LWN: Comments on "Android Root Access Vulnerability Affecting Most Devices (Threatpost)"

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

ThinkRob — Mon, 23 Jun 2014 06:01:38 +0000

T-Mobile has an unlimited plan too.

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

spender — Thu, 19 Jun 2014 03:10:12 +0000

You should only be surprised when a kernel exploit *isn't* able to circumvent SELinux. I don't think a single kernel exploit I've written would have been prevented by SELinux. Slide 4 of my 2010 LSS presentation continues to ring true:
https://grsecurity.net/spender_summit.pdf

-Brad

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

sblack — Wed, 18 Jun 2014 18:43:25 +0000

I'm surprised that this is able to circumvent SELinux in newer versions of Android.

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

mathstuf — Wed, 18 Jun 2014 18:20:14 +0000

Heh. Yeah, Sprint coverage around here is close to "nope" by the (comparatively) recent reviews I'm seeing (and the trend is actually getting worse over time it seems; in 2003 they had 4 star ratings and in 2012 they're in "have to go outside to call" coverage). That doesn't even seem to count data coverage either…

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

adler187 — Wed, 18 Jun 2014 17:44:49 +0000

Sprint also has unlimited (without throttling) data plans. Of course, Sprint's network is nowhere near as good as Verizon's and you may have similar issues finding phones due to use of CDMA.

As much as I'd prefer T-Mobile to stay separate, the one good that could happen with a Sprint merger is Sprint moving to GSM (they're moving that way already with LTE). If the deal goes through, I'll be cautiously optimistic...

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

mathstuf — Wed, 18 Jun 2014 16:38:20 +0000

Unfortunately, Verizon is the only one with a truly unlimited plan (i.e., no throttle after X GB) still available for those who are still grandfathered in, so there's lockin there too (for me at least).

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

nybble41 — Wed, 18 Jun 2014 16:02:52 +0000

By "certain carriers" I assume you mean Verizon, since the US market is essentially divided into "phones compatible with Verizon" and "phones compatible with everyone else", like the Nexus line. Even with Verizon, though, there are the "Developer Edition" and "Google Play Edition" phones with unlockable bootloaders.

If you're going to insist on a particular model of phone, of course, then your options will be limited. Your best bet would be to get away from Verizon, assuming there are any other providers servicing your area.

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

Rearden — Wed, 18 Jun 2014 15:43:27 +0000

That's easier said than done. Carriers have a lot of sway over what phones are available right now. Different radios and wireless technologies (in the US anyway) make it hard to often get the particular phone someone might want if they aren't willing to accept sub-par service on certain carriers.

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

mastro — Wed, 18 Jun 2014 15:09:58 +0000

You should just vote with your wallet and buy devices with an unlockable bootloader. E.g. Nexus phones and tablets.

Android Root Access Vulnerability Affecting Most Devices (Threatpost)

rriggs — Wed, 18 Jun 2014 14:40:37 +0000

Root exploits on Android are a mixed blessing. These are more often than not used for good, giving Android users root access to their phones. I have in the past specifically sought out Android devices with known root vulnerabilities in order to have a "usable" device.