5 ms·

> I imagine that internally for Barclays it's a big move and a sensitive one. A security breach in the early stages would be catastrophic... > A rooted phone i

by Drakim 12y ago

> I imagine that internally for Barclays it's a big move and a sensitive one. A security breach in the early stages would be catastrophic... > A rooted phone is not a stable environment for Barclays to run their software - it could have been changed in any number of ways This means it could be less stable, but I don't see how it would affect the possibility of a "security breach". You are talking about two different kind of issues as if they are related. Could you clarify?

onion2k 12y ago
By definition a rooted phone is compromised - a user has obtained root level privileged access. That's what 'rooted' means. The assumption is that it's the phone owner's actions that caused that to happen, but that's not necessarily the case. A third party could have rooted it. A local app exploit could have rooted it. Some clever malware that hasn't even been written yet that somehow escaped Android's security sandbox could have done it. Ordinarily no one would care if a phone has been rooted or not. It's not important. But the point here is that allowing an app that has access to your bank account to run on a rooted device is assuming that the device was intentionally rooted by it's owner. For a bank that should be assuming far too much.
- viraptor 12y ago
  Actually they can only check for actual user-exposed way of rooting the phone. If there's a way some local app can do it, it doesn't have to expose this functionality - it can do whatever it wants to with it's elevated privileges and not leave a trace behind. Local app exploit that messes with the bank app only will not be detectable by the bank app.
- icebraining 12y ago
  There's no reason for a clever malware to root your phone. "Rooting" only makes sense if you want to replace 'su' to grant root to different apps. If a malware escalates to root, it can just do whatever it wants, it doesn't have to "root". Besides, even if the malware really needed to "root" the device, it could just use the same process has RootCloak[1] to hide that fact. There's no valid security explanation; the app must designed assuming it's running on an insecure system, because there's no way of knowing if the system isn't lying. [1] http://repo.xposed.info/module/com.devadvance.rootcloak http://repo.xposed.info/module/com.devadvance.rootcloak
- e40 12y ago
  A third party could have rooted it. This seem highly unlikely. In fact, I've never heard of it. And, add to that the serious hurdles I had to go through to root all the phones I ever rooted (3). Your statements amount, to me, to overblown risk.
esquivalience 12y ago
Sorry, sloppy language. I didn't mean stability in the normal sense - rather, homogeneity of the OS. I think that is connected to security: a rooted OS is more likely than a vanilla OS to cause software to run less predictably (probably mostly deliberate). This creates a definite security risk, and one that will be especially feared by a bank where confidence in its brand is at risk.

by Drakim 12y ago

onion2k 12y ago

By definition a rooted phone is compromised - a user has obtained root level privileged access. That's what 'rooted' means. The assumption is that it's the phone owner's actions that caused that to happen, but that's not necessarily the case. A third party could have rooted it. A local app exploit could have rooted it. Some clever malware that hasn't even been written yet that somehow escaped Android's security sandbox could have done it. Ordinarily no one would care if a phone has been rooted or not. It's not important. But the point here is that allowing an app that has access to your bank account to run on a rooted device is assuming that the device was intentionally rooted by it's owner. For a bank that should be assuming far too much.

viraptor 12y ago
Actually they can only check for actual user-exposed way of rooting the phone. If there's a way some local app can do it, it doesn't have to expose this functionality - it can do whatever it wants to with it's elevated privileges and not leave a trace behind. Local app exploit that messes with the bank app only will not be detectable by the bank app.
icebraining 12y ago
There's no reason for a clever malware to root your phone. "Rooting" only makes sense if you want to replace 'su' to grant root to different apps. If a malware escalates to root, it can just do whatever it wants, it doesn't have to "root". Besides, even if the malware really needed to "root" the device, it could just use the same process has RootCloak[1] to hide that fact. There's no valid security explanation; the app must designed assuming it's running on an insecure system, because there's no way of knowing if the system isn't lying. [1] http://repo.xposed.info/module/com.devadvance.rootcloak http://repo.xposed.info/module/com.devadvance.rootcloak
e40 12y ago
A third party could have rooted it. This seem highly unlikely. In fact, I've never heard of it. And, add to that the serious hurdles I had to go through to root all the phones I ever rooted (3). Your statements amount, to me, to overblown risk.

esquivalience 12y ago

Sorry, sloppy language. I didn't mean stability in the normal sense - rather, homogeneity of the OS. I think that is connected to security: a rooted OS is more likely than a vanilla OS to cause software to run less predictably (probably mostly deliberate). This creates a definite security risk, and one that will be especially feared by a bank where confidence in its brand is at risk.