrypted: http://arstechnica.com/tech-policy/2012/03/fbi-stumped-by-pimps-androids-pattern-lock-serves-warrant-on-google/ http://arstechnica.com/tech-policy/2012/03/fbi-stumped-by-pi...