This latest test is related to rooting framework KernelSU. Sinilar vulnerabilities were found earlier in other rooting frameworks such as APatch , SKRoot, etc. The vulnerability results in gaining root access and escalated privileges.
Would be much easier to work against such vulnerabilities if rooting was officially sanctioned and actual resources could be put towards making it a viable and secure option, rather than taking away the power from the user for the device they purchased.
Giving apps root permissions exposes a huge hole in the Android security system (normal permissions) though. This is inherently more insecure than not having root at all.
> rather than taking away the power from the user for the device they purchased
I disagree with that. Not having root doesn't mean it's inherently anti-user. I use GrapheneOS without root and am still in total control of my device.
The author goes into the weeds on the vulnerabilities that can be left following some rooting methods. All to the good.
Meanwhile, it's non-rooted phones that get endlessly compromised
by state sponsored cellbright attacks (LEO),
by blackhatted Israeli exploitive malware platforms
and from an endless array of general crapware, much
of it from handset manufacturers, wireless carriers and
their bloatware affiliates.
All that said, the article really does go into detail. I know enough to follow along but probably not enough to spot issues (if there are any).
This latest test is related to rooting framework KernelSU. Sinilar vulnerabilities were found earlier in other rooting frameworks such as APatch , SKRoot, etc. The vulnerability results in gaining root access and escalated privileges.
Would be much easier to work against such vulnerabilities if rooting was officially sanctioned and actual resources could be put towards making it a viable and secure option, rather than taking away the power from the user for the device they purchased.
Giving apps root permissions exposes a huge hole in the Android security system (normal permissions) though. This is inherently more insecure than not having root at all.
> rather than taking away the power from the user for the device they purchased
I disagree with that. Not having root doesn't mean it's inherently anti-user. I use GrapheneOS without root and am still in total control of my device.
The author goes into the weeds on the vulnerabilities that can be left following some rooting methods. All to the good.
Meanwhile, it's non-rooted phones that get endlessly compromised
All that said, the article really does go into detail. I know enough to follow along but probably not enough to spot issues (if there are any).You are mistaking "rooting" with using a different Android distribution.
You can install GrapheneOS/Lineageos without root. And you can install a su binary on the stock OS, not improving privacy at all.
>Meanwhile, it's non-rooted phones that get endlessly compromised
With the notable exclusion of GrapheneOS. (It's also Cellebrite-proof going on three years now.)