6 weeks after release, Samsung S5 VZN/ATT still not rooted. Bounty at $17k

http://forum.xda-developers.com/showthread.php?t=2728051

by fivedogit • 12 years ago

96 60 12 years ago

mmastrac2• 12 years ago

Ugg -- if I weren't still employed full-time right now I'd be all over this. I really miss my phone-hacking days.

There are _so many_ vectors to privilege escalation on mobile devices. The only reason I stopped working on projects like this is that (most) of the manufacturers released official "root" tools for those on "decent" carriers.

L_Rahman4• 12 years ago

I got curious about what you actually did in your phone hacking days only to go to your profile and discover that you're the person behind unrevoked.

My first ever phone was the Evo 4G and I spent many hours tinkering with it and running ROMs thanks to unrevoked so let this be a belated thank you for your efforts.

mmastrac2• 12 years ago

There was a bunch of us in the unrevoked days that contributed to the success of the project (everything from the userland parts to the UI that actually drove the installer). I was one of the guys deep in the radio for hours at a time, and occasionally the Android system source but it was definitely a high-functioning team that made it happen. :)

The Evo4G was our first and biggest coup, and we used that as a shim to get lots of press coverage shaming the carriers and manufacturers, as well as contacts inside of both HTC and Sprint that led to our eventual "victory" with HTC's official unlock program. Glad you found it useful!

jwise0• 12 years ago

Ha! I was about to come and comment on this, and was glad to see that you already made it in the thread :-) I also wish I still had time for unrevoked-like projects.

One of the things that I think differentiates the Android community from the iOS community is a focus on short term results. I'm not sure whether this is a good thing or a bad thing. On the upside, more freed devices is generally a positive thing, and OEM branches of Android -- at least, in the past -- have been a veritable 0day tree (shake them and exploits just fall out onto the ground). On the downside, vendors have been getting more competent at reverse engineering exploits than they were in the unrevoked days, and so exploits are usually well and truly burned once they've been released. This means that early users who want "more more more, now now now" mean that later users may not get to unlock their device at all.

The iOS groups seem to solve this by timing releases together, based on Apple hardware. I suspect that this is a more sustainable model... but on the other hand, it doesn't matter what I think, because as bounties like this grow, it's not a model that can thrive :-) Oh, well.

comex• 12 years ago

Unfortunately, these days it's more like iOS group - there's only one. It helps that Apple usually doesn't bother to patch the bugs until the next release, so jailbreaks last a long time, but there's only so far you can go with a lack of interested people. (Don't look at me...)

shubhamjain• 12 years ago

Can you explain how exactly you root a phone? I mean how do you find an exploit and use it to gain root access?

JTon• 12 years ago

There was a great slide show posted here a while back that explained the theory being rooting android, but for the life of me I cannot find it. Google "Android rooting theory" and you'll get a set of fairly rich results. For more depth I'd recommend looking into specific exploits, such as Zerg Rush

Dorian-Marie• 12 years ago

Seems like it's just people posting the amount of what they would give, so I would expect the hacker to receive less than $17k.

mikeknoop• 12 years ago

You'd be surprised. I've been on the receiving end of one of these bounties and nearly everyone fulfilled their pledge.

On top of that, donations trickled in for months after from folks who didn't originally pledge.

The XDA community is very good about these things.

http://forum.xda-developers.com/showthread.php?t=499076

voltagex_2• 12 years ago

Just occasionally the XDA community really impresses me. I don't know how people deal with the SnR though.

bobbles• 12 years ago

It'd be hilarious if the bounty got so high that Samsung just does this themselves

fpgeek• 12 years ago

Samsung has already done it themselves (for a price, of course): http://www.samsung.com/us/mobile/cell-phones/ET-G900VMKAVZW

kfir• 12 years ago

The developer edition is $599 when getting locked phone is usually a buy one get one free kind of deal.

pkulak• 12 years ago

Not being snarky at all, but why is this so important to people? Why not just buy a Nexus 5? Or a Play Edition phone?

justin66• 12 years ago

In this case, it's a Verizon phone. Verizon (quite illegally, to my understanding) keeps most devices it doesn't sell itself off its network.

runjake• 12 years ago

Because some people can't "afford" the price of the unsubsidized Nexus 5 next to a "$199" (on contract) S5. Some people like better cameras, some people prefer the S5 hardware, etc etc.

lstamour• 12 years ago

If you can't afford an off-contract phone, you really can't afford an on-contract phone. You just don't know it yet ... ;-)

JshWright2• 12 years ago

Some people are Verizon customers...

gabriel34• 12 years ago

So, AT&T/Verizon sell subsidized locked phones and get their money back on the long run.

If I wanted to, in the US, could I get a contract with a lower value because I'm not buying this subsidy? If so, wouldn't the right move would be to do so and buy an unlocked phone? I'm guessing AT&T/Verizon's interest is far larger than banks', leading to a better deal, even if you don't have the money right now.

On the other hand, locking my phone is the wrong way to enforce anything. It's my device to do what I want with.

zobzu• 12 years ago

"the brand name"

smtddr• 12 years ago

Sometimes just the hardware.

I have a Kindle Fire HDX from Nov.2013 sitting around waiting for an unlocked bootloader to run custom ROMs. Why not just get a Nexus tablet? Because I don't like the design of those; Kindle Fire HDX is much prettier IMHO.

dfc• 12 years ago

I am not very familiar with mobile security and/or the differences between carriers. Right now the bounty is $10k for root@vzw and $7k for root@att. How likely is it that someone wins the bounty for VZW but is unable to apply the method to ATT or vice versa? Are VZW and ATT the usual contenders for last to fall?

sliverstorm• 12 years ago

I can't comment on likelihood, but if the exploit involves the radio, it wouldn't necessarily be portable.

ibrahima• 12 years ago

AT&T and Verizon are usually the only carriers that bother locking bootloaders with no authorized unlock option. Most international/unlocked phones have some way of unlocking the bootloader. Samsung has recently started locking things down more with Knox I suppose, but I think the bootloader is still relatively open (my T-Mobile Note 3 and international Galaxy Note 10.1 2014 happily installed a custom recovery without any fiddling).

higherpurpose• 12 years ago

Does Samsung offer an unlocking tool for the GS5? If not, they should. Google is making Android harder to root, which makes "official" unlocking all the more important, and hopefully people will keep asking for it whenever it's not available.

cmelbye• 12 years ago

If they did, there probably wouldn't be a $17k bounty for unlocking the phone.

skriticos2• 12 years ago

Samsung does, they don't care all that much, they sell devices. ATT/Verizon (carriers) are the ones locking the phones down here (and want to lock the users into their contracts).

codesuela• 12 years ago

Google is making Android harder to root Did I miss something? Could you please elaborate.

voltagex_2• 12 years ago

http://www.securelist.com/en/blog/9175/Android_4_3_and_SELin... and https://source.android.com/devices/tech/security/dm-verity.h...

Sorry for just dropping links, I'm not particularly well versed in this area.

flym4n• 12 years ago

It's getting harder because they keep adding/enabling countermeasures like ASLR, NX, RELRO, FORTIFY_SOURCE

xeroxmalf• 12 years ago

Its important to note as well that "unlocking" and "rooting" are very different with very different end goals. One allows you to move between phone carriers (unlocked phone), the other allows you full software control of your phone (rooting).

briandh• 12 years ago

I think he/she is referring to bootloader unlocking, not network unlocking.

herokusaki• 12 years ago

The bounty only explicitly mentions stock firmware but it is implied that the exploit should also not require disassembling your device and messing with its hardware. This makes me wonder: would a hardware exploit be easier? Modchips have been a staple of the console scene since at least the original PlayStation but I am unaware of their use in smartphones.

pjc50• 12 years ago

JTAG is usually an extremely effective way of breaking into the phone, but it's usually used as a first step in reverse engineering rather than for the end-user.

Of course, some phones (Apple) are glued shut which prevents end-user modding.

rsynnott• 12 years ago

iPhones aren't glued shut (though the battery is glued down in the newest one): http://www.ifixit.com/Teardown/iPhone+5s+Teardown/17383

You may be thinking about the HTC One, which is almost impossible to disassemble without destroying it (though this has improved a bit in the M8).

morenoh149• 12 years ago

It's such a small form factor, a phone. I don't think many ppl would be willing to put after market chips in there.

userbinator• 12 years ago

I'm not familiar with the S5 in particular but in principle I think all you need to do is get direct write access to the filesystem and you can write whatever firmware you want, so being able to read/write the eMMC directly should be enough --- provided it's not been encrypted/password protected/etc. Correct me if I'm wrong.

talonstriker• 12 years ago

On most (if not all), the "firmware" is under the /system partition. That partition is mounted as read-only. You need root to remount it as r/w.

AFAIK, rooting exploits in the past took advantage of buffer overflows and remote code exploits to execute code at a raised privilege levels. Now a days, that's also difficult since past vulnerabilities have been fixed and the proliferation of SE Linux.

api• 12 years ago

The fact that you need to "root" your own property -- I am just astounded that there isn't more yelling over this. Microsoft could never have gotten away with this in the 90s or early 2000s. You probably still couldn't get away with it on commodity PCs. Hell, you can even run Linux on a Mac. But change the form factor and all the sudden nobody cares.

maratd• 12 years ago

It's not the form factor, it's the pricing structure. Most phones are "free" with contract or very near to it. It's difficult to complain about something you're getting for "free".

Now look at off-contract phones. I have a Dev Edition Moto X. I unlocked and rooted my phone with official tools provided by Motorola. I paid for the phone in full. I wouldn't have bought it unless I got a device that I completely owned.

If you want hardware that you can completely own and control, you can buy it. Most people simply choose not to.

lmm• 12 years ago

It's because Apple did it first. Even in the PC days Apple behaved far worse than Microsoft, but somehow they army of fans that will defend any action from them. Heck, I remember when they introduced those tamperproof screws and on this very site there were people claiming that it was actually just a better screw design.

jotm• 12 years ago

I don't know, elevating to root was always recommended in Linux :-)

kasabali• 12 years ago

It's tangential but I want to point out to those who doesn't follow the rooting community closely that Samsung doesn't lock the bootloaders of phones unless it's requested by the carrier. International editions, Play store editions, and contract phones from carriers which doesn't request locking are unlocked by default. You can install whatever you want on it. Even if it has Knox. Knox doesn't mean locked bootloader, its relation to rooting is that it voids the warranty when it detects rooting, it doesn't lock the bootloader or prevent rooting.

Corollary: I'm aware of the fact that it is not always possible, but buy your phones off contract when possible. Life is too short for fiddling with those nonsense, and also vote with your wallet.

6 weeks after release, Samsung S5 VZN/ATT still not rooted. Bounty at $17k

Related Stories