yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy S 5 General] elliwigy:
not sure about that.. i remember my sgs4 having knox for sure.. i also dont think my s5 has a retina scanner lol plus it says nothing about any vulnerability?
[Verizon Galaxy S 5 General] kilroy1stcav:
Is this anything? http://blog.cassidiancybersecurity.com/post/2014/06/Android-4.4.3,-or-fixing-an-old-local-root
[Verizon Galaxy S 5 General] Nsane457:
No.
[Verizon Galaxy S 5 General] DR4LUC0N:
http://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-19997/Google-Android.html

Not sure if anything on this website could help us.
[Verizon Galaxy S 5 General] Dennisg34:
A respected DEV has already brought this to attention in the other thread..
[Verizon Galaxy S 5 General] thewebsiteisdown:
Maybe Something?

I just came across this post on reddit. There might be something in here worth looking into.

http://www.androidpolice.com/2014/0...lity-shuts-several-serious-security-exploits/
[Verizon Galaxy S 5 General] Dennisg34:
Jcase already shut this down as not working for Samsung, even the article describes that Samsung models have already fixed this
[Verizon Galaxy S 5 General] warriorpluto:
We can't use hardware hacks similar to this to force loading official kit Kat with root? http://xdaforums.com/showthread.php?t=2690033
[Verizon Galaxy S 5 General] spuniun:
nope
[Verizon Galaxy S 5 General] bruderhood15:
http://www.androidpolice.com/2014/0...-patches-7-more-vulnerabilities-some-serious/
[Verizon Galaxy S 5 General] spuniun:
We've discussed this already. Heartbleed has no path to privilege elevation, it can only be used to steal your personal data.
[Verizon Galaxy S 5 General] bruderhood15:
I understand that its been talked about but maybe something new can come out of this considering they just found 7 more vulnerabilities.. maybe you should actually take a look at the link instead of shooting me down. Ignorance is bliss, smh
[Verizon Galaxy S 5 General] ks3rv3rg:
Obviously you're taking the ignorance is bliss concept to the next level. Before you start getting all butthurt maybe you should do some research. Heartbleed is a meant to steal sensitive information. None of the discovered vulnerabilities have anything to do with privilege escalation. The one described in the article is a man-in-the-middle. Nothing to do with gaining root, everything to do with intercepting large amounts of data. Here's their description- "OpenSSL’s ChangeCipherSpec processing has a serious vulnerability. This vulnerability allows malicious intermediate nodes to intercept encrypted data and decrypt them while forcing SSL clients to use weak keys which are exposed to the malicious nodes.

There are risks of tampering with and exploits on contents and authentication information over encrypted communication via web browsing, E-mail and VPN, when the software uses the affected version of OpenSSL."

Make sense? Heartbleed just isn't for exploiting an OS in the way we need. That's why this isn't worth persuing.

AND that whole thing is referring to openssl which has nothing to do with us.
[Verizon Galaxy S 5 General] eragon5779:
Everybody, please stop arguing and bashing each other. We won't get anywhere this way. It's the reason this thread got closed last time.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] Dennisg34:
This thread was never closed, but I agree about the bashing part. Blah, it's just getting to a sad point where people are extremely frustrated with not having root while the HTC trolls brag about switching (which ew, I'm never switching regardless of root). There are people out there working on this, again they're silent. Then there's the extreme negativity since we're coming up on the 2 month mark of the phone being released and people saying it'll never get done. Ugh, either contribute to possible exploits (read through forums first to see if it has been asked because it IS annoying seeing 5 people post the same link) or just sit here patiently waiting like most of us have been and being respectful to each other. :D:thumbup::)
[Verizon Galaxy S 5 General] Franzie3:
I think the thing is everyone see the word "vulnerability" and all of a sudden gets over excited without reading into what it actually is. I'll admit it, i've done it before but i've learned to just read and keep my mouth shut unless something flat out says "this will work for xyz"
[Verizon Galaxy S 5 General] DR4LUC0N:
A lot of articles don't say "this will work for xyz". Also a lot of people(like me) don't know what to look for, so we are at least trying to help by maybe finding something useful.

On the other note... I sell cell phones where I work, I had a Samsung rep come in and I asked him why they locked the GS5 down from being able to root.

I could tell he legitimately didn't know the answer, but after I told him about the bounty and what not he told me he knows a few guys higher up and he'll relay any info he can get to me, hope it will be something useful.

Also if I may ask, when we do a recovery on our phone(to wipe all data) does it reinstall any apps as far as something with escalated privileges?
[Verizon Galaxy S 5 General] kprice8:
Tell him if he gets you the keys or something that achieves the root, and you get to collect the bounty, he can have some of it. :D
[Verizon Galaxy S 5 General] Franzie3:
By xyz i meant specific device not like kernel version. It's a tough nut to crack regardless.

Now by recovery you mean a wipe data/factory reset? If yes, then the answer is no, nothing is reinstalled. it would be as if it was fresh out the box.
[Verizon Galaxy S 5 General] Dennisg34:
Lol he's probably going to tell his higher ups about it to see our 'progress' and keep any eye up for patches
[Verizon Galaxy S 5 General] DR4LUC0N:
If we don't update our phone how will the "patches" effect us? On top of that I didn't tell him where the bounty was coming from.
[Verizon Galaxy S 5 General] Hashbang173:
Heartbleed could technically unlock the bootloader, see the last posts in this thread: http://xdaforums.com/showthread.php?t=2500826
[Verizon Galaxy S 5 General] ks3rv3rg:
Using heartbleed to hypothetically hack Samsung for the keys is not the same as using it to unlock the bootloader. Here's one quote from the link you provided that talks about this.
[Verizon Galaxy S 5 General] Hashbang173:
Yes but It would allow you to make signed unlocked bootloader
[Verizon Galaxy S 5 General] ks3rv3rg:
What would? Having Samsungs keys?
[Verizon Galaxy S 5 General] Hashbang173:
I'm no dev but I think it would allow us to flash a developer s5 bootloader by changing the required aboot fuse number.
[Verizon Galaxy S 5 General] miked63017:
The problem is that there is no key exchange over the wire to intercept. The public keys and cert is local, and the private key along with its passphrase is never sent to the phone. At least that's my understanding of the protocol, and how its used for signing things. Without the private key and associated passphrase I think your out of luck. I do believe that parts related to heartbleed could help, if the pc generating the private key was affected that could make guessing/brute forcing take alot less time. But I'm sure by any calculation, given the info available, will still take longer than anybody wants to dedicate a high power cpu(or multiple cpus and/or gpus) for. It doesn't take a dev to brute force, or do the math, so if you have the hardware you have just as much a chance at brute forcing as anyone. Honestly most developers I know don't really know too much about SSL, they rely on sysadmins to setup SSL offloading and just hope everything works right, unless its something they specialize in.
[Verizon Galaxy S 5 General] Hashbang173:
The theory in the other thread i linked to was that the Samsung server might have the key required, they might be the same. We could illegally get that key through heartbleed. I am not interested in doing this because it is against the law.

Sent from my OtterX running SlimKat
[Verizon Galaxy S 5 General] miked63017:
Better hurry then, the company I work for patched all our servers for heartbleed over a month ago. And our security sucks.
[Verizon Galaxy S 5 General] spuniun:
The signing key you need is never transmitted over a network in order for someone to intercept it. You will not get it without it being leaked by someone with physical access.
[Verizon Galaxy S 5 General] Hashbang173:
I'm saying their private SSL key for their website may be the same
[Verizon Galaxy S 5 General] spuniun:
The two things are not even remotely related to each other other than being referred to as a "private key".
[Verizon Galaxy S 5 General] warriorpluto:
Maybe something with the Wi-Fi policy?
[Verizon Galaxy S 5 General] spuniun:
If your goal is to steal someone's personal data then by all means, but if you're talking about privilege elevation there's nothing to see here.
[Verizon Galaxy S 5 General] DR4LUC0N:
I don't know if it's possible(so don't shoot me) but when we Factory Data Reset our devices...doesn't it just reinstall the stock rom? If so can we take advantage of that by using a program to monitor the installation to recognize when and what apps are being installed? Maybe we can slip an "edited" Google Play Store during that time and go from there.
[Verizon Galaxy S 5 General] slimc84:
An edited play store will not provide an unlock for the bootloader.
[Verizon Galaxy S 5 General] DR4LUC0N:
Then replace that with an app that we can take advantage of to get root.

Or why can't we just Brute Force the keys to obtain root?
[Verizon Galaxy S 5 General] ks3rv3rg:
The brute force discussion has been had a few times in this thread and the other. Long story short, the time and energy it would take would be far too much to be worthwhile.
[Verizon Galaxy S 5 General] DR4LUC0N:
We got people talking about using Heartbleed to illegally obtain the keys, and others talking about we will have root by the end of the year, the person who makes the Brute Forcer will be known as a god, we will probably be able to use it on any other phones after this one at least until they change the way they secure root.
[Verizon Galaxy S 5 General] briantacker:
Someone had said it would take a supercomputer a few hundred thousand years to brute force...so I think it's out of the question.
[Verizon Galaxy S 5 General] miked63017:
I got a question/theory, I was reading info on KNOX again https://www.samsungknox.com/en/solutions/knox/technical. Specifically the attestation section, thinking about another theory that dev edition phones don't get OTAs because they would need to be rolled out on a per device basis.

Keeping both of those in mind, thes are a few questions I have:

1. In order for a dev edition OTA, it would need to be signed by the private key that's already on the device, and thus the per device theory?

2. Could those same keys be used to sign an odin update, and/or individual images included in an odin package?

3. What makes the dev editions different that they check for the device key sigs?

4. Based on the way SSL works shouldn't those keys and cert work since the cert was signed by the samsung keys, presumably the CA, making samsung's key for all intents and purposes of the same value as the device keys?

5. Probably most important, where are those keys and certs for attestation kept on the device, has anybody found them?
[Verizon Galaxy S 5 General] Walter.White:
Talk to [MENTION=4939386]Surge1223[/MENTION] or [MENTION=766721]ryanbg[/MENTION] they have done quite a bit research on this.
[Verizon Galaxy S 5 General] Dennisg34:
Really? With the keys again??!
[Verizon Galaxy S 5 General] miked63017:
[MENTION=4939386]Surge1223[/MENTION] or [MENTION=766721]ryanbg[/MENTION] you guys got any ideas about my questions above, or would it be better to pm?
[Verizon Galaxy S 5 General] Surge1223:
Dev editions start out as retail editions and are converted using a tool that uses the devices specific info. We dont have access to that tool. Dev editions dont get updates because they would have to use that tool and giving us access to it would allow us to unlock retail editions. I guarantee the dev edition devices will get no official otas of any kind.
[Verizon Galaxy S 5 General] miked63017:
Do you think its possible that the tool used leverages the keys and cert used for atestation, in place of their keys and cert used for a given carrier? This is only thing I can think of that would make sense of the no otas unless individually tailored for each device. Maybe all the tool does is sign an unlocked bootloader, using the same keys used for atestation, making it flashable via odin for that specific device.

If this makes sense, any idea where those keys and cert are stored on the device?
[Verizon Galaxy S 5 General] Surge1223:
The tool uses device specific information done on an individual basis, so yes its individually tailored for each device. Theres keys in the pbl as well. The certs are the same with the exception of an additional samsung singed cert. The only difference between a retail and a dev aboot is the dev aboot differs by 512b, and that 512b is unique to every dev edition device's aboot.
[Verizon Galaxy S 5 General] miked63017:
Do you think that extra 512b is the blob described there?

Do you know what happens if you flash a non dev aboot on a dev device, does the phone appear to be back in a locked state?

Also, do you think the tool they use to unlock is software or is it a special device they plugin to the phone?
[Verizon Galaxy S 5 General] warriorpluto:
No it's just software. Someone in Europe already stated on the s4 forums that Samsung uses software. He went in for service and asked the employee questions and the service only took like four minutes plus his Knox trip counter was reset. This is all software based.
[Verizon Galaxy S 5 General] 32BitWhore:
Surge is there any device you DON'T dev for? :D
[Verizon Galaxy S 5 General] Walter.White:
1. Not likely.

2. It will definitely go back to lock state. (Same thing would happen if you flashed different dev unit's aboot. Since each dev device's aboot is unique).

3. Software that most likely takes into account unique aspect of each device to unlock it (be it be imei or serial # or something else).
[Verizon Galaxy S 5 General] ryanbg:
They're all pretty similar on the inside. If you get one, you get most.
[Verizon Galaxy S 5 General] K-alz:
This website claims to be able to root all android devices. Has anyone checked it out? http://smart-root.com/

from my locked note 3!
[Verizon Galaxy S 5 General] miked63017:
I don't think that site has anything to offer, I think they use freely availble tools and exploits and apply them for you over team viewer. I doubt they write any exploits. Please note though that is my opinion, and it could be wrong as I have never used their service, they could be engineering their own solutions.
[Verizon Galaxy S 5 General] K-alz:
I understand, sir. hopefully someone braver (can afford the cost) than I am will contact them and see what they have to offer.

from my locked note 3!
[Verizon Galaxy S 5 General] miked63017:
I wonder if the "free wifi hotspot" package they have for the s5 is the one I made in the sprint s5 forum.
[Verizon Galaxy S 5 General] Hashbang173:
It's that or them installing FoxFi [emoji28]
[Verizon Galaxy S 5 General] miked63017:
I feel like that site needs a good DOS'ing but feel like its wrong to discuss here :)
[Verizon Galaxy S 5 General] K-alz:
Could be man. This guy is going to contact them http://xdaforums.com/showthread.php?p=53326808

from my locked note 3!
[Verizon Galaxy S 5 General] tutorialbs:
So which part of the stock Verizon S5 hardware do I have to solder/mod to get root? :p

http://s-smartphone.com/cell-phones/samsung/dissecting-high-end-smartphone-samsung-galaxy-s5/ "Dissecting high-end smartphone Samsung Galaxy S5"

How hard would it be to replace the internal memory (nand flash)? If so maybe we could replace with internal memory from an old phone flashed with S5 T-mobile firmware (or whatever carrier has unlocked S5 firmware) and have unlocked S5 on Verizon
[Verizon Galaxy S 5 General] K-alz:
What's DOS'ing referring to?

from my locked note 3!
[Verizon Galaxy S 5 General] miked63017:
Well they are saying that rooting takes hours of research and that there is no help available. When meanwhile they are most likely using tools that are provided for free, come with instructions, and usually have forums dedicated for help, and they are charging you money for it. To me that adds up to a questionable business model regarding licenses and the way they knock the community that they are leveraging for profit, at best. IMHO they are doing undesirable things, and deserve to have undesirable things happen to their website. I won't go into details of what DOS means though.
[Verizon Galaxy S 5 General] K-alz:
Well, you never know. They might have come up with their own method of root and they're charging for it. Also, I just wanted to know what DOS stands for. Didn't want any details. I really didn't know. lol

from my locked note 3!

Edit. a guy on the note 3 forum is contacting them and actually willing to spend the money and give it a shot. He mentioned that he talked to a buddy of his on facebook who actually rooted his s5 via that website. he didn't mention what carrier it was, though.
[Verizon Galaxy S 5 General] miked63017:
Google: ddos website

Should give you the gist
[Verizon Galaxy S 5 General] K-alz:
I will. Thanks.

I edited my previous post btw.

from my locked note 3!
[Verizon Galaxy S 5 General] Walter.White:
http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack

;)
[Verizon Galaxy S 5 General] miked63017:
Cool, I wish him luck, hopefully they pull through for VZW and ATT s5 users. I sent them an email asking if they would root a vzw s5 when you mentioned it earlier and have not received a response yet. Will let you know if/when I do.
[Verizon Galaxy S 5 General] K-alz:
Thanks man. I'd love to see people having root and ending this frustration. He told me the same. I'll also come back with details for you if he gets back to me as he said he would. ::fingers-crossed::

from my locked note 3!
[Verizon Galaxy S 5 General] Franzie3:
S5 root says $50 bucks.....not $15. I dont like the smell of it..
[Verizon Galaxy S 5 General] thewebsiteisdown:
Stick your nose in it see if it smells any better...
[Verizon Galaxy S 5 General] Franzie3:
I'll pass for now. I'm fine with my device as is. I'll wait for a public method that shows me what I'm doing and a Dev who does it that I can donate to.
[Verizon Galaxy S 5 General] K-alz:
And it's able to root the Verizon S5? What do you not like about it? From what I understand it's some certain files that you download then they "walk" you through the process via 'team viewer' remotely on your PC- which is actually the sketchy part about it-.

from my locked note 3!
[Verizon Galaxy S 5 General] kuronosan:
Haven't any of you learned anything? They specifically say NOT to pay people to root your phone.
[Verizon Galaxy S 5 General] Franzie3:
until the is a confirmation this actually worked with a vzw s5 I think its all for not. I find it hard to believe they have root for this...the s4 and other unrooted devices. I hope I'm wrong but I would rather it be public knowledge or at least give the files your paying for. idk...I'm being more pessimistic about it. I'll just keep an open ear.
[Verizon Galaxy S 5 General] tutorialbs:
Fixed that for ya.
[Verizon Galaxy S 5 General] thewebsiteisdown:
So now we're being taken advantage of by hackers as well, great thanks again Verizon / ATT for creating this mess. It sucks that this is fake but, if it sounds to good to be true...
[Verizon Galaxy S 5 General] miked63017:
If it was legit, which most likely it is not, you could always let them walk you through it then disconnect them from your pc before they remove the files they used to do the root. But its doubtful its real, it probably says all carriers because cf-autoroot at one point said the same thing. Which was true until VZW and ATT came along with their locked bootloaders. I don't doubt that they will root any phone with a publicly available method, maybe even some without by re-using hacks for other models. But still you are paying for something you could do yourself for free, or better yet donate the money to the dev that made the exploit.
[Verizon Galaxy S 5 General] eortizr:
The user that pledged the 1K should go ahead and spend $50 on this and confirm if it works... lol:p
[Verizon Galaxy S 5 General] jcase:
It is a lie
[Verizon Galaxy S 5 General] csimms:
This is what i got when k emailed them asking how they claim all carriers when at&t and verizon cant be rooted

I can't root the ATT/VZW variants of the Galaxy S5 right now. I simply have one listing for all carriers since having a listing for every carrier and keeping them up to date based on current latest OTAs is simply not scalable.
[Verizon Galaxy S 5 General] miked63017:
From the horses mouth:

Mike,

Yes I can do that for you as long as it isn't the AT&T or the Verizon version. What carrier is your S5 for?

--

Jake Hilborn

Owner of Smart-Root

www.smart-root.com

651-263-5134

On Wed, Jun 11, 2014 at 11:56 AM, Mike Donlon <miked63017@gmail.com> wrote:

Can you root the verizon galaxy s5 for me?
[Verizon Galaxy S 5 General] cr4ck3r4lif3:
I see this on craigslist often. Offer paid services for root that has been given free to the public.

If they could root the Verizon S5, a bounty would have been collected.
[Verizon Galaxy S 5 General] kprice8:
Dunno if anyone saw this yet or not... but.... click here...
[Verizon Galaxy S 5 General] warriorpluto:
If no one else could do it I knew it would be him. That guys my hero. Has done some amazing stuff these past years.
[Verizon Galaxy S 5 General] kprice8:
Fingers crossed this is legit ****. I really want to get back to how I had things, but if I am stuck with FoxFi and restrictions, I'll deal.
[Verizon Galaxy S 5 General] :
Same here, I want to make another ROM.
[Verizon Galaxy S 5 General] K-alz:
He just posted a picture of him holding the AT&T s5 rooted. Holy sh*t he did it.

from my locked note 3!

---------- Post added at 07:32 PM ---------- Previous post was at 07:29 PM ----------

No, he's going to have to pay the 1k to [MENTION=3280118]geohot[/MENTION] cuz he just rooted the AT&T s5 and he's going over to the Verizon way ;)

from my locked note 3!
[Verizon Galaxy S 5 General] ali87va:
Technically, he has to actually provide a root method for the community. And he is known to just throw teases out there, so I wouldn't hold my breath.
[Verizon Galaxy S 5 General] eragon5779:
CVE-2014-3153 is what it is based on. He may or may not release the exploit to the public, but at least we know the CVE he used.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] elliwigy:
agreed.. i think sony scared him for life lol. hes not been the same since n watches what he releases.. i wouldnt b surprised if vzw/samsung gets mad over a root being achieved.. the govt is probably feelin real safe with the phones they bought ha..
[Verizon Galaxy S 5 General] Hashbang173:
Hope this works with the vzw s4 KK so we don't have to do all this downgrading stuff
[Verizon Galaxy S 5 General] miked63017:
Anybody find any POCs for this cve, even if they are not specific to android. If there was one somewhere it might be easy to port.
[Verizon Galaxy S 5 General] kuronosan:
I want to be annoyed that he's done something like this "for fun" and isn't releasing it, because of how many people that want it.

Then I realized that we now know the exploit.
[Verizon Galaxy S 5 General] vacaloca:
Not the right vulnerability... that's an exploit for CVE 2012-3153, not CVE 2014-3153
[Verizon Galaxy S 5 General] Dennisg34:
Thought it looked strange...
[Verizon Galaxy S 5 General] eragon5779:
Whoops. My mistake.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] tutorialbs:
'

the exploitable vulnerability not the exploit itself. he didn't have to post any of what he did so im just glad he posted what he did.