[Android Software/Hacking General [Developers Only]] Chainfire:
Nice to have been informed ? I've stated in the threads regarding the exploit and fixes that yours and RyanZA's solutions are not secure.

The problem is that any solution based on BOOT_COMPLETE can never be secure. And "sort of", "mostly", etc, have absolutely no place in security.

To me it appears (I have not checked the code, so I'm just guessing) you now make the receiver blocking during the exploit process in v0.9, again relying on boot order. You cannot rely on boot order even in ideal conditions, and I can think of several scenarios where that just doesn't work (protecting too late) or crashes (leaving you completely unprotected).

Sure, that beats the attached version in the first post, but I have several more tricks up my sleeve. I've rerun my tests against both RyanZA and your v0.9 with a private exploit test version that beats both protections every single time. Before anybody asks me to publish it - sorry but I will not. That may sound like a cop-out (think and say what you will) but if I do release it, you will only try to improve your solution - completely missing the point.

Anyway, I will not discuss the point further, I believe I have made my point, and nothing I can further say or do will convince anyone more than who is already convinced.

As for the modified status, yes that is totally reversable. I'll document this in more detail, maybe add a button in the app to help with it. As for your fix triggering modified, your app can trigger it, but it depends on the firmware version.

The thing is, if I was a blackhat you'd all have some serious problems with that attitude, you would notice by the hard-bricked device in your hand. Maybe we're all lucky I'm not and that all malware authors are too lazy to add 20 trivial lines to their code. (Right ...)

Also who said that exploit would only run at boot ? It's simply what I decided to test against because it's the most obvious flaw. A proper package would try the exploit at several times ... including boot.

Just because you build your house in the middle of nowhere is no guarantee it won't be burgled. And when said burgler comes, if your windows are barred it's not going to help if there's a big gaping hole where your door should be.

Supercurio's is IMHO still the worst one, as it's the easiest one to beat. And it does require root, it just doesn't tell you about it and uses the exploit itself to root. That difference is just meaningless words. It also keeps a rooted background process around that it communicates with through a socket, of which I'm not sure how secure that even is (who knows that might be exploitable, I haven't bothered to try).

As stated though, I'm not going to discuss that point further. If you don't agree I'm not going to be able to convince you.

Furthermore, you're assuming that we know about all the exploits in the wild ... due to the nature of the exploit, it seems unlikely you can reliably detect this type of exploit - there are many ways this hole can be abused, the code going around is just one example of it.

Being in the right and getting your right are two different things. While what you say is no doubt true, the manufacturer can still claim your rooting/custom firmware is what caused the damaged to the device. And while I believe it's actually their responsibility to prove that, in reality, what are you going to do when they simply refuse to fix your device due to root ?

As an example, HTC claimed HSPL (the bootloader unlock back in WM days) broke my screen, and the (official HTC) repair center simply refused to fix it, because HTC HQ would not cover it (which is not in the EU). Threw some law and some lawyers at them, and in the end my device did get repaired, but I'm pretty sure the repair center footed the bill itself, and with the amount of time and money spent on the process, it would have been cheaper to just buy a new one.

The unmodified status cannot currently be faked (well technically it can, but nobody done it yet), but the state is certainly restorable (I will document this further with my app).

If the author of an app you have installed already would release an update to their app containing the malware and running it at boot, it will generally run before Supercurio's or RyanZA's fix, and you'd be screwed.

If you run my patch at boot no other app should be able to use the exploit - I am not aware of any way to beat my method.