Researcher Unlocks Galaxy S4 Bootloader For AT&T, Verizon Phones 75
Trailrunner7 writes "Those of you who like to tinker and jailbreak Android phones should take notice of some new research conducted on Samsung Galaxy S4 Android devices shipped by AT&T and Verizon. Both devicemakers ship the Galaxy S4 smartphones with a locked-down bootloader that prevents users from uploading custom kernels or from making modifications to software on the phone. Azimuth Security researcher Dan Rosenberg has found a vulnerability in the manner in which the devices do cryptographic checks of boot image signatures and was able to exploit the flaw and upload his own unsigned kernel to the device."
How hard is it? (Score:5, Interesting)
When the phone powers up, there is usually a watchdog circuit that holds a pin low (ground) for a short time, usually 50-100ms, then it allows the pin to rise, and that pin then allows firmware to be loaded which starts the bootloader process (or is the bootloader process). Usually you can short that pin, and after the amount of time required to load the OS, the firmware can be updated (reflash the chip with new bootloader/os). I realise finding the pin and reflashing the chip can be a bit of a job, but its not impossible (I've used techniques like this to unbrick/reflash bootloaders in routers and other devices, and likewise upload new firmware).
Re:not a true unlock (Score:5, Interesting)
It's morel like if you forgot to lock your back door so your neighbor slips in it once or twice, you notice lock the back door and its back to secure.
Yeah, it's like that, but also: Then the neighbor slips in your window instead. So, you lock that. Then you notice them crawling in right through the damn wall?! Oh, that's right you live in a Swiss Cheese Shanty. Bah, but who cares, you'll be moving out soon -- You're building a whole new home, and it's going to be Sweet! Most Secure System Ever. No ones ever tried to tunnel their way into a Funnelcake Fortress before!
Meanwhile the list of your previous homes includes Calamari Castle, Macaroni Mansion, and a Doughnut Domicile, so it doesn't seem like the future bodes well for your boot-locking strategies.... Oh! What about a Footwear Flat? I know an old lady looking to part with one on the cheap, roof's a bit 'leaky' though...
Re:I'm not paying $1000 for a damaged phone (Score:2, Interesting)
Tracfone prepaid
My tracfone is a 18 year old Motorola flip phone no net just phone and it still supported