Related
While unlocking the bootloader on a Galaxy Nexus unleashes the full potential of the bootloader, it also poses a security risk. Even with your lockscreen protected with a pattern/PIN/password, not having flashed a custom recovery, having an anti-theft app installed (maybe even converted/installed as a system app) your phone's data is easily accessible for a knowledgeable thief.
All the thief needs to do is reboot into the bootloader and boot or flash a custom recovery such as ClockWorkMod or TWRP. It's then possible to boot into recovery and use ADB commands to gain access to the phone's data on the internal memory (unless you have it encrypted) and copy/remove files at will.
Granted, the risk seems low. The thief would not only require knowledge of fastboot, he would have to turn off the phone before you have issued a wipe command using an anti-theft app. You could of course flash back the stock recovery & relock the bootloader after being done with flashing stuff, but that would require you to unlock it again if needed which will erase your userdata.
There are two ways to tackle this security risk AND retain unlocked bootloader functionality without losing userdata.
1) Encrypt your phone using Android's built-in encryption feature
Advantages:
- you can leave your bootloader unlocked & leave a custom recovery installed without risk of exposing your data.
Disadvantages:
- unless the custom recovery can decrypt your phone, you cannot use all of its features.
- when decryption fails, you cannot access your phone and need to do a factory reset from recovery. Users have reported not being able to decrypt after applying OTA updates.
- the encryption process is irreversible. The only way to return to an unencrypted phone is to perform a factory data reset which erases all your data.
2) Unlock & relock the bootloader from Android OS
Prerequisites:
- root access
- an app that can unlock/relock the bootloader at will such as BootUnlocker
Steps
Root your device using one of the many guides out there (recommended guide). Install BootUnlocker. Reflash stock recovery and lock the bootloader. Whenever you need an unlocked bootloader again, simply use Bootlocker to unlock it (this won't wipe userdata). When done, relock.
Advantages:
- doesn't require encryption (for those who do not wish to use it).
Disadvantages:
- relies on third-party apps.
- method will not work if you lose root access for whatever reason.
- method will not work when you cannot boot into Android for whatever reason.
USB debugging
Strictly not related to the bootloader, but for maximum security disable USB debugging when not required. Having it enabled allows the execution of ADB commands even if the lockscreen is still locked. Myself, I use Tasker in combination with Secure Settings to automatically enable USB debugging when my device is connected to my home WiFi access point but disabled if not connected.
The following video demonstrates what a knowledgeable thief can do with your phone when you have USB debugging enabled by default: http://www.youtube.com/watch?v=ah7DWawLax8&t=7m0s
More info: recently, an exploit has been discovered that will enable gaining root without going through the 'traditional' process of unlocking the bootloader & flashing a custom recovery in order to flash Superuser or SuperSU packages. See this post for a guide.
Play store devices
Devices bought directly from Google's Play Store apparently do NOT wipe userdata after fastboot oem unlock. So for these devices, method number 2 does not add any security. For more info, read this thread: http://forum.xda-developers.com/showthread.php?t=1650830
Very well written!!
One thing you may want to tie in to your explanation is the effect of having USB Debugging enabled - it's easy to gain root (and subsequently unlock your bootloader) with it enabled, even with a locked bootloader.
Sent from my Galaxy Nexus using Tapatalk 2
Added some information regarding USB debugging. Thanks for the tip efrant.
Good read:good:
Do you have to be on stock rom to lock the bootloader ?
Oscuras said:
Do you have to be on stock rom to lock the bootloader ?
Click to expand...
Click to collapse
Nope.
Sent from my Galaxy Nexus using Tapatalk 2
Thanks for this :good:
Trying to wrap my head around this with regards to anti theft protection etc.
Currently have an unlocked bootloader, custom rom, and root. If I have something like Cerberus or Avast running (both claim to work as system apps so will not be deleted via hard reset), have debugging unchecked and a pin lock at screen on - if I lock bootloader now, how secure am I to data theft?
Presumably, with debug disabled, fastboot from pc command prompt to unlock bootloader will not work? Can ODIN be used to flash a new ROM and if so my system apps (and thus the security apps) will be wiped, rendering the whole thing useless?
Thanks
Guiding.God said:
Thanks for this :good:
Trying to wrap my head around this with regards to anti theft protection etc.
Currently have an unlocked bootloader, custom rom, and root. If I have something like Cerberus or Avast running (both claim to work as system apps so will not be deleted via hard reset), have debugging unchecked and a pin lock at screen on - if I lock bootloader now, how secure am I to data theft?
Presumably, with debug disabled, fastboot from pc command prompt to unlock bootloader will not work? Can ODIN be used to flash a new ROM and if so my system apps (and thus the security apps) will be wiped, rendering the whole thing useless?
Thanks
Click to expand...
Click to collapse
If you have the stock recovery (custom will allow adb), your personal data is as secure as it can be. Of course, you cannot stop anybody from booting into your bootloader and run fastboot oem unlock OR use Odin to flash your device. However, doing so will effectively wipe your device so your personal data cannot be accessed.
I would more worry about my phone then data because I have nothing important on it...
Sent from my Galaxy Nexus using xda premium
Petrovski80 said:
If you have the stock recovery (custom will allow adb), your personal data is as secure as it can be. Of course, you cannot stop anybody from booting into your bootloader and run fastboot oem unlock OR use Odin to flash your device. However, doing so will effectively wipe your device so your personal data cannot be accessed.
Click to expand...
Click to collapse
qtwrk said:
I would more worry about my phone then data because I have nothing important on it...
Sent from my Galaxy Nexus using xda premium
Click to expand...
Click to collapse
Thanks for the clarification.
And I worry more about the work related data, the phone itself is insured
This is important info, and a lot of folks probably don't realize how open they are. This should be stickied or better yet included in the stickied thread where the bootloader unlock instructions are. Thanks for the post.
Great info. One question, I use Titanium Backup automated nightly to backup data and new apps, and it requires USB Debugging on.
I suppose I could use Secure Settings to turn USB Debugging on and off, but that means an opening is available once a day for a few minutes. Thoughts?
Pkt_Lnt said:
Great info. One question, I use Titanium Backup automated nightly to backup data and new apps, and it requires USB Debugging on.
I suppose I could use Secure Settings to turn USB Debugging on and off, but that means an opening is available once a day for a few minutes. Thoughts?
Click to expand...
Click to collapse
You could do as I do: use secure settings in combination with tasker so USB debugging will only be enabled when connected to your home Wifi. It will allow your nightly TiB backups, and I assume the 'ADB opening' is not an issue when at home (not many thieves there I hope).
Petrovski80 said:
You could do as I do: use secure settings in combination with tasker so USB debugging will only be enabled when connected to your home Wifi. It will allow your nightly TiB backups, and I assume the 'ADB opening' is not an issue when at home (not many thieves there I hope).
Click to expand...
Click to collapse
I downloaded Secure Settings to check it, and it will work. I have AutomateIT Pro and it does not support plug-ins. I have been finding more tasks that it seems only Tasker can perform, I guess it is time to get it. Thank you.
Petrovski80 said:
You could do as I do: use secure settings in combination with tasker so USB debugging will only be enabled when connected to your home Wifi. It will allow your nightly TiB backups, and I assume the 'ADB opening' is not an issue when at home (not many thieves there I hope).
Click to expand...
Click to collapse
Great idea.
Petrovski80 said:
You could do as I do: use secure settings in combination with tasker so USB debugging will only be enabled when connected to your home Wifi. It will allow your nightly TiB backups, and I assume the 'ADB opening' is not an issue when at home (not many thieves there I hope).
Click to expand...
Click to collapse
A Jasager router could exploit this if you have WiFi enabled in public. When WiFi is enabled and not connected to a network, every 'x' period of time (depending upon your wifi.supplicant_scan_interval setting in your build.prop) your phone will send out a packet saying "hey, is xyz network around?". It will do that for every network that you have saved settings for.
Under normal circumstances, you get no reply when away from your home router and the phone just waits the interval to try again. A Jasager ("yes man" in German) router waits for a device to send out those packets and simply responds "yep, that's me!". Under this circumstance, your phone would authenticate to their router and think it's on your home network, triggering any applicable Tasker options.
This is one of the reasons that I do not have WiFi enabled unless I actively want to be connected to a router in the area.
Also, I have USB Debugging disabled and my TiBu backups run perfectly fine according to schedule.
I am not a paranoid worry wart so the risk are more than worth it for me. There's nothing on here that I would care if some one got a hold of anyway.
Sent from my Galaxy Nexus using xda premium
Cilraaz said:
A Jasager router could exploit this if you have WiFi enabled in public. When WiFi is enabled and not connected to a network, every 'x' period of time (depending upon your wifi.supplicant_scan_interval setting in your build.prop) your phone will send out a packet saying "hey, is xyz network around?". It will do that for every network that you have saved settings for.
Under normal circumstances, you get no reply when away from your home router and the phone just waits the interval to try again. A Jasager ("yes man" in German) router waits for a device to send out those packets and simply responds "yep, that's me!". Under this circumstance, your phone would authenticate to their router and think it's on your home network, triggering any applicable Tasker options.
This is one of the reasons that I do not have WiFi enabled unless I actively want to be connected to a router in the area.
Also, I have USB Debugging disabled and my TiBu backups run perfectly fine according to schedule.
Click to expand...
Click to collapse
Maybe. Tasker checks both the SSID and the MAC address of my router before it returns 'wifi connected' as true and enables USB debugging. Sure, MAC addresses are easy to spoof, but I don't think the MAC address is part of the broadcast packet (I haven't checked) because that's simply a value stored by Tasker itself.
And even if it is, the combination of a lost/stolen GNEX and a thief who modded their router with jasager firmware + knows ADB is too unlikely for me to worry about it. But indeed, for maximum security it's best not to automate enabling of USB debugging.
Petrovski80 said:
Maybe. Tasker checks both the SSID and the MAC address of my router before it returns 'wifi connected' as true and enables USB debugging. Sure, MAC addresses are easy to spoof, but I don't think the MAC address is part of the broadcast packet (I haven't checked) because that's simply a value stored by Tasker itself.
And even if it is, the combination of a lost/stolen GNEX and a thief who modded their router with jasager firmware + knows ADB is too unlikely for me to worry about it. But indeed, for maximum security it's best not to automate enabling of USB debugging.
Click to expand...
Click to collapse
The MAC check would almost certainly keep you safe.
It's interesting stumbling across this thread after having just seen a podcast episode about Android hacking. If anyone is interested, check out Hak5. One of their recent episodes is about Android hacking via ADB, specifically something called P2PADB that was created for quick device-to-device ADB access. It was fairly amazing the things this person could do to a phone that has USB Debugging enabled.
Cilraaz said:
The MAC check would almost certainly keep you safe.
It's interesting stumbling across this thread after having just seen a podcast episode about Android hacking. If anyone is interested, check out Hak5. One of their recent episodes is about Android hacking via ADB, specifically something called P2PADB that was created for quick device-to-device ADB access. It was fairly amazing the things this person could do to a phone that has USB Debugging enabled.
Click to expand...
Click to collapse
Watching the video right now. Personally, I find it a gaping security hole that the ADB interface is accessible through a locked lockscreen.
For anyone interested in the vid: the ADB part starts at 7:00.
Edit: amazing video. It really proves what a knowledgeable thief can do when you have USB debugging enabled, especially when combined with root access (don't we all?). I'm going to add the video to my post. Thanks for the info Cilraaz!
With Samsung devices, turning on device encryption force you to use 6 characters password (alphanumeric), which is troublesome if you use your phone often.
What I found out is that after I set such password, complete the device encryption and go back to the Lock Screen setting, I can change the password to 4 digits.
Going back to encryption setting, it said I can now encrypt the device, but must use 6 characters password. But isn't my phone already encrypted? AFAIK, there is no turning off encryption once it's done.
So at this point, is my phone encrypted or not?
lanwarrior said:
With Samsung devices, turning on device encryption force you to use 6 characters password (alphanumeric), which is troublesome if you use your phone often.
What I found out is that after I set such password, complete the device encryption and go back to the Lock Screen setting, I can change the password to 4 digits.
Going back to encryption setting, it said I can now encrypt the device, but must use 6 characters password. But isn't my phone already encrypted? AFAIK, there is no turning off encryption once it's done.
So at this point, is my phone encrypted or not?
Click to expand...
Click to collapse
The phone is encrypted but like you said you cannot permanently decrypt the phone once the process is completed.
DConrad2010 said:
The phone is encrypted but like you said you cannot permanently decrypt the phone once the process is completed.
Click to expand...
Click to collapse
Thanks for the info.
I am curious why initially the device requires alphanumeric passwords (which I created), but once encryption is done, I can go back to the "Lock Screen" and change it to just numeric password. I believe this will NOT remove encryption, but for confirmation, want to check if the encryption is still there.
lanwarrior said:
Thanks for the info.
I am curious why initially the device requires alphanumeric passwords (which I created), but once encryption is done, I can go back to the "Lock Screen" and change it to just numeric password. I believe this will NOT remove encryption, but for confirmation, want to check if the encryption is still there.
Click to expand...
Click to collapse
I had to un-encrypt my phone by unrooting via Oden. Once i Odened then you have to do a factory reset and you are un-encrypted for good.
I'd like to enable Google Smartlock for passwords on my Google Pixel C, but when I was running Android N, under Settings/Security it shows my device as encrypted with no option to turn it off. So, I reloaded MM, N still has a lot of bugs I don't feel like messing with on an everyday tablet, but even under MM my device is encrypted with no option to disable it. Smartlock for passwords will not run on an encrypted device, but Google has decided to make encryption part of the OS. Is the only way around this is to unlock the bootloader and flash another ROM?
Rolldog said:
I'd like to enable Google Smartlock for passwords on my Google Pixel C, but when I was running Android N, under Settings/Security it shows my device as encrypted with no option to turn it off. So, I reloaded MM, N still has a lot of bugs I don't feel like messing with on an everyday tablet, but even under MM my device is encrypted with no option to disable it. Smartlock for passwords will not run on an encrypted device, but Google has decided to make encryption part of the OS. Is the only way around this is to unlock the bootloader and flash another ROM?
Click to expand...
Click to collapse
I never encrypt my devices so I couldn't speak about smart lock only working on encrypted devices. I know Marshmallow and up it's required for OEMs to encrypt (85% sure on that - I think it was supposed to start with Lollipop but OEMs weren't required to do so). Not that I don't believe you though, but that just seems weird for Google to "force" encryption but then allow another of their features, Smart Lock, to only work with unencrypted devices?
To answer your question - if you're running stock MM or N on a Google device, by default your data will be encrypted. The only way to decrypt would be to unlock the bootloader, format the data partition and flash a kernel that doesn't force encryption. You don't have to use another ROM per se, you just need a kernel that will keep you decrypted on your first boot.
I've no issue with smartlock on Pixel C, stock N5 and unencryted N9. I've only use trusted location - without GPS I wonder if you are having a problem with your location. Have you got "location" correctly set?
Ok, on your Pixel C, go into settings/Google, then scroll all the way to the bottom where it says Smartlock for Passwords, press it, and tell me what it says. When I do, it says, "This account uses custom passphrase encryption, which is unsupported at this time."
However, if I go to settings/security, I can enable Smart Lock, but just underneath where it says Smart Lock, it says:
Encryption
Encrypt Tablet
Encrypted
I never chose to encrypt anything, but, I guess Google uses encryption by default. Smart Lock can still be used, but Smartlock for Passwords can not.
Rolldog said:
Ok, on your Pixel C, go into settings/Google, then scroll all the way to the bottom where it says Smartlock for Passwords, press it, and tell me what it says. When I do, it says, "This account uses custom passphrase encryption, which is unsupported at this time."
However, if I go to settings/security, I can enable Smart Lock, but just underneath where it says Smart Lock, it says:
Encryption
Encrypt Tablet
Encrypted
I never chose to encrypt anything, but, I guess Google uses encryption by default. Smart Lock can still be used, but Smartlock for Passwords can not.
Click to expand...
Click to collapse
Sorry misunderstood. I think the answer is that using your own passphrase disables Smartlock on Android see: https://support.google.com/chrome/answer/1181035?p=settings_encryption&rd=1
"Some Google features will not be available after you set a sync passphrase
Google Now won’t show suggestions based on sites you browse in Chrome.
You won't be able to view your saved passwords on https://passwords.google.com or use Smart Lock for Passwords on Android.
Your history won't sync across devices. Web sites or URLs that you type in the address bar in Chrome will still sync."
Setting for Google/custom passphrase in chrome browser at chrome://settings/syncSetup
The strange thing is I don't use a custom passphrase, all of my information does sync between all of my devices, and I get Google Now cards based off my search history. However, last night, when I logged into an app, Smartlock for Passwords popped up and asked me if I wanted to save this password, so I guess it's working now. It still shows my tablet as encrypted, so I imagine it's just a bug.
Hey guys -
Need some detective help. I did something to my 10, and I think I did something with the encryption, but I'm not sure how or what.
Follow me here, since I'm not sure what caused it, I'll start at the beginning, and see if anything raises a red flag..
Got phone from HTC, US unlocked version. Got it in.. heck, this past June, I think.
Unlocked bootloader. Got Sunshine, ran it, but never paid and never turned S-OFF.
Never set PIN or Fingerprint.
Installed Viper10 when it was out.
Went to do fingerprint. Got screen saying that for backup, needed to set PIN. Set PIN, then taught it some fingerprints.
Never had data issues, and as far as I know, never encrypted phone. TWRP, when run, did not need me to enter any password or key to access the phone. On bootup, would get PIN prompt, but AFTER Android loaded.
Never got any RUUs, never upgraded Viper10.
Installed CM13 today. Whohoo!
Install went fine, no issues. Restored apps from TiBu, deleted unused bloatware, including the built-in Android keyboard.
Set up other options, and finally got to enter in fingerprints.
It gives me the same screen I got on Viper. This time, though (and I have no idea why), I back out back to Security settings, and enter in PIN there.
Then train fingerprints!
Now, when I reboot system, or boot to TWRP, I get a prompt asking for password (TWRP) or PIN (Android). HOWEVER.. I can enter my pin in TWRP just fine. But not Android. Apparently, since it hasn't booted, Swype doesn't work, and I get no keyboard. Can't enter PIN in at all.
That is my mistake, however, as I removed the built-in Android keyboard. (Something I've done countless times before on other Android versions without issue..)
So I restore Nandroid backup of Viper10. I still get the PIN entry, and STILL have no keyboard.
I see reference in TWRP about PINs not working, so I delete that locksettings.db file (from memory, filename is likely wrong here..)
Phone boots up. Yay. No PIN prompt. Yay.
But now I do NOT have data - as in, it's acting like my phone is unencrypted now.
So, what I'd like to know is -
If NOW my phone is unencrypted, and I'm getting the 'No Data' issue, what was my phone doing BEFORE, when I didn't have to enter PIN, but was getting data?
How can I get BACK to not having to enter PIN and still get data? (In my case, will the instructions for unencrypted work? Or is my phone now 'special'?)
How did I set the PIN the first time on Viper10, and not have it encrypt my phone? I'd like to ultimately get back to THAT scenario - where the lockscreen asks for PIN, but nothing else does (TWRP, Bootup, etc).
Thanks guys!
-Mike
I may be pointing the obvious, but have you do a full wipe before restoring your nandroid? If so, did you try to clean flash your rom to see what happens?
Maybe by removing stock keyboard something got messed up and keeps the keyboard in your nandroid from properly installing.
Yup, I tried restoring the Nandroid several times, some with wiping, some without. Also, I always clean-flash my new ROMs (i.e. ones not restored from nandroid backup, installed new, like going from Viper10 -> CM13)
Going to try again today while at work, see what happens.
During setup in CM13, there should be option to require PIN at startup (It is usually checked by default). Uncheck it and your phone will remain encrypted without requiring a PIN to start.
jackebuehner said:
During setup in CM13, there should be option to require PIN at startup (It is usually checked by default). Uncheck it and your phone will remain encrypted without requiring a PIN to start.
Click to expand...
Click to collapse
Technically correct (encrypted) but effectively incorrect: encryption is moot if a password is not required to decrypt it. It would be like locking your door and leaving the key in it: it's locked but it's not secure.
You need a system keyboard to be able to enter PIN on bootup; hence, the pre-installed keyboard (Google on vanilla, TouchPal on htc) isn't really 'bloatware' as it's necessary. Google makes a good keyboard; TouchPal, though, yeah, necessary bloatware in this case.
Rolo42 said:
Technically correct (encrypted) but effectively incorrect: encryption is moot if a password is not required to decrypt it. It would be like locking your door and leaving the key in it: it's locked but it's not secure.
Click to expand...
Click to collapse
Ah, so in previous ROMs (both OEM and Viper10, it technically WAS encrypted, I just never set the password? .. Huh.
Rolo42 said:
You need a system keyboard to be able to enter PIN on bootup; hence, the pre-installed keyboard (Google on vanilla, TouchPal on htc) isn't really 'bloatware' as it's necessary. Google makes a good keyboard; TouchPal, though, yeah, necessary bloatware in this case.
Click to expand...
Click to collapse
Interesting, thanks for this; good to know. A shame, but good to know that's just how it is.
coyttl said:
Ah, so in previous ROMs (both OEM and Viper10, it technically WAS encrypted, I just never set the password? .. Huh.
Interesting, thanks for this; good to know. A shame, but good to know that's just how it is.
Click to expand...
Click to collapse
Correct. The password is to get at the encryption key; it isn't the encryption key itself.
Bitlocker/SED works the same way. Otherwise, a password change would mean re-encrypting everything.
If you put in the wrong password, it'll look like you have no data.
Hey guys,
I have always had my op3 encrypted and I've become used to always entering the pin when booting up, accessing twrp etc. but today when I rebooted into twrp I didn't have to enter any pin to use twrp. When booting up the system I didn't have to enter a pin either.
When I check the settings under Security & Fingerprint it looks as in the attached screenshot, I don't have any options to decrypt or anything either
I'm running OOS 4.1.3, FrancoKernel #23 , Magisk 12, twrp-3.1.0-x_blu_spark_v27.
Is this something that anyone has experienced and know how to fix?
I want to keep my encryption but then, of course, you should have to use the pin.
Cheers!
Then the pin is defaulted and thus you don't need any. I don't need one, too and never did, but all is encrypted (Even locked down with a pin on bootup and fingerprint otherwise)
I believe this is an option you need to setup during the wizard when you initially set up the device. It asks you whether you want to require a pin on startup or not.
But, you can also turn this on by going to settings>security>screen lock.
From there, you click on the area where it says PIN. Confirm your pin, then click PIN again, and there should be an option to require pin for startup. Other than that, you are still encrypted, but it is all bypassed in order for quicker startup.
Sent from my ONEPLUS 3 using Tapatalk
noobtoob said:
I believe this is an option you need to setup during the wizard when you initially set up the device. It asks you whether you want to require a pin on startup or not.
But, you can also turn this on by going to settings>security>screen lock.
From there, you click on the area where it says PIN. Confirm your pin, then click PIN again, and there should be an option to require pin for startup. Other than that, you are still encrypted, but it is all bypassed in order for quicker startup.
Sent from my ONEPLUS 3 using Tapatalk
Click to expand...
Click to collapse
Ah that was it! it had somehow disabled itself, simply going in and enabling "require pin to start device" solved it.
Thanks!
Try removing the lock screen password and setting it up again and it will be back again in twrp.?