Rooting Android Phones Is No Longer Cool, It's A Liability

Android prides itself for being an open platform. On a technical and legal level, that might be true. But when it comes to the day to day use of smartphones, Android doesn't stray too far from iOS' walled garden. Although not completely locked down, users are still locked out of functionality and hardware that may be rightfully theirs. There exists a class of Android users that constantly work to subvert this status quo. Some might see them as revolutionaries. Others look at them like they're insane. They are the root users, and they are on the verge of becoming an endangered specie.

The term "rooting" traces its roots, pardon the pun, to Android's Linux legacy. Root is the Linux operating system's unchanging name for the super user, the administrator, the one and only user that has god-like powers over each and every part of the OS. Whatever security limits frameworks like SELinux impose can be bypassed, modified, or undone by root.

(Image courtesy of Wikipedia)

That immediately poses a problem for a smartphone platform. For desktop-oriented systems like Linux, Windows, and, yes, even the BSD-based macOS, having an easily accessible super user is no problem. But when you have a device that is almost always connected to the Internet and has a higher chance of falling into the wrong hands than your hulking desktop, it becomes a security risk.

Google has bent over backwards to hide something that comes naturally to Linux-based systems: root access. Unsurprisingly, that didn't sit well with not a small number of Android users who expected Google to deliver a smartphone platform that didn't suffer from the chokehold that Apple had on iOS. A platform that embraced all, including power users.

Admittedly, in the early days of Android, rooting was almost necessary to milk Android for all it's worth. Android a few years back pales in comparison to the Android you have in your pockets today. Functionality was very limited and so was customization. The rooting and modding community had to come up with all sorts of hacks in order to implement a much needed feature, fix something that broke, sometimes intentionally, in a new release, or simply fine tune the performance of a device. All of those required root access.

But as mentioned, Android today is very different and many of the reasons that gave birth to the rooting community have vanished or, at the very least, been mitigated. Workaround and hacks still do exist, but many of them no longer require rooting a device. Users and Android developers still don't see eye to eye on some things, but it is easier to install some third party app these days than risk voiding warranties by rooting.

That's not to say that there is zero reasons to root a device anymore. There are still things that no app, even with all the permissions, can do. And there are some use cases where rooting is really required. Removing some bloatware, mucking around with other operating systems, running servers like VNC, and more. But the power that comes with being able to do those and more comes at a rather high price, and one that entire Android community has to pay.

Rooting as it exists on Android is practically a security exploit. On a normal UNIX-based system like Linux and BSD, getting root access is as easy as logging into the user (named root) and entering the root password. In contrast, Android implements restrictions on multiple levels of the operating system so as to block root access. And the only way to get around that is to technically hack into Android's security.

This is one area where Android is not so different from a proprietary OS like iOS, though on that side of the fence they call it "jailbreaking" instead. In a nutshell, rooting involves finding system vulnerabilities that will allow an arbitrary and unauthorized piece of code to run. This piece of code will usually then tweak system settings, like mounting partitions with read/write access, to install other pieces of program that, in turn, enable root access.

If that process sounds almost like the same path a malware would take, then you're right on track. That is pretty much the reason why rooting is a double-edged sword and why it is getting harder and harder to root Android every new release.

The spat between Apple and the US government gave rise to the metaphor of the backdoor in terms of encryption, but that also applies to security exploits in general. Including, unfortunately, rooting. Getting root access is a process that exploits a security vulnerability to run arbitrary code, and that vulnerability exists for all Android systems, not just on an individual device. To put it simply, the backdoor exists for everyone, not just rooters. And not everyone trying to gain root access have benign intentions in mind.

In fact, the very same tools that makes it easier to root devices with a single tap or install is also being misused and abused by less conscientious people to root users' devices without their knowledge, much less their permission. Android is often chided for its poor security system, something that is exacerbated by the real possibility that some piece of malware that got past Google's automated bouncer might actually root a device.

While Google may undoubtedly love to cater to Android power users, who arguably have very creative ideas about the platform, it has an even bigger responsibility to secure the operating systems for its billions of users, not to mention is partners and shareholders. And so each Android release is like a game of cat and mouse between the Google security team and the Android rooting community, with Google plugging up holes and rooters looking for new ones to exploit. Of course, this is a rather simplistic representation, as rooting developers are often more security-minded than your average user and do report such vulnerabilities back to Google. But, as it stands, it's not a pretty picture, and it's about to get uglier.

If there are valid reasons to root devices, Google might giving equally strong reasons not to root devices. And it's not some abstract concept like security but a practical one called "Netflix".

Not too long ago, it was discovered that Netflix gained the ability to hide itself from rooted devices or even just those that had unlocked bootloaders, which doesn't necessarily entail rooting. Apparently, it wasn't just a Netflix thing. Netflix was just using a new developer option that allowed app developers to discriminate against rooted devices.

These new SafetyNet exclusion rules have multiple angles, including vendor lock-in and monopoly. And they really only affect what users will be able to see on Google Play Store, not the functionality of the apps themselves. But it is also an indication of the steps that Google is making to make having a rooted device less attractive or even less useful. And it is getting app developers to take its side. Of course, there will be a tug of war between Google and the Android rooting and modding community, but if enough of the big apps do things Google's way, the rooting community might see its numbers dwindle even further. Never underestimate the power of Netflix.

Rooting is never going away. Android isn't the perfect OS (yet), OEMs and carriers still burden consumers with bloatware, and there will always be users who want total control of a device they bought with their hard-earned money. But the way Android is implemented today, rooting isn't also going to change. It will always be a security liability.

But at the heart of the matter isn't whether rooting is still worth that risk or not. The real question is whether Google should have deprived users of something that is inherent in the Linux operating system in the first place. In an ideal world, users can have their cake and eat it too. They can have a hardened mobile platform that still offers unfettered access to anything and everything. Unfortunately, such an open mobile operating system doesn't exist yet, and even secure Linux desktops have users who shoot themselves in the foot with root access. Until such an OS exists, we'll have to continue the imperfect and delicate dance between power and security.