[Security Discussion] j'vai:
you know, since yesterday, i've been thinking, & pondering about this exploit, it's not the same as on desktops, many processing calls DO makes Lo (or loopback / 127.0.0.1 for window users) calls that don't hit the outside..

but with phones, these are different beasts, (they are networking animals) their design is currently for TOTAL world facing calls to the outside, mostly, & with android phones which this exploit adresses, & with the newer qualcomm chips being single pathed, that plays a significant part in this..

the post i made on how to overcome the ecsbf issue - http://xdaforums.com/google-nexus-5/help/nexus-5-e-csfb-issue-t2729014 which i DEARLY wanted participation, but i think it went clean over everyone's heads, even the mod that closed it, it was relating to the how these chipsets interact with the network at hand (sprint's)

the biggest issue with the chipset was that it was an asymmetric multiprocessor, i mentioned it before - http://xdaforums.com/showpost.php?p=52708292&postcount=15

in the last link i posted (What is the “Waiting Channel” of a process?), that guy stated -

"..If you really want more detailed information you could check the kernel source.

If you type cat /proc/some_pid/stack in a terminal you'll get some output like that one :

[<c0227f4e>] poll_schedule_timeout+0x3e/0x60

[<c022879f>] do_select+0x55f/0x670

[<c0228f40>] core_sys_select+0x140/0x240

[<c0229241>] sys_select+0x31/0xc0

[<c05c9cc4>] syscall_call+0x7/0xb

[<ffffffff>] 0xffffffff

And on the first line you get what's displayed on the system monitor. As far as I know, poll_schedule_timeout indicates that your process is waiting for something.

It deals with asynchronous I/O and polling..."

reference - Asynchronous I/O

...............

android is linux at it's heart, & what does linux have as a stateful firewall, yes, **iptables** built into the kernel!

we have to find out what effects this exploit has on the stateful tables in the kernel to create the gateway for the exploit(s) ..

has to be the tables, with the single chipset qualcomm has unleashed, 3g (gsm / cdma) switching to & from lte, & wifi, presents a new ip address everytime, it's NEVER the same IP addy while in wifi, 3g or 4g.. & how many times within **an hour** does a phone switches just between 3g & 4g?

we have to find out how futex_requeue() effects iptables..

i have to give credit to another poster today, which made me post what i suspected, he found this gem -

"..I think i've found an acceptable explanation from another site for z4root and it must be almost the same with towelroot:

What z4root (or any other rooting program) does it runs some exploit to change its own uid (user-id) to 0 (root). You can think of it as of performing some kind of hack and tricking kernel into thinking it actually has the right to be root (then if z4root was a virus it could do everything with your phone from installing keyloggers to bricking it). Of course if it is possible to trick kernel in such a way to give you root access it is considered a security vulnerability (any app could do that and perform some malicious stuff) and usually gets fixed in future kernel updates (that's why z4root may not work if you upgrade your firmware).

When z4root has set its uid to 0 it does the following: remounts /system partition as writable (by default it's read-only), copies over su binary, Superuser.apk and busybox and then remounts /system back as read-only.

So how does the su binary give you root access without doing "the hack" thing when normally applications have same uid as parent process? This is because su binary has set-uid flag set and is always ran as uid 0 (root).

Now, if you have copied su binary over to /system/bin then you must have had root access which means you have to change owner/permissions (chown root:root /system/bin/su; chmod 6755 /system/bin/su). .."

from - http://xdaforums.com/showpost.php?p=53492633&postcount=71 (i'm going to thank him after this post)

we know busybox on the linux desktop is simply a window manager, like fluxbox, like what i use, openbox, or metacity, etc, they all make Lo calls...

this exploit is a 2-3 step exploit; it CAN'T have r00t privileges w/o 1st, gaining access, which means, it must 1st be granted r00t access to network sockets (**THE** MOST DANGEROUS THING TO GRANT) TO DO the rest...

towelroot is called a root *toolkit*... lol

but, if you snatch the *tool* from root toolkit...

imaleave it alone.. lol