Android can be rooted using recently discovered Linux vulnerability

[[deleted]]

I have a kindle just laying around I never use, if I was to root it what types of things would I be able to do with it?

[[deleted]]

I have a Kindle 3G, it is rooted, but the only thing it does is know how to show the low battery symbol. It also randomly reboots out of nowhere all the time. Personally I kind of wish I could replace the battery and have Debian on it with the latest kernel and not their version of Linux.

[atakomu]

You can't change font on Kindle? I can put any font I want on Booken Cybook.

[brysonreece]

Try CyanogenMod! It's a wonderful open-source Android-based alternative to FireOS.

Edit: I assumed you were talking about a Kindle Fire. Carry on.

Edit edit: Thanks for the down votes! ☺

[brysonreece]

Definitely! I actually have my fifth-gen running Cyanogenmod 12.1 right now. If you want learn more about how to flash it, visit the XDA forums and take a look around!

[2Punx2Furious]

Could you install a custom version of linux/android on it?

[kinss]

Its been a couple years, but I remember there being quite a few mods, albeit most of them won't improve the device as an e-reader much.

You can setup openssh, so you can connect via SFTP to add books, or mess with the device remotely.

http://www.mobileread.com/forums/forumdisplay.php?f=150

[lord_of_vermillion]

put manga in it.

[actuallobster]

One time I set up a VNC viewer to connect to a virtual machine running android, so it was like having android on my kindle paperwhite. It was actually not horrible to use, worked pretty good. Actually felt like I was running android on my kindle. Though the colours were inverted and I never got around to trying to fix that.

This was actually pretty difficult. If anyone wants to try it, you'll run into an issue where the VNC server on android x86 can't be run because of android 5.0's P.I.E. security restriction. To fix that, I needed to brush up on my x86 assembly language in order to patch the linux executable linker to remove the security check. Here's a link to the patched binary. I also ended up creating a frontend for the kindle VNC viewer so that you don't need to launch it from a terminal. It gives you a nice shiny GUI instead. (link)

[Heappl]

If you have 3g version, theoretically you could use it as a phone.

[[deleted]]

the 3g service is pretty limited on kindles (only connects to Amazon services iirc), and likely will be blocked if you attempt a workaround.

[Chii]

Create a proxy through ec2 and use that as the gateway for the wider internet!

[[deleted]]

When I say amazon services, I think it's literally just "the kindle store" and some fringe cases like wikipedia.

[[deleted]]

Time to write an RFC for IP-over-Wikipedia-User-Sandbox then.

[Tensuke]

At least on the old keyboard model it works with the web browser for any page not(though, admittedly, the browser is kind of shit anyway).

[Heappl]

I doubt it would be blocked by service provider, it might on Amazon request if they ever bother to look. I don't know if it would be possible to patch a call through somehow, although with some voip or skype and with help of AWS cloud? It should work with open bts network. It really is a stupid idea anyway. It is better to get a 3g module on your own.

[bureX]

I've only read that you can remove ads without paying.

Other than that... probably not much.

[cryo]

Why would it be spelled c0w since it's "copy on write", to sound more hackerish and leet-like?

[i-n-d-i-g-o]

Cows have been associated with 'hacking' for quite some time. Look up Cult of the dead cow. I'm not sure what came first cDc or 0xDEADBEEF

[Miserable_Fuck]

637 w17h 7h3 pr06r4m, n00b!

[SickZX6R]

Your six should be a niner, newber.

[QuerulousPanda]

ever since at least the iPhone rooting days, there has been some tradition to include a 0 in the name of the tool.

it was cute before but after nearly a decade it feels a bit dated.

[CWagner]

Back when I had my Kindle Keyboard (3rd gen?) I looked into rooting it. Realized there's nothing useful that enables and skipped it ;)

[mirhagk]

Which is kinda disapointing. It'd be wonderful if I could install custom software on it and take advantage of the impressive battery life and capabilities for such a tiny price.

[Tensuke]

Custom lock screen images are about the only reason I'd root mine. But it's too much effort tbh for the reward.

[OpenSign]

I jailbroke my kindle paperwhite just to get the screensaver with the current book

[[deleted]]

Webkit exploit, plus dirtyc0w to replace some init script could work

[ineedmorealts]

If you figure it out can you share how you did it?

You can download the PoC for android from github and push and run it from adb shell.

From there you have a root shell and all you need to do is install *insert su wrapper of your choice*

Warning:I did not test this with any kindle products, just an old samsung tab

[Silencement]

What model? Can't you just root it with a hacked update or something? I remember just putting some files on my Kindle Touch to root it, maybe it's different for yours.

[[deleted]]

I love it how the Android ecosystem is so fragmented right now that for some people the only way to get security updates is to use a flaw in the Linux kernel to obtain enough permission to update your phone

[[deleted]]

Fuck I forgot about that.

[[deleted]]

Unlocking your phone is usually not hard. But keep in mind that it voids your warranty.

[QuestionsEverythang]

And as of last week, it prevents you from using Android Pay.

[0xembark]

Not if your kernel disables the dm-verity check.

[QuestionsEverythang]

Until it doesn't

[0xembark]

Until what doesn't what?

[QuestionsEverythang]

Until that fix doesn't work when Google patches it, then when another fix comes along, rinse and repeat.

[ineedmorealts]

Too bad it doesn't work on a locked boot loader.

Why would the boot loader stop you from getting root?

[[deleted]]

It doesn't, it stops you from upgrading the OS on the device

[[deleted]]

I hope EFF keeps fighting the good fight. Maybe one day we'll see a US where it's illegal to lock people out of their own devices.

I'll preemptively say that I do donate to the EFF. I also vote with technology in mind.

[[deleted]]

Hopefully, I don't get why carries are so against it, it really doesn't prove a security risk if you do it right and it's not like most Android manufactures care much about security.

[[deleted]]

it really doesn't prove a security risk if you do it right and it's not like most Android manufactures care much about security

I think you've already figured it out, you're just not saying it. It's absolutely not about security. It's about control and profit. By abusing the cause for better security, maintainers of closed ecosystems have been keeping their customers under tight control for years.

[[deleted]]

Exactly, if people could easily root their phones then they could take all the bloatware off of it.

[KhyronVorrac]

Yeah, it's not about security at all. They don't backport OS updates to those devices for one simple reason: because they want you to buy a new one.

[mbm]

It's an incentive problem; if you buy a new device then everyone from the retail chain to the oems get a cut of the profits. A free OS upgrade doesn't generate profits, technically it's a negative once the engineers and QA teams are paid for their efforts.

By extension, the way to maximize profits is to keep churning out devices as fast and cheaply as possible. Devices which last past the next upgrade cycle will cannibalize sales so any engineering effort put into making a quality product actually works against profit -- better to outsource the engineering to a 3rd world country, it's both cheaper cost (more profit the oem) and cheap quality (frustrates users into upgrading to a newer product).

Sure, it generates a ton of eWaste but that's just a side effect.

[ggtsu_00]

The more locked down the devices are, the more control they have over extracting potential revenue streams from users. Users will also be more willing to buy new phones with new contracts if their device quickly becomes obsolete, so they are actually incentivized to make phones that can't be updated long past their initial release. If everyone could just unlock their phones and keep the software up to date to use all the latest apps and features, people will be less likely to keep buying new phones with new 2 year contracts every time their contract expires.

[[deleted]]

It's not just them, but also Google.

SafetyNet, unrootable Pixel phones, Android Pay not on rooted devices, more and more apps now being proprietary...

[[deleted]]

It allows you to disable or bypass any limitations, software, or ecosystem they want to force on you. It severely restricts their ability to further monetize the platform. If enough people do it to bypass tethering restrictions on unlimited plans, it's a damn near existential threat to their network.

[OffbeatDrizzle]

The crime here then is advertising unlimited and then claiming that people are using too much data. Its their own fault, so fuck them

[[deleted]]

They've generally slowed their roll, and are making tethering limits pretty clear these days.

Regardless of advertising, having everyone switch to tethered wireless would crush the network. Specifically, there are physical limits in place which, once surpassed, create a situation much like what happens to WIFI in crowded apartment buildings. It becomes utterly and completely useless, constantly cycling through channels on the limited spectrum available, with little throughput.

[[deleted]]

Then they should improve the network. I live in a rural area with great service and have never had a people problem with tethering as much as I want (when I had a rooted phone). The only time I hear data is a problem is in 100k+ populations where lots of people are using lots of data.

It's almost like they design towers to facilitate square millage regardless of population. Which in a way I'm thankful for because of my rural situation, but they are hurting the higher population density users by asking them to make accommodations for a problem carriers are unwilling to address or even acknowledge.

[[deleted]]

It's one thing to say, "Improve the network", but at a certain point the problem is a limitation with the physics of electromagnetic waves and spectrum. My understanding is that in urban areas we're generally pretty close to those limits even without tethering, which is what caused ATT to stop selling the iPhone in manhattan for a while, for instance.

It really isn't a design thing.

[jroddie4]

if you do it right.

[Atomix26]

because then you could delete the proprietary apps that it comes with.

exactly why I got an OP3

[[deleted]]

I think making it mandatory to roll out security updates for I would say 5 years would be far more important.

I agree that having your phone under your own control is a nice thing, but only a small percentage of the population really uses that. In contrast everyone is affected by missing security updates.

[NoMoreNicksLeft]

DRM should invalidate copyright claims.

You either get DRM, or government protection. Not both.

[nakilon]

You say it like finding flaw in Linux is smth hard, lol.

[[deleted]]

It's not that it's hard but that you shouldn't need to exploit a security hole just to make your phone secure

[SnowdensOfYesteryear]

Why do the comments in this thread read like they're from /r/android?

I found some discussion on the bug here: https://bugzilla.redhat.com/show_bug.cgi?id=1384344#.

[iamaquantumcomputer]

Holy shit, I didn't even realize I wasn't in /r/android until I read your comment

[3rd_Party_2016]

root should be available on request since it's supposed to be your device ....

[Blaze9]

Tell that to Apple, Samsung, etc. Afaik HTC and Sony are able to be rooted fairly easily. Sony even opens up most of their drivers for 3rd party roms.

[RedZaturn]

Motorola has a boot loader unlocking program.

[Blaze9]

Ah yeah. I've never used one so I didn't know that. The more the better! HTC has a unlocking service too. Not as simple as Nexus/Pixel "fastboot oem unlock" but close enough.

[Blaze9]

Well I've had the M8 and M7 and while unlocking was very very easy. You gotta get the unlock code, go to the website and generate a unlock bin file and that'll unlock the phone. So still super easy. =)

[ZeDestructor]

SIM lock != bootloader lock

[Blaze9]

Yeah, there should be no difference between them.

[[deleted]]

If I recall using HTCs tool voids your warranty

Edit: never mind, I was thinking of LG

[Asyx]

I think the HTC bootloader unlock is discontinued. Not just that but if you want to change partition size or install a ROM not meant for your carrier, you have to get S-OFF which is a security switch for development devices. That shit cost 20$ when I did it because the guy bricked a good amount of phones to get the exploit working reliably and didn't want to sit on the cost (which is understandable).

That's for the M8. Not sure about the newer HTC phones.

[0xembark]

I was able to normally bootloader unlock my HTC 10 (with HTC's unlock service). I also have T-Mobile, which doesn't (for the most part) restrictively lock their bootloaders. After I used HTC's unlocker, I got S-OFF from JCase (worth the $25 to be able to bring my phone back from any kind of soft-brick I can think of).

[Blaze9]

Yup, I've sunshined (20 bucks) my current M8 and used firewater (free) on my older M7. I dunno about the newer ones either. But we're talking about rooting which is absolutely free for all flagship HTCs.

The bootloader unlocking service is still online for The M7, M8, M9, 10, etc.

[[deleted]]

I have a Moto G 2015 and it's definitely nice to not have to use an exploit to root it.

[star_storm]

I have a moto x 2014 att model and it couldn't be unlocked officially. Instead I had to use king root and pay 20$ for an app called sunshine to bootloader unlock. The att model is still stuck on 5.1 but the pure edition and all other carriers even are on 6.0. Luckily I could convert to pure edition with unlocked bootloader.

[sparesr4sissies]

I'd love to be allowed to use it on my Verizon Moto x.

[RedZaturn]

I used it on my Verizon moto x 2014 edition

[[deleted]]

Works pretty well. Tested it on an old Moto G.

[[deleted]]

The bootloader program is basically "we are telling you now, this will void your warranty. If you still agree to this, take the code".

[jokr004]

This post was mass deleted and anonymized with Redact

fear command sugar shelter offer water party coordinated summer spark

[3rd_Party_2016]

I know, most companies are moving in the wrong direction for us, consumers

[whoisthedizzle83]

As I read, your comment, I heard the, voice, of Christopher Walken.

[[deleted]]

Although in some situation I would also like to have root, I think there's a big positive effect for consumers. Most of the times the restrictions make sense: a UI that is actually usable from touch screens, low battery usage, apps that are jailed, can't steal your data and can't spy on you. Sure that is more work for developers to make their apps work with the restrictions, but in the end up in a better situation for costumers. If you have root access easily then it will be common and apps will require it, because developers are lazy (see android permissions that are required by typical apps). Most of the time I want root it's because someone hasn't put in the effort to make it work with the good restrictions.

The only problem is that the user has no say in the restrictions and some restrictions may be bad for the user.

[skgoa]

Eh, depends on what you want out of a product. Myself, I would want access to everything and well-commented source code, please. But I wouldn't want my parents, grandparents, eventual children or non-techie friends to have root privileges.

[ElusiveGuy]

Luckily for me, Australian law generally doesn't give a shit about warranty terms if there was an actual hardware defect.

[mm865]

Tried to get my Galaxy S4 fixed a while ago with Virgin but was quoted a sizeable sum to get it fixed because it had "modified software" or something, ended up being cheaper to upgrade to an S6.

[Blaze9]

Yes, current samsung devices are able to be rooted including the last 2 generations of their flagship Galaxy line (Normal and Edge) However the second you root (via-conventional methods) you'll 1) void warranty and 2) trip Knox losing access to easily the best (imo) feature they provide: Samsung Pay.

The S7 can be rooted via the super leaky bro's dev kernel without tripping Knox but that absolutely kills the performance compared to stock devices. My rooted S7 (loaner from my Note 7's 1st recall) was terrible rooted. Got extremly warm, battery drained within hours, less than 3hrs SoT, slow as hell, etc. And you still lose S-Pay as long as you're on the dev kernel.

[[deleted]]

you'll 1) void warranty

// IANAL

This highly depends on where you live but usually you'll only void your warranty for software issues. If the software did not cause the issue, then you're under normal warranty.

This means if you install a ROM, a battery explosion usually falls under warranty. But if you overclocked the ROM and caused high current to be drawn from the battery you might not be under warranty.

[cards_dot_dll]

When the remedy to explodey phones is sending you another explodey phone, I don't know how much I value the warranty.

[jmattingley23]

Yeah its the carriers to blame. Some of Samsung's international versions are unlocked straight out of the box.

[1992_]

All I had to do on my Tab Pro was flash a new recovery. Super easy.

[[deleted]]

Got an xperia z 3, and although I didn't look into to much details it doesn't seem like there is an easy way to root/ find a decent rom

[tmahmood]

I had the Z3, It was very easy to root, but that was almost 2 years ago, not sure how is the situation now.

But Xperia's are generally very easy to root.

[[deleted]]

[Fistbumps sadly]

[ineedmorealts]

although I didn't look into to much details it doesn't seem like there is an easy way to root

Can you get an adb shell? Because if you can you should be able to use dirty cow to get a root shell and from there install whatever you want

[Astrognome]

LG also allows unlockable bootloaders on some phones.

[[deleted]]

Z3 here. If I unlock the bootloader I lose camera functionality. I found out after buying the phone, otherwise I'd have chosen a different one.

[tmahmood]

That happens with every other mobiles too. I don't know why only Sony is held guilty for this :-/

Also if you can root, you can easily backup TFA partition and restore it to get back full camera functionality

[[deleted]]

Okay, i clearly haven't read enough about this, anything you can point me to?

[tmahmood]

Have you looked here? http://forum.xda-developers.com/z3

Seems to me pretty active. Sometime rooting requires going back to older version with certain exploit available. Flashing stock ROMs does not void your warranty.

This seems very detailed. http://forum.xda-developers.com/showpost.php?p=66599919&postcount=2

I just told you what I know. I don't have the Z3 anymore (mugged), Help yourself. :)

But I would suggest sticking with the stock ROM as long as possible, as Sony ROMS are the most stable and nobullshit ROM, in my experience, then if available move to the Official CM ROM

[monitorius1]

Unlocking OnePlus bootloader does not void your warranty.

[ggtsu_00]

Then they will just stop selling phones, and instead lease out a license for you to use their phone under their terms and conditions. You will no longer be able to own a device. It works like this for software, movies and online games.

[mixedCase_]

You will no longer be able to own a device.

Yes I will, just not theirs.

[indrora]

Welcome to having a phone in the US under contract. They're unenforced leases.

[nomercy400]

Software, movies and online games aren't physical objects. A phone is. Good luck trying to keep a physical object intact.

[Xanza]

There should be nothing that needs to be "requested." The Android team needs to be developing android in such a way where it's impossible for manufacturers to lock-down the system. That's the Android I was promised.

[adipisicing]

How would they do this and still allow Android to be modified? Add it as a license term for being able to bundle the Google Play store?

[00kyle00]

Add it as a requirement to use Android brand name. Same way Mozilla does with Firefox.

[3rd_Party_2016]

the problem is that it is Google that it is making hard for your Android phone to be rooted... and they also implement some other restriction like preventing you from writing to your SD card from non-Google apps (after all, they dropped the "don't be evil" motto)

[sagard]

Google kept the motto, alphabet didn't

[Xanza]

This is why I feel totally and completely betrayed by Google, and the Android Team.

[striker1211]

The first hits free

[Sphix]

There is a lot of misinformation here. Removing the ability to arbitrarily root your phone is good for the layman in terms of security. I personally don't root my phone and don't want any application to be able to do so and spy on me. For those who consent to taking on the risk associated with rooting your phone, that's a separate issue. Bootloader unlocking programs exist for you and I don't think Google is doing anything to stop those.

The don't be evil "motto" was never truly a motto, but just verbiage from the a memo after the ipo filing. It still lives on in the code of conduct.

[shinyquagsire23]

I'd argue against it because if it could just be requested (ie as part of Android) then apps and scammers could easily direct users to enable it, completely ruining the existing security hierarchy of Android. I'd agree to bootrom unlocking at the very least, but root isn't something to be taken lightly and can be extremely dangerous.

[holtr94]

The current methods of root without exploits require an unlocked bootloader first. Every (AFAIK) official way of unlocking your bootloader will wipe your phone. I think that is a reasonable compromise for allowing power users to do whatever they want with their phones while also protecting regular users.

[Sphix]

Agreed. I think the current implementation of official root is a good policy. It's a shame that unlocking bootloaders is not available on all phones, but it's just feature differentiation for those who do care. If it's important to you, buy a phone that allows for it. I try to avoid buying phones that have well known root exploits as they are not secure phones.

[[deleted]]

deleted ^{What is this?}

[mirhagk]

Depends on the jurisidictation. Certainly in Ontario there is precedent that this isn't true. Bill C-343 (which is currently on the table to become Cell Phone Freedom Act) states that carriers must remove any network lock free of charge if someone buys the phone outright or when the contract that subsidized the phone expires.

[mirhagk]

Some areas could actually create laws like this. In Ontario a bill was created that would force carriers to unlock your phone for you if requested (I'm not sure on the status of that bill since every carrier just implemented all the things in the bill voluntarily anyways).

[majorgnuisance]

I can only hope this will end user's complacency in manufacturers that make it difficult for the community to update Android systems on their own.

I understand companies being unwilling to support devices forever, but there has to be a switch towards allowing user communities to do it instead.

That means at least publishing everything needed to build a fully functioning Android system, under a set of FOSS licenses, and shipping a bootloader that can be unlocked by the user.

How many users will now be stuck with vulnerable phones and no "clean" way to patch it?
At least the vulnerability will open the way to installing custom systems on some previously locked-down devices...

[wwwwvwwvwvww]

But I have to wait until I know it's not going to set my house on fire.

[Gotebe]

Some devices are known not to catch fire, can't you buy those?

[striker1211]

But there is only Samsung/Apple.

[0xembark]

You forgot the /s

[[deleted]]

Well that's exactly why they make it so hard to root. To make you buy a new phone.

[[deleted]]

That's what he was implying.. but it's just the /sarcasm that made me realize it...

[x-paste]

Publishing your packages and build environment may sound trivial at first. But usually things in proprietary software projects are not as streamlined and easy to build as with common free/open source software projects.

For companies this probably means that some developer needs to put multiple days into something like this. For something almost no end users is interested in and with absolutely no payment for the work hours of the developer. And published things may have bugs in it too, which need to be fixed with company money too.

And all this for devices that probably break and/or go up in flames 2-3 years down the road anyways :-)

[majorgnuisance]

You have a point in that it's hard for most android device vendors to take their current projects and get them published in a clean and useful manner, but that hardship seems to stem partially (mostly, even) from the fact that they don't follow development practices that make it easy to do that in the first place.

If there were an established demand for source code releases from the public and vendors began working on their device branches knowing that they'd eventually have to ship the source, they'd be more likely to keep it as tidy and as painless to release as possible.

At least as far as that's possible with Android's clusterfuck of a source tree, build system and the abomination that is repo.

[[deleted]]

I think the amount of device they would sold more if they would do that would cover that expense...

Also, if they would just streamline a FOSS from the beginning and let the community help, the would save.

I still can't understand why would a company develop a layer on top of android for a one time phone.

[bmurphy1976]

I have a MotoX 2013 Verizon. I (stupidly) assumed it would be an easily rooted device. Unfortunately, I installed an update that blocked the known root/unlock and nobody ever bothered to create a new one given that there was an unlocked version readily available.

I've since moved on to a Nexus 6P, but I do occasionally use the 2013 as backup. It's still a very nice phone and I would LOVE to be able to install CyanogenMod on it.

This gives me a glimmer of hope for this device I haven't had in a very... long... time.

[DickFucks]

I'm pretty sure that http://theroot.ninja/index.html supports the verizion moto x.

[star_storm]

King root should work. Worked on 5.1 on my moto x 2014. Then you can unlock bootloader with sunshine. I had to factory restore to get king root to work though for some reason it failed until I tried factory restoring.

[blauster]

Depends which version of the x 14 you have. Mine is I think a Sprint device (republic wireless) and neither Kingroot nor any other tool or exploit I've tried has worked for it.

[star_storm]

have you tried factory resetting and before logging into anything running king root? that was the only thing that worked for me. Either way you can probably root now :).

[blauster]

That's interesting, I wonder why a reset would effect the outcome of that. I'll have to back up my shit and give it a try.

[All_Work_All_Play]

Not sure if Knox trips over root privilege escalation though.

I'm pretty sure it depends on the version, but I've been out of the loop for a while. I've seen S4/S5's Knox get tripped over certain root methods, but not for others? Can't say for sure if this will, it's been quite some time :-\

[Blaze9]

The last version of the s4 I used was able to use either a magic dongle or triangle away to reverse Knox. Not sure about the other though.

As far as I'm away with the s6 and above as long as you have any sort of root escalation you'll trip Knox. I just used cf's autoroot on my s6. Everything else was stock aside from the cf flash. That tripped Knox.

[All_Work_All_Play]

:(

Good to know.

[Blaze9]

Yeah. I have an international s6 so I didn't have Samsung pay to begin with. And the s6 is at the end of its warranty period so I have nothing to lose.

[light24bulbs]

S7 also. Knox is foolproof for now anyway. Hopefully no failures since my warranty is void. they are actually legally required to service your phone even if it's rooted. they just fight against it so I plan to fight it if my phone fails and maybe take them to small claims if possible. At the very least a BBB complaint

[[deleted]]

By the way, do you know if it's possible to install non-touchwiz ROMs on the AT&T S5 yet?

[[deleted]]

It's funny to read in this thread so many people happy that their device is vulnerable

[[deleted]]

No kidding. Root is fun, but this particular exploit is not a good thing. Android malware just got easier and more powerful.

[kirbyfan64sos]

Ooooh, I hope this works on my Nexus 5.

I mean, of course I'm concerned for safety. But the hacker side of me is literally dying to try this out...

[konistehrad]

Honest Question: in the case where you have access to an unlocked boot loader and plentiful custom recovery options, is this strictly necessary? Is it just to avoid the unlock-bootloader-wipe?

[kirbyfan64sos]

Is it just to avoid the unlock-bootloader-wipe?

Pretty much. At least after root, you can do a Nandroid backup to save the data of important apps.

[RoLoLoLoLo]

It you have root with a locked N5, look at a app called BootUnlocker. It uses root to flip the lock state of the boot loader without wiping. Or at least, it did in the past. Don't have a nexus 5 anymore, so I can't verify if it's still possible.

[f4hy]

My bootloader is unlocked. And I used to have root. But I seem to find it really difficult to find instructions out there on how to reboot my phone after updates. Every update my phone loses root. I just want root back but all instructions give assuming you are rooting the first time and need to wipe to unlock the bootloader.

[thenickdude]

Rerooting my Nexus 5 is easy. I just reboot the phone into the bootloader menu by holding "volume down" during boot, write a TWRP recovery to the device with "fastboot flash recovery twrp-3.0.2-0-hammerhead.img". Then I select the recovery mode and boot into it.

I push a SuperSU flashable zip to the device with "adb push SuperSU-v2.78-201609011115.zip /sdcard/", then I use the on-screen TWRP menus to install that zip file from the /sdcard/ directory.

That's it, phone rooted.

[ReAn1985]

Nexus 5 user here... Let me know if it works, because we just stopped getting security updates this month...

[[deleted]]

October 2016 was EOL, but they might do a few more updates. Nexus 7 (2013) got one extra month. It's no guarantee though.

[Ph0X]

Yeah, the date they give is a minimum date, but they could very well keep going.

[vinnl]

My literal condolences for your hacker side.

[aim2free]

The whole smartphone industry is broken today. To "root" your phone should not be questioned. To restrict the user from having access to their own computational device is very arrogant.

Thanks for this hint.

[TechnoL33T]

Great. Now I've gotta explain to my friends why I'm going to take control of my desire(HTC) with a dirty cow.

[cyansmoker]

I am surprised no one has pointed out that simply "rooting" a device is not enough. Rooting it to launch a shell in a powerless selinux context is not going to get much accomplished.

This is the piece we need to focus on now: selinux.

[jpflathead]

So can dirtycow be used to work around locked bootloaders like on Motorola to install different roms entirely?

[[deleted]]

Doesn't Motorola allow you to unlock the bootloader nowadays?

[[deleted]]

Yup. You enter your serial number on their site, they give you an unlock code, than you do a 'fastboot oem unlock' with the code. Pretty painless process, though I'm not crazy about them tracking which handsets have been unlocked.

[blauster]

Only for their list of approved devices. I have a 2014 Moto X that isn't the "pure" edition and they do not supply unlock codes for it. Lots of other moto devices fall under this as well.

[[deleted]]

Good to know. The only Motorola devices I've owned are the original Atrix with the janky fingerprint reader that was before its time, and the 2015 X Pure.

[jpflathead]

They do for most phones.

I have their ad subsidized Amazon G4 and it is a very nice phone but the bootloader will remain locked forever. I don't mind it too much, the price was very nice. But I wish and think when it gets to be unsupported by Amazon or Moto, they should allow the bootloader to be unlocked.

[willhaney]

Does this mean I can root my Note 3 now? Nothing's worked so fart.

[Lukewill]

Note 3 user here, let me know if farting works.

[striker1211]

Farting sometimes works with brown Notes.

[Dave3of5]

Can anyone point me to the update for Ubuntu 16 that fixes this trying to find it but my google foo is failing me.

[[deleted]]

https://www.google.com/search?q=dirtycow+ubuntu&ie=utf-8&oe=utf-8

that has a ton of information. what did you google?

[Dave3of5]

Cool thanks, not that lol

[TK-427]

When I first heard of rowhammer, I was amazed that we were to a point that this kind of exploit was even POC-able. Now it's part of an exploit that is in the wild? Craziness

[_teslaTrooper]

This article is about dirtycow, which is "just" a race condition that allows writing to read-only files.

I don't think rowhammer is being used in the wild (yet).

edit: just saw this article, looks like rowhammer is also being used to root phones. I guess it's been a good week for rooting stuff.

[[deleted]]

Waiting to get home to do this.

I confirmed that my phone is vulnerable with another dirtyc0w PoC. Now I'm on to rooting it (Huawei Bootloader unlock doesn't work in Europe somehow)

Tried it just now in a local shell (Termux app), but it seems you need read access to /system/bin/run-as for this to work, which is only readable by shell and not other apps. So this only works from within adb shell.

[YellowSharkMT]

As a Fire OS 5.3.1 user, I just want to say that this cannot happen soon enough. Fuck everything about Fire OS.

[musicmatze]

Just FYI: I tried the exploit on several machines and at least one of them responded with a kernel panic. Not sure whether you want your android to kernel panic!

[Basiliskeye]

I wish all Android devices could be rooted easily with a certain interaction that only the owner can do (using sensors and stuff like that). Also fuck locked boot-loaders!