Develop Bugs

[INFO] Understanding the risks of having an unlocked bootloader

While unlocking the bootloader on a Galaxy Nexus unleashes the full potential of the bootloader, it also poses a security risk. Even with your lockscreen protected with a pattern/PIN/password, not having flashed a custom recovery, having an anti-theft app installed (maybe even converted/installed as a system app) your phone's data is easily accessible for a knowledgeable thief.
All the thief needs to do is reboot into the bootloader and boot or flash a custom recovery such as ClockWorkMod or TWRP. It's then possible to boot into recovery and use ADB commands to gain access to the phone's data on the internal memory (unless you have it encrypted) and copy/remove files at will.
Granted, the risk seems low. The thief would not only require knowledge of fastboot, he would have to turn off the phone before you have issued a wipe command using an anti-theft app. You could of course flash back the stock recovery & relock the bootloader after being done with flashing stuff, but that would require you to unlock it again if needed which will erase your userdata.
There are two ways to tackle this security risk AND retain unlocked bootloader functionality without losing userdata.
1) Encrypt your phone using Android's built-in encryption feature
Advantages:
- you can leave your bootloader unlocked & leave a custom recovery installed without risk of exposing your data.
Disadvantages:
- unless the custom recovery can decrypt your phone, you cannot use all of its features.
- when decryption fails, you cannot access your phone and need to do a factory reset from recovery. Users have reported not being able to decrypt after applying OTA updates.
- the encryption process is irreversible. The only way to return to an unencrypted phone is to perform a factory data reset which erases all your data.
2) Unlock & relock the bootloader from Android OS
Prerequisites:
- root access
- an app that can unlock/relock the bootloader at will such as BootUnlocker
Steps
Root your device using one of the many guides out there (recommended guide). Install BootUnlocker. Reflash stock recovery and lock the bootloader. Whenever you need an unlocked bootloader again, simply use Bootlocker to unlock it (this won't wipe userdata). When done, relock.
Advantages:
- doesn't require encryption (for those who do not wish to use it).
Disadvantages:
- relies on third-party apps.
- method will not work if you lose root access for whatever reason.
- method will not work when you cannot boot into Android for whatever reason.
USB debugging
Strictly not related to the bootloader, but for maximum security disable USB debugging when not required. Having it enabled allows the execution of ADB commands even if the lockscreen is still locked. Myself, I use Tasker in combination with Secure Settings to automatically enable USB debugging when my device is connected to my home WiFi access point but disabled if not connected.
The following video demonstrates what a knowledgeable thief can do with your phone when you have USB debugging enabled by default: http://www.youtube.com/watch?v=ah7DWawLax8&t=7m0s
More info: recently, an exploit has been discovered that will enable gaining root without going through the 'traditional' process of unlocking the bootloader & flashing a custom recovery in order to flash Superuser or SuperSU packages. See this post for a guide.
Play store devices
Devices bought directly from Google's Play Store apparently do NOT wipe userdata after fastboot oem unlock. So for these devices, method number 2 does not add any security. For more info, read this thread: http://forum.xda-developers.com/showthread.php?t=1650830

Very well written!!
One thing you may want to tie in to your explanation is the effect of having USB Debugging enabled - it's easy to gain root (and subsequently unlock your bootloader) with it enabled, even with a locked bootloader.
Sent from my Galaxy Nexus using Tapatalk 2

Added some information regarding USB debugging. Thanks for the tip efrant.

Good read:good:

Do you have to be on stock rom to lock the bootloader ?

Oscuras said:
Do you have to be on stock rom to lock the bootloader ?
Click to expand...
Click to collapse
Nope.
Sent from my Galaxy Nexus using Tapatalk 2

Thanks for this :good:
Trying to wrap my head around this with regards to anti theft protection etc.
Currently have an unlocked bootloader, custom rom, and root. If I have something like Cerberus or Avast running (both claim to work as system apps so will not be deleted via hard reset), have debugging unchecked and a pin lock at screen on - if I lock bootloader now, how secure am I to data theft?
Presumably, with debug disabled, fastboot from pc command prompt to unlock bootloader will not work? Can ODIN be used to flash a new ROM and if so my system apps (and thus the security apps) will be wiped, rendering the whole thing useless?
Thanks

Guiding.God said:
Thanks for this :good:
Trying to wrap my head around this with regards to anti theft protection etc.
Currently have an unlocked bootloader, custom rom, and root. If I have something like Cerberus or Avast running (both claim to work as system apps so will not be deleted via hard reset), have debugging unchecked and a pin lock at screen on - if I lock bootloader now, how secure am I to data theft?
Presumably, with debug disabled, fastboot from pc command prompt to unlock bootloader will not work? Can ODIN be used to flash a new ROM and if so my system apps (and thus the security apps) will be wiped, rendering the whole thing useless?
Thanks
Click to expand...
Click to collapse
If you have the stock recovery (custom will allow adb), your personal data is as secure as it can be. Of course, you cannot stop anybody from booting into your bootloader and run fastboot oem unlock OR use Odin to flash your device. However, doing so will effectively wipe your device so your personal data cannot be accessed.

I would more worry about my phone then data because I have nothing important on it...
Sent from my Galaxy Nexus using xda premium

Petrovski80 said:
If you have the stock recovery (custom will allow adb), your personal data is as secure as it can be. Of course, you cannot stop anybody from booting into your bootloader and run fastboot oem unlock OR use Odin to flash your device. However, doing so will effectively wipe your device so your personal data cannot be accessed.
Click to expand...
Click to collapse
qtwrk said:
I would more worry about my phone then data because I have nothing important on it...
Sent from my Galaxy Nexus using xda premium
Click to expand...
Click to collapse
Thanks for the clarification.
And I worry more about the work related data, the phone itself is insured

This is important info, and a lot of folks probably don't realize how open they are. This should be stickied or better yet included in the stickied thread where the bootloader unlock instructions are. Thanks for the post.

Great info. One question, I use Titanium Backup automated nightly to backup data and new apps, and it requires USB Debugging on.
I suppose I could use Secure Settings to turn USB Debugging on and off, but that means an opening is available once a day for a few minutes. Thoughts?

Pkt_Lnt said:
Great info. One question, I use Titanium Backup automated nightly to backup data and new apps, and it requires USB Debugging on.
I suppose I could use Secure Settings to turn USB Debugging on and off, but that means an opening is available once a day for a few minutes. Thoughts?
Click to expand...
Click to collapse
You could do as I do: use secure settings in combination with tasker so USB debugging will only be enabled when connected to your home Wifi. It will allow your nightly TiB backups, and I assume the 'ADB opening' is not an issue when at home (not many thieves there I hope).

Petrovski80 said:
You could do as I do: use secure settings in combination with tasker so USB debugging will only be enabled when connected to your home Wifi. It will allow your nightly TiB backups, and I assume the 'ADB opening' is not an issue when at home (not many thieves there I hope).
Click to expand...
Click to collapse
I downloaded Secure Settings to check it, and it will work. I have AutomateIT Pro and it does not support plug-ins. I have been finding more tasks that it seems only Tasker can perform, I guess it is time to get it. Thank you.

Petrovski80 said:
You could do as I do: use secure settings in combination with tasker so USB debugging will only be enabled when connected to your home Wifi. It will allow your nightly TiB backups, and I assume the 'ADB opening' is not an issue when at home (not many thieves there I hope).
Click to expand...
Click to collapse
Great idea.

Petrovski80 said:
You could do as I do: use secure settings in combination with tasker so USB debugging will only be enabled when connected to your home Wifi. It will allow your nightly TiB backups, and I assume the 'ADB opening' is not an issue when at home (not many thieves there I hope).
Click to expand...
Click to collapse
A Jasager router could exploit this if you have WiFi enabled in public. When WiFi is enabled and not connected to a network, every 'x' period of time (depending upon your wifi.supplicant_scan_interval setting in your build.prop) your phone will send out a packet saying "hey, is xyz network around?". It will do that for every network that you have saved settings for.
Under normal circumstances, you get no reply when away from your home router and the phone just waits the interval to try again. A Jasager ("yes man" in German) router waits for a device to send out those packets and simply responds "yep, that's me!". Under this circumstance, your phone would authenticate to their router and think it's on your home network, triggering any applicable Tasker options.
This is one of the reasons that I do not have WiFi enabled unless I actively want to be connected to a router in the area.
Also, I have USB Debugging disabled and my TiBu backups run perfectly fine according to schedule.

I am not a paranoid worry wart so the risk are more than worth it for me. There's nothing on here that I would care if some one got a hold of anyway.
Sent from my Galaxy Nexus using xda premium

Cilraaz said:
A Jasager router could exploit this if you have WiFi enabled in public. When WiFi is enabled and not connected to a network, every 'x' period of time (depending upon your wifi.supplicant_scan_interval setting in your build.prop) your phone will send out a packet saying "hey, is xyz network around?". It will do that for every network that you have saved settings for.
Under normal circumstances, you get no reply when away from your home router and the phone just waits the interval to try again. A Jasager ("yes man" in German) router waits for a device to send out those packets and simply responds "yep, that's me!". Under this circumstance, your phone would authenticate to their router and think it's on your home network, triggering any applicable Tasker options.
This is one of the reasons that I do not have WiFi enabled unless I actively want to be connected to a router in the area.
Also, I have USB Debugging disabled and my TiBu backups run perfectly fine according to schedule.
Click to expand...
Click to collapse
Maybe. Tasker checks both the SSID and the MAC address of my router before it returns 'wifi connected' as true and enables USB debugging. Sure, MAC addresses are easy to spoof, but I don't think the MAC address is part of the broadcast packet (I haven't checked) because that's simply a value stored by Tasker itself.
And even if it is, the combination of a lost/stolen GNEX and a thief who modded their router with jasager firmware + knows ADB is too unlikely for me to worry about it. But indeed, for maximum security it's best not to automate enabling of USB debugging.

Petrovski80 said:
Maybe. Tasker checks both the SSID and the MAC address of my router before it returns 'wifi connected' as true and enables USB debugging. Sure, MAC addresses are easy to spoof, but I don't think the MAC address is part of the broadcast packet (I haven't checked) because that's simply a value stored by Tasker itself.
And even if it is, the combination of a lost/stolen GNEX and a thief who modded their router with jasager firmware + knows ADB is too unlikely for me to worry about it. But indeed, for maximum security it's best not to automate enabling of USB debugging.
Click to expand...
Click to collapse
The MAC check would almost certainly keep you safe.
It's interesting stumbling across this thread after having just seen a podcast episode about Android hacking. If anyone is interested, check out Hak5. One of their recent episodes is about Android hacking via ADB, specifically something called P2PADB that was created for quick device-to-device ADB access. It was fairly amazing the things this person could do to a phone that has USB Debugging enabled.

Cilraaz said:
The MAC check would almost certainly keep you safe.
It's interesting stumbling across this thread after having just seen a podcast episode about Android hacking. If anyone is interested, check out Hak5. One of their recent episodes is about Android hacking via ADB, specifically something called P2PADB that was created for quick device-to-device ADB access. It was fairly amazing the things this person could do to a phone that has USB Debugging enabled.
Click to expand...
Click to collapse
Watching the video right now. Personally, I find it a gaping security hole that the ADB interface is accessible through a locked lockscreen.
For anyone interested in the vid: the ADB part starts at 7:00.
Edit: amazing video. It really proves what a knowledgeable thief can do when you have USB debugging enabled, especially when combined with root access (don't we all?). I'm going to add the video to my post. Thanks for the info Cilraaz!

[Q] S4 mini locked, forgot password

My second cousin has forgot his GT-I9190 lock screen password. He doesn't really care about doing a factory reset but he wants to save some data first.
Problem is, making it different from the many other cases of getting the device locked, is that this phone has no practical "advanced user options" enabled. That is, no USB debugging, no root, locked bootloader (hence stock ROM) and so on. Normally when people encounter this situation they have SOME of the above, but we don't.
Possible solution I've thought about:
If I had ADB access, I could copy the whatsapp .db.crypt7 files and the photos and that would be enough.
If I had ABD access + root, I could just edit Android's database and disable the lock screen.
If I had any recovery, I could traverse the filesystem and take everything I want. Even a dump of it would be fine, to walk over it with an external tool.
Flash ANYTHING (without deleting data, tho). But can't do, locked bootloader.
View the files in windows explorer, but Android doesn't show anything there because it's locked.
NONE of these can be done.
What can I do about it? Is there any practical, not too complicated solution for this? I just want the files at /sdcard, then the phone can be wiped.
Thanks

Wipe w/broken screen

So I have a busted screen, and due to work email and such, I'd like to wipe the phone before sending it back. I have attempted to navigate the factory reset with the buttons with no success. Any suggestions? The phone is factory unlocked.
Help is much appreciated!

ReMMy1100 said:
So I have a busted screen, and due to work email and such, I'd like to wipe the phone before sending it back. I have attempted to navigate the factory reset with the buttons with no success. Any suggestions? The phone is factory unlocked.
Help is much appreciated!
Click to expand...
Click to collapse
You have a few options.
Get the screen fixed.
Buy an mhl cable and show the screen on a TV, do what you like from there.
Not 100% but try adb commands through a PC and see if there is one to wipe the phone.
Again not 100% but you could use USB OTG to communicate and type in the code within the dialer to wipe the phone.
Flash an ruu, this should nuke the devices memory AFAIK.
There are probably more ways but they're what I would try first.
Or change your password on your work email, if you use a client like good, you can remove it from the device and the password will stop people entering it anyway, not to mention that its sandboxed.
If you have a password (pattern or pin) and you're rooted then you can easily remove them from TWRP recovery by deleting one file, however would the people who get the broken phone go to those lengths?
Hope this helps.

Urgent, bypass pincode possible?

My father in law died last weekend and we don't know the pincode of his stock Nexus 5X. We can access his Google account and we know the pincode of his sim card. I hope someone can help us out to get access to his phone. Things we've tried:
- The vingerprint reader was setup but we've tried a lot of possible pins. We've tried his vinger yesterday but because of the attempts the pin is also required now.
- With a pattern lock you'll get a possibility to unlock through the Google account password after some attempts but his phone was secured with a vingerprint and/or pincode. Only the delay between attempts get increased, currently 16 minutes between them.
- The lock option from https://www.google.com/android/devicemanager, but because there is already a pin lock it doesn't work. The pin doesn't change.
- I've tried to access the phone through ADB, booted into the recovery but "adb devices" doesn't see the phone. When I choose to "install update through adb" I see the devices with "adb devices" but I can't use "adb shell", only sideloading works.
- Installing a custom recovery could work but the bootloader is locked, when I unlock it a full wipe will be performed so we still can't access the data.
- From the Play store in the browser on my Mac I've installed the androidlost.com app on the phone, but the app needs to be opened once before it can be used.
- A rubber ducky could help us out, but I don't have one and the time between attempts get increased and increased... it would take weeks, months or years to unlock.
What other possibilities do I have?

First sorry for your lost!
Second, i don´t know for sure, but maybe get the phone to the store where you bought it and explain the situation, maybe they will give a correct advice or like you said the phone is registed in google ( device manager) maybe if you contact them they will help you with that ( the problem is they probably will take a long time to reply or don´t reply at all) or wait for a more expert user than me here in xda,
again, sorry for your lost and hope you solve this problem,
cheers

If the phone was rooted with a recovery installed, YES, you could delete the passcode files and get into it, without root/recovery, you cannot get into it without the password, that is the point of encryption and passwords and all that jazz.... Yes there is probably a way for some high level hacker to do it but good luck finding that.... If you just want to be able to USE the phone, do a factory reset from recovery....

Help, my firestick has no network capability

Hi everyone
i my friend gave me his firestick 4k the other day because he has managed to mess it up big time
He said that he followed a tech docter youtube video to sideload an app to remove bloatware, after being successful at this, he then used an app that clears your cache and closes all the apps for you, from what i can understand it sounded like the app "cleanmaster"
after doing that he immediately lost his internet connection, he said that there wasnt even a network section anymore, just a troubleshooting option, he then factory reset his stick but this didnt solve anything
ive got the stick setup now, ive looked in the network section and he was right, theres nothing, even in the my fire tv section where you can see the ip/mac/ssid etc, they all say "not connected"
ill attach pictures
Im willing to flash this somehow, or root it, install cfw anything, please help!

Try:
Select Settings > Network from the Fire TV menu, then Play/Pause on your remote, and follow the recommended steps.
If that doesn't work maybe reset the stick again.
I know one of the settings in the debloat tool turns off the ability to see new networks, resetting should have reenabled that switch.

carpenter940 said:
Try:
Select Settings > Network from the Fire TV menu, then Play/Pause on your remote, and follow the recommended steps.
If that doesn't work maybe reset the stick again.
I know one of the settings in the debloat tool turns off the ability to see new networks, resetting should have reenabled that switch.
Click to expand...
Click to collapse
Thanks for replying, pressing play/pause does nothing, as you can see there is nothing on the network page at all except the troubleshoot option
Factory reset doesn't work at all, doing a factory reset from the my fire tv section just makes you go back to the settings menu, using the back and right button combo does nothing either, even if you wait for the countdown to end
When he gave me the stick he had already factory reset it so there are no apps on here at all including this bloatware one you mentioned, nothing

stickpirate77 said:
Doing a factory reset
there are no apps on here at all including this bloatware one you mentioned, nothing
Click to expand...
Click to collapse
Head to the unlock, root, twrp, unbrick thread here :
[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 4K (mantis)
NOTE: There have been multiple reports of devices with serial numbers containing VM190 or higher being shipped with DL-Mode disabled in BROM. These devices cannot be unlocked using kamakiri. These devices do not show up at all on USB when...
forum.xda-developers.com
If you have a stick that is from 2019 you can fix it by unlocking it and installing another firmware. This will also give you root privileges.
Regards

Bertonumber1 said:
Head to the unlock, root, twrp, unbrick thread here :
[UNLOCK][ROOT][TWRP][UNBRICK] Fire TV Stick 4K (mantis)
NOTE: There have been multiple reports of devices with serial numbers containing VM190 or higher being shipped with DL-Mode disabled in BROM. These devices cannot be unlocked using kamakiri. These devices do not show up at all on USB when...
forum.xda-developers.com
If you have a stick that is from 2019 you can fix it by unlocking it and installing another firmware. This will also give you root privileges.
Regards
Click to expand...
Click to collapse
How can I do this please? Keep in mind the stick doesn't display an IP address

stickpirate77 said:
How can I do this please? Keep in mind the stick doesn't display an IP address
Click to expand...
Click to collapse
This post may explain better mate :
[NEWBIE GUIDE] How to Unlock Bootloader/Root and install Addons FireStick 4k
None of this is my work and all recognition goes to the awesome developers that made this possible, I will link their guides in here with some minor notes for newbies like me that may had some issues trying to unlock and root the Fire Stick (FS)...
forum.xda-developers.com
It doesn't have to show ip address, follow the thread carefully. It involves opening up the stick, connecting it to pc (via the power cable) and shorting a resistor.
This will unlock the stick and let you flash brand new firmware. It's the only way to do it if your factory reset isn't working I'm afraid.
Regards

Thankyou for this fantastic response, when I've got spare time and the balls to try it I'll dive in, seems complicated but I'll give it a good go

stickpirate77 said:
Thankyou for this fantastic response, when I've got spare time and the balls to try it I'll dive in, seems complicated but I'll give it a good go
Click to expand...
Click to collapse
don't unlock your stick, use any of the method
Method 1:
reinstall the app again and turn on wifi, the wifi on the stick is disabled.
Method 2:
take out your stick, connect to your pc
wait for it boot
enter
adb devices
​if it says "unauthorized"
press "Down" on remote two times​and press "select" to authorize your pc​​when it says "device"
enter​adb shell​svc wifi enable​
if you get "killed" error then go for method 3
Unplug your stick from PC and connect to your TV.
Method 3
Install the apk on your stick, then click on "Enable"
It will also tell you if your Wifi is disabled or not.
This app can TURN ON and TURN OFF the WIFI
Here's a proof

Hi I'm trying method 2 at the moment, but if it doesn't work how do I install the WiFi enabler APK without having WiFi?

stickpirate77 said:
Hi I'm trying method 2 at the moment, but if it doesn't work how do I install the WiFi enabler APK without having WiFi?
Click to expand...
Click to collapse
you can install the apk using adb
adb install "Wifi Enabler.apk"

Legendary! It worked! Thankyou so much, how do I mark this thread as solved? I'm new to this forum

stickpirate77 said:
Legendary! It worked! Thankyou so much, how do I mark this thread as solved? I'm new to this forum
Click to expand...
Click to collapse
You can close the thread but you'll have to contact the forum maintainer, which isn't necessary, just click the under post #8.

SweenWolf said:
You can close the thread but you'll have to contact the forum maintainer, which isn't necessary, just click the under post #8.
Click to expand...
Click to collapse
I've run into the next problem, I've installed the debloat tool, I've re enabled everything to try and clean up the mess my friend made, but when I try and deregister the stick it just goes straight back to settings, is there anything else I can do here? (he said I can have the stick now as he has a new one)

stickpirate77 said:
I've run into the next problem, I've installed the debloat tool, I've re enabled everything to try and clean up the mess my friend made, but when I try and deregister the stick it just goes straight back to settings, is there anything else I can do here? (he said I can have the stick now as he has a new one)
Click to expand...
Click to collapse
What do you mean be goes back to settings?

SweenWolf said:
What do you mean be goes back to settings?
Click to expand...
Click to collapse
I click on settings, my account, Amazon account, deregister, deregister.....
Nothing happens and I'm kicked back to the settings bar highlighting my account again

stickpirate77 said:
I click on settings, my account, Amazon account, deregister, deregister.....
Nothing happens and I'm kicked back to the settings bar highlighting my account again
Click to expand...
Click to collapse
Look, sorry for the issues, you have to do some steps.
Connect your pc to stick (using wifi)
adb connect IP:5555
then adb shell
then enter
pm list packages -d
And send me the output

SweenWolf said:
Look, sorry for the issues, you have to do some steps.
Connect your pc to stick (using wifi)
adb connect IP:5555
then adb shell
then enter
pm list packages -d
And send me the output
Click to expand...
Click to collapse
I typed ADB connect IP:5555
it said unable to connect

stickpirate77 said:
I typed ADB connect IP:5555
it said unable to connect
Click to expand...
Click to collapse
Reboot your stick (Long press "Play/Pause + Select" for few seconds)
Try deregistering, is result is same, go to developers options, turn it off and then on again.
Go to network section of the stick copy the ip address.
Then go to your pc, (make sure your Stick and PC are on same wifi network)
Enter
adb disconnect
adb connect ip:5555
Here ip is the ip address of your stick
Eg adb connect 192.168.43.123:5555
It should connect

stickpirate77 said:
I typed ADB connect IP:5555
it said unable to connect
Click to expand...
Click to collapse
Got it to connect

stickpirate77 said:
Got it to connect
Click to expand...
Click to collapse
In the shell
Enter
pm enable com.amazon.tv.oobe
pm enable com.amazon.aria
Then reboot and you will be able to deregister
Main one is oobe but enable both of them