Forgot your password?
typodupeerror
Cellphones Handhelds Hardware

T-Mobile G1 Rooted 246

Posted by CmdrTaco
from the that-didn't-take-long dept.
An anonymous reader writes "T-Mobile's G1 phone, the first commercially available Android based phone, has been rooted. The exploit is extremely simple to execute, just requiring you to run telnetd from a terminal on the phone, and then connecting to the phone via telnet."
This discussion has been archived. No new comments can be posted.

T-Mobile G1 Rooted

Comments Filter:
  • Rooted? (Score:5, Funny)

    by earthcreed (1292180) on Wednesday November 05, 2008 @11:40AM (#25642461) Homepage
    This just in, all machines that you have root access on rooted! If you have access to run telnetd you already have root.
    • Re: (Score:2, Informative)

      by Anonymous Coward

      -- unless it's setuid, of course.

    • by Sparr0 (451780)

      *whoosh*
      people other than the person running telnetd can gain root access to the device.

    • Re:Rooted? (Score:4, Insightful)

      by deniable (76198) on Wednesday November 05, 2008 @12:06PM (#25643237)
      More importantly, if you have physical access to the console, all bets are off.

      News Flash

      Houses are rootable. If you unlock your doors and hang out a 'rob me' sign, people can break in.

    • Re:Rooted? (Score:5, Funny)

      by neowolf (173735) on Wednesday November 05, 2008 @12:13PM (#25643409)

      Agreed. Non-story. This is just stupid.

      Excuse me sir... I would like to hack into your phone. Could you please type this in for me...

      • Re:Rooted? (Score:4, Insightful)

        by Olix (812847) on Wednesday November 05, 2008 @12:28PM (#25643833)

        To be fair though, lots of people /are/ stupid enough to fall for this kind of thing... consider how well that "I love you" worm or whatever it was did a few years back.

        With the right method, I'm sure you could con people into doing something silly with an Offical-sounding text message, and then exploit it.

        • Re:Rooted? (Score:5, Funny)

          by lysergic.acid (845423) on Wednesday November 05, 2008 @01:05PM (#25644747) Homepage

          i dunno. tech support operators have a hard enough time walking the average person through how to run ipconfig on their windows PCs. trying to get the average person to open a terminal in Linux to run anything would be like trying to walk a cow down a flight of stairs.

        • Re:Rooted? (Score:4, Insightful)

          by sexconker (1179573) on Wednesday November 05, 2008 @01:23PM (#25645157)

          The BEST ringtones!
          The FUNNIEST jokes!
          REAL horoscopes tailored for YOU!

          Sports! Fashion! Celebrity gossip! Keno numbers!

          Just text FAIL to 37528!

          Sign up now and get a free spinning rim background!

          SPECIAL BONUS for G1 owners!
          After texting FAIL to 37528, open up telnet to receive your mystery gift!

          Text FAIL to 37528, TODAY!

      • Re: (Score:3, Informative)

        by jmorris42 (1458) *

        > Agreed. Non-story. This is just stupid.

        Guess you didn't actually read the material. This shouldn't work but somehow a privledge escalation is allowing a non-root user to invoke telnetd and then to connect from outside and actually get a root shell. So the owner of the hardware is able to break int T-Mobile's software. Oh the horror!

        So far it is more likely to simply get patched instead of developing into a full jailbreak but stay tuned. The camel's nose has entered the tent, it just might be able t

  • by Loibisch (964797) on Wednesday November 05, 2008 @11:41AM (#25642499)

    ...wasn't this supposed to be an open platform anyway? I don't quite get it.

    • by Sparr0 (451780)

      What don't you get? Someone ran a network service on an open platform, the service was buggy, the device got exploited (in theory, anyways).

  • Coral to the rescue (Score:4, Interesting)

    by MightyYar (622222) on Wednesday November 05, 2008 @11:41AM (#25642533)

    Coral Cache [nyud.net]

    On a side note... a hyphenated domain name! How retro...

    • by Philosinfinity (726949) on Wednesday November 05, 2008 @11:51AM (#25642789)
      It could be worse... I chose a domain name with a double hyphen... aleph--null.com Whenever a web form states that my email address is invalid, i realize my folly just a bit more.
      • by Splab (574204) on Wednesday November 05, 2008 @12:13PM (#25643413)

        I've never understood why so many web programmers insist on parsing E-mail addresses, very few are capable of doing it correctly. I usually use splab+someidentification@mydomain.tld - this way I can track where I submitted the address they got - but since programmers insists on parsing the E-mail address they almost always considers + to be invalid.

        Just send the person a confirmation E-mail and bobs your uncle.

        • by Kijori (897770)

          You said it yourself - the problem is that they get it wrong, not that they do it. I use a regular expression that checks that it matches the RFC specification. A double hyphen passes, as does an address with a + in. I confirm the addresses afterward, the validation is just to check that they haven't done anything really stupid, like starting their street address in the "email address" field.

          Validation is mostly about helping the user - I can't tell if they've put an incorrect address/email address/name/wha

      • You could always send them a POST request to their "contact us" page, explaining them about the problem.

        They are likely to believe that you are sending them an email when in fact they're sending themselves an email.

        They're also likely to not know the difference between a million datagrams and a ton of data.

        Of course the contact us page rejects the address you enter into the address field.

        Fortunately, they're competent enough to know that clients can always be trusted, so you can just post your complaint wit

  • Bad Idea (Score:4, Insightful)

    by TheAmit (1011767) on Wednesday November 05, 2008 @11:47AM (#25642653)
    Waiting to see how many non-Linux types try this and get in trouble. Its not a good idea to change permissions on sh. All other apps you run on your phone and use sh are now running as root [:)] I would be very scared of this setup. Going to enjoy this
    • Re: (Score:3, Funny)

      Obviously you've never seen this: http://www.garyshood.com/root/ [garyshood.com]
      • by tsa (15680)

        That's funny, especially the list of people who also run as root. I made a root account on my Macs, just for the reasons mentioned in that funny article. Typing sudo all the time drives me mad.

        • I made a root account on my Macs, just for the reasons mentioned in that funny article.

          Screw that, I just wiped OS X from my Mac Pro and installed XP.

          Take that, bitches!

  • Wait...so.... (Score:4, Insightful)

    by kcbanner (929309) on Wednesday November 05, 2008 @11:48AM (#25642699) Homepage Journal
    The user...has to run telnetd...as root...how...how is this an exploit? Maybe its more complex than this but the site is currently 503ing for me.
    • Re:Wait...so.... (Score:4, Informative)

      by MrMr (219533) on Wednesday November 05, 2008 @11:58AM (#25643005)
      No it's not more complex. The curious bit is that telnetd appears to set uid=0 after login, which allows you to make a setuid root shell.
    • by Animats (122034) on Wednesday November 05, 2008 @12:15PM (#25643477) Homepage

      It's apparently weirder than that. Running "telnetd" as an ordinary user apparently allows remote logins as root. This happens even though the "telnetd" executable does not apparently come with permissions set-UID to root. If that's correct, there's a security hole somewhere else that's being used by accident here. Is "login" a set-UID program on Android phones?

      (As a robotics guy, I hate the name "Android" being used for a telephone. It's the worst choice since "U.S. Robotics" which ended up as a modem company.)

      • by SnowZero (92219) on Wednesday November 05, 2008 @01:07PM (#25644783)

        Just about everyone in the robotics community calls them humanoid robots anyway. "Android" and "droid" are pretty much confined to sci-fi, and by the time we have real androids, I'm pretty sure this phone OS will be a thing of the past. Sure, Ishiguro's current work in this area is pretty interesting, but even those robots are only mistaken for humans from a distance, and they aren't mobile.

      • Re: (Score:2, Funny)

        by Anonymous Coward

        As a robotics guy, I hate the name "Android" being used for a telephone.

        This makes about as much sense as hating Apple because you're a grocery store clerk.

  • I don't know much about android or phones or anything, how is this a exploit? I mean, it requires you to physically get to the phone and open a terminal...
    • Re:hmnn? (Score:5, Funny)

      by antifoidulus (807088) on Wednesday November 05, 2008 @11:50AM (#25642771) Homepage Journal
      Well, its a problem if you are both security conscious AND stupid.... oh how I wish that was a much smaller intersection than it actually is....
      • by H0p313ss (811249)

        Well, its a problem if you are both security conscious AND stupid.... oh how I wish that was a much smaller intersection than it actually is....

        Yes... but we're talking here about a level of stupidity that would preclude the incredibly small demographic that would be smart enough to start telnetd in the first place.

        • You obviously haven't met our security people.
          They are quite qualified in the are of procedures.

          I think I saw this somewhere:
          "procedures are the last refuge of the incompetent."

          • by deniable (76198)
            Maybe, but I've worked in places that needed *more* bureaucracy. Then again, one of those was the place where we had to upgrade the comms because the construction workers were wasting too many chargeable hours downloading their daily porn. Just one written 'No porn in the workplace' document would have been nice.
            • I've found that the most powerful "no porn in the workplace" document is a letter of termination for creating an inappropriately uncomfortable or hostile work environment. Nobody who receives such a letter ever checks porn from the company's computers again, and most of their coworkers don't either.

    • That's why I make sure I rarely have physical access to my phone. It keeps me safe.
  • by NitroWolf (72977) on Wednesday November 05, 2008 @11:51AM (#25642777)

    This is like saying something is "bricked" when it's just a bad firmware flash that can be fixed.

    The phone isn't rooted. Rooted means someone gained root access through an exploit and/or installed a root kit. Running telnetd and then connecting as root is a normal method of logging in, no exploits required.

    Or are they saying every UNIX system that has a method of remote access is rooted?

    • by Anonymous Coward on Wednesday November 05, 2008 @12:01PM (#25643093)

      Well, I found an exploit to alter the root password on Unix systems. It's really simple. You just login or su to root, then run the command 'passwd'. Works every time.

    • by omeomi (675045) on Wednesday November 05, 2008 @12:09PM (#25643301) Homepage
      The phone isn't rooted. Rooted means someone gained root access through an exploit and/or installed a root kit. Running telnetd and then connecting as root is a normal method of logging in, no exploits required.

      Well, given that it's a device that isn't designed to be root-accessible by the user, this did require somebody to do something that the manufacturer didn't intend in order to gain root access.
      • by knewter (62953)

        parent++

        Seriously, it's at least KIND OF a deal. First, there was no terminal of any sort on an android phone since I got mine Oct. 20th. So ~16 days from my receiving it to getting a root terminal. The pTerminal program is in many ways useless, as it's a really crappy terminal. But this is just what the doctor ordered.

        Now, as I understand it the bootloader on the phone is encrypted or some such thing, so installing your own firmware is probably tivo-lockedout, but I'm not sure at all. I know android's

    • This telnetd didn't ask for a login or password - it just went straight to a root shell prompt.

      • On a single-user device, the account you use is often root. Telnet typically has to run initially as root in order to listen on port 23. It then normally drops privs to the user who logs in. If the intent of the application wasn't to allow root access, then there's a bug in the telnet daemon. On a single-user device which is likely running in single-user mode, I'm not surprised it's easy to have a shell as root, though. I would expect this system they've been calling wide open to be, well, wide open.

        • Re: (Score:3, Informative)

          by Eric Smith (4379)
          Android does NOT run everything as root. They have a security model that uses separate user ids for many things, and root for almost nothing. When you start the telnetd, it is as a non-root user, and the telnetd is not setuid. However, when you connect to the telnetd from a telnet client, you get a root shell. Something extremely weird and/or broken seems to be going on in there.
  • by LWATCDR (28044) on Wednesday November 05, 2008 @12:06PM (#25643201) Homepage Journal

    What???
    Telnetd is one of those things that should just be deleted from every system that it is on.
    Just use SSH folks.

    • I have a small LAN with 2 machines at home behind a hardware firewall thats generally not connected to the internet anyway. Why do I need to run sshd on them when telnetd does me fine?

      • by LWATCDR (28044)

        why not run sshd on them?
        You can even do ssh tunneling and use scp. Plus if you ever put them on the internet you will not have to "remember" to take telnet off.

      • by Culture20 (968837)
        Humans are habitual by nature. Regularly using telnet at home, one runs the risk of accidentally using telnet outside the home.
    • Take a good at the number of vulnerbilities in ssh these past few years compared to telnet. Not to mention ssh is very cpu intensive for an embedded device.

      • by kv9 (697238)

        Take a good at the number of vulnerbilities in ssh these past few years compared to telnet.

        oh yeah, telnet is super secure

        Not to mention ssh is very cpu intensive for an embedded device.

        I have SSH running on my phone, on my switch and on my UPS without any issues. you have absolutely no excuse for using telnet (unless it's a MUD or something).

  • by Zarf (5735)

    ... everyone ready? one... two... three... *gasp*!!!

  • Calling it an exploit is a stretch; perhaps it's just a vulernability, or dare I say, "working as intended"? I doubt google left such an obvious "security" flaw by mistake.

  • by Idimmu Xul (204345) on Wednesday November 05, 2008 @12:47PM (#25644365) Homepage Journal

    The point of this exploit isn't so you can remotely hack other people's phones, it's so mobile hackers can get to a lower level than Android permits users to do, which will allow them to flash the phone with unsigned custom updates and what not and customise their phone more.

    People should really read the articles and smarten up.

  • Seriously... it makes the news, when a device is rooted, that you OWN? I mean, isn't that the point of owning a device? That you can do whatever you want with it?
    Else it is not sold but leased. If they say they sold it, but do not give you root access, to me that is deliberate fraud and should be followed by a billon-dollar class-action lawsuit to sue them out of business.

    How long before such news come out on the newest PC (eg from Dell)?

    Oh, I forgot... that was a major "feature" of Vista, called TCPA.

    Thank

This screen intentionally left blank.

Working...