Custom ROMs Less Secure ... a whitepaper.

[andruoid]

Hey all I came across this article in one of my RSS feeds. It's about the potential of custom ROMs being less secure and the info behind the claims. I briefly went through the article and wanted the real devs here to have a look as well. What do you guys think?

http://packetstorm.foofus.com/papers/general/android-custom-rom.pdf
The PDF is clean, no worries about downloading.

-

 

[SUroot]

I can't download the pdf, for some reason my.operator wants to charge me for age verification

Here is my response to a similar thread.

http://androidforums.com/desire-all-things-root/364577-super-user-permision.html#post3254193

Hopefully its relevant

 

[jerofld]

Well, yes, of course there is always the potential for a dev to unintentionally (or intentionally) inserting a security hole into the ROM. Hell, the only way to achieve root on a number of devices is to exploit a security hole in the first place. But, the upshot is that some people monitor their logcats, data usage, etc to report bugs for these devs (or their own curiosity). It gets reported. If the dev doesn't fix it, or is discovered to be intentionally trying to pull user data, you better believe people will boycott them.

 

[aysiu]

I'm not a dev, but I do know a bit about security, and a lot of the concerns in there are stupid and really just amount to what we all know from computing (and this is true of Windows, Linux, Mac, BSD, etc.), which is that physical access is essentially root access.

If someone has unfettered physical access to your phone and is determined to compromise it, she will given enough time and Google searches.

There is mention of a wifi adb root shell, which would definitely be concerning, except when I checked my build.prop file on the Cyanogen rom I'm using, I didn't see the setting in question (not sure if it was an "if you set this setting yourself" hypothetical or "if your rom creator puts this in" hypothetical).

 

[T.M.M.L]

I look at it like this,

Devs have just as much of a chance of introducing security holes as do the manufactures. But the difference is how the two groups approach this issue.

Manufacturers have proved time and time again that the almighty dollar is their main concern. Unless enough noise is raised to bring an issue to the masses and more importantly the media, manufacturers may or may not fix an issue, because they are concentrating on the next "Big" thing.

Devs, in general , are made or failed by their work. If a dev has a rom with a ton of errors and glitches, then people tend to shy away from them. Any dev who turns their nose up at a reported security error, would be committing "virtual suicide" A developers reputation is their Sword & Shield or Archilles Heel.

Just my 2 cents.