Developing a Framework & Standard Operating Procedure (SOP) for Mobile Device Rooting / Jailbreak.

Jailbreaking and rooting are basically one and the same concept. Jailbreaking is considered as rooting by Android users. We are going to explore the Standard Operating Procedure (SOP) for Mobile Device Rooting / Jailbreak.

How Rooting Works – A Clarification of the Android Rooting Process

Jailbreaking and Rooting are one and the same thing. In essence, jailbreaking is considered as rooting by Android users. According to Jjiggunjer (2015) Jailbreak and rooting are usually the same procedures though not identical from an abstract process perspective. In essence, Jailbreaking means getting around the bootloader and later getting the admin rights, whilst rooting entails decently getting some privileges. Additionally, gain in the privileges is considered perhaps higher with the jailbreaking since sideloading is previously permitted with the Android devices.

Generally, rooting is considered as a process of accessing root entree to the basic Linux system under the Android and therefore getting total or full control over software running or operating on the Android phone. Some examples of superior access include the unmounting and mounting systems, beginning one particular favorite HTTP or SSH or DNS or DHCP or the proxy server as well as killing the system process. The capacity of running the arbitrary commands in the Android devices such as root user permits an individual to carry out anything on the Android or Linux system.The following sections explain the framework for which an Android smartphone can be rooted.

The Bootloader as well as Recovery Process

The bootloader is usually the first step of coding which is carried out whenever a particular phone is switched on and is its main function is loading recovery and Android operating system as well as flashing the new ROM. Basically, some of the bootloaders are considered unlocked in case the users could boot and flash the arbitrary ROMS without any hacking going on. Unluckily, a good number of the Android phones possess locked bootloaders which individuals would be forced to hack to make enable them to carry out any function other than booting stock ROM. On a typical Samsung device, by invoking a particular arrangement of the keys and connecting the device to the laptop or computerized device, it would be easier to flash any form of the custom ROM utilizing Samsung’s functions without circumventing any form of security appliances. System recovery is usually considered as low-level coding on any particular Android phone. This is different from Android user-lands and is said to be generally situated on its panels; that is, it is generally booted by bootloader whenever an individual presses the particular combination of the keys. Furthermore, it is considered as an independent program where the Android and Linux user-terrestrial is not necessarily loader whenever booted in the recovery. It is also a first OS which has full control over other systems and would perform any function as long the codes to perform the process are usually built-in. The stock recovery differs with producers, though regularly comprises of the functionalities such as such as flashing up to date ROM or reformatting data partition signed by the manufacturer.

ADB (Android Debug Bridge)

The ADB permits the Mac or PC to connect to the Android phone and carry out particular functions. The most common function is launching simple shell using ADB shell command which is available via Android Studio which installs Android SDK under the AppData folder of the current user. The ADB shell would run the commands unprivileged or privileged users depending on the value of the to secure which is equal to 0 or 1. Subjects of root index are generally copy-pasted from the partition within the storage on the boot, though an individual could not write to partition in case the device is not necessarily rooted. Generally, such property denies the root admittance through the ADB, and one of the only means to the variation is by accessing the root admission or entrance making the Android device more secure.

The Android UI

All appliances on the Android system usually run as the unprivileged users within the sandbox. Programs operating as unprivileged could not operate another program which is operating as privileged. Conversely, the program operating as the root could operate other programs as the root or as unprivileged users. Further, on the Linux system, the privileged escalations are generally achieved through sudo as well as sun programs. Applications labeled as requiring the root are only fulfilling the other programs through us. On the other hand, the stock OEM ROMs does not accompany these. One could not download this or copy them over; this calls for the presence of its SUID bit that shows the system that programs have room for escalating their runtime privileges to the root. This implies that only the programs which could interact with the Android and running in the unprivileged model are unable to start other programs executing in the privileged model or gain the free admittance and implementing in the privileged model. In case of such holds, Android devices are more immune to the free escalation trials.

Rooting a locked bootloader

If the device has an unlocked bootloader, flashing an arbitrary ROM will essentially pull all stock ROMs from Android devices, add a sub, as well as repackage them in the reformed ROM. Besides, one should switch off the Android device, then press specific combination keys in starting the devices in the flashing mode where Samsung utilities would flash adjusted ROM on the device. Certain manufacturers do not set ro.secure to 1, so it is easier to root by plugging Android devices in run ADB as well as in a computer, and the shell will pop to implement any form of the program as the root. With locked bootloaders and ro.secure set as 1, the only way is to experiment by typing or coding ps on the Android shell, which would operate as the root since it requires starting the other privileged models. This will spawn the device procedures in operating in the privileged model to implement preferred arbitrary codes. Thus, setting the precedence for susceptibilities within the device processes operating as the root would permit an individual to implement the arbitrary codes as the roots.

 

Author: Tan Kian Hua, Ph.D. student at LIGS University

 

Bibliography

Chuan Ji, Oct 19, 2011, Tags: Android, Featured, Retrieved from

https://seasonofcode.com/posts/how-rooting-works-a-technical-explanation-of-the-android-rooting-process.html

Srinivasa Rao Kotipalli, Mohammed A. Imran, (2016, July). Hacking Android. Chapter 2: Android Rooting

Suktika Mukhopadhyay, Brandon Clark, Talha Tariq, Luca De Fulgentis; Title of article. Dangers of Jailbreaking and Rooting Mobile Devices. Retrieved from https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Dangers_of_Jailbreaking_and_Rooting_Mobile_Devices

Kunal Relan (2016) iOS Penetration Testing - A Definitive Guide to iOS Security, page range. 31-39

Suktika Mukhopadhyay, Brandon Clark, Talha Tariq, Luca De Fulgentis (27 June 2015). Projects/OWASP Mobile Security Project - Dangers of Jailbreaking and Rooting Mobile Devices. Retrieved from

https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Dangers_of_Jailbreaking_and_Rooting_Mobile_Devices

Jim Swauger, Jim Hawke, Retrieved from

http://www.binaryintel.com/services/jtag-chip-off-forensics/jtag-forensics/

Oleg Afonin, Vladimir Katalov (September 2016). Mobile Forensics – Advanced Investigative Strategies.