• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root Samsung Acclaim Need To Be Rooted

I would hope people that root don't bank on their phone. I know I don't, and I'm sure I speak for many rooters.

Rasmith you should be aware that any skilled user can pull information from any Acclaim, rooted or not. While it's easier with a rooted one, the possibilities of theft remain for your phone, too. Just thought I'd let you in on that, since you don't seem interested in addressing this fact.
 
Upvote 0
Well dcollins23, if this is such an easy task, then why didn't anyone claim the $15,000 prize for doing so at CanSecWest's Pwn2POwn contest this year (Nexus One) or last (G1)?

Mind you, I am speaking about the ability to remotely crack the phone via TCP/IP, not get to files with the phone physically in your hand. Since you sound like an expert, please inform us n00bs how exactly you are doing this. Which one of the IP layers are you attacking and how?

A bunch of the folks who are rooting their Android phones have no idea how big a security hole they are opening. I have personally spoken to over half a dozen people who were completely unaware that rooting Android affected the security of their phones at all.

The possibility exists for any device to be cracked, but do to the structure of *NIX operating systems, of which Android is one, it is much harder than say for iPhone or Windows Mobile (both of which went down at Pwn2Own).
 
Upvote 0
rasmith3530 I don't believe that dcollins23 was talking about remote exploits, I think he was talking bout physical access to the device. and anyone with physical access to a device can find bout any thing on your device rooted or nonrooted.
that article also don't talk about remote exploits, It's talking about apps you install being able to read info from other apps that they normally are not able/allowed to read.http://androidforums.com/members/rasmith3530.html
 
Upvote 0
Rasmith, I apologize, I was speaking in broad generalities. I can tell immediately you are much more familiar with the process of hacking and what it entails, and it no way do I mean to sound like an expert, because I am definitely a n00b when it comes to this.

What I was trying to say is that no phone is completely safe. While rooting a phone might be the most dangerous, you just said yourself how the iPhone went down to hacking at that competition. That sort of buys in to what I'm saying. Most phones aren't safe from information theft, even as a stock phone. It sounds like Android phones are an exception? That's pretty awesome knowing that it's extremely difficult to tap into the systems information (TCP/IP wise) with a stock Android device.

On the other hand, while I'm certainly not an expert on this stuff, I do recognize some basic precautions like not to bank. I am curious though, how would one go about tapping into my phone's info? What pieces need to be in place other than a rooted phone?
 
Upvote 0
dcollins23, sorry that it has taken so long to reply, but we have this new project at work which has been keeping me plenty busy.

First, there is a huge difference between having physical access to a phone, and having to perform a hack remotely, over the air. If someone can gain physical access to your phone, the sky is the limit. It will not matter whether your phone is rooted or not. Applications can be installed to 'back door' into most all mobile phone platforms.

OTA, or Over The Air access, is an entirely different beast, and it is here that I've discussed how dangerous rooting your phone can be. If you don't use your phone as a smartphone, then by all means, root away. You won't be harmed when someone steals some of your songs, pictures or videos (if they're not pron!). If however, your phone has confidential corporate data, correspondence, financial info (your Paypal or Amazon account for instance, or as I've mentioned, your banking info) you may want to think twice.

Now, I won't go into specifics about how to hack a rooted Android phone, but I will say that it would be foolish to accomplish this over a carrier's network, as your actual IP address would be logged. You would likely be traced and your identity detected by the carrier's fraud department.

Rather, the successful way to do this would be over WiFi, in an airport or Internet cafe (Starbucks, Caribou, etc). There, someone could use a laptop running a 'Live' Pentest version of Linux, their computer's MAC address spoofed to cloak their identity, in order to detect your open device and attack it, all while you blissfully surf the web or download that last minute PowerPoint presentation you will need when you visit a client. Once your phone's MAC address (a specific hardware identification specific to your device) is known, and something like a keylogger or rootkit installed, you are PWND and OWNED!
 
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones