Star 0

Abstract

Today, mobile devices are ubiquitous; a facet of everyday life for most people. Due to increasing computational power, these devices are used to perform a large number of tasks, from personal email to corporate expense account management. It is a hassle for users to be required to maintain multiple mobile devices to separate personal and corporate activities, but in the past this was a commonplace requirement.The Bring Your Own Device (BYOD) revolution has promised to consolidate personal and business applications onto one device for added convenience and to reduce costs. As business applications move to personal devices, a clear problem has arisen: how to keep business data secure and personal data private when they reside on the same device. Many solutions exist, both for increasing the security of mobile devices as well as BYOD and Mobile Device Management (MDM) software, to allow access to business applications and data while keeping it secure.One chink in the armor for both security and business applications is "rooted" devices. These devices have been unlocked, providing low-level system access to users and applications. With root access, users may be able to bypass BYOD mechanisms in place to protect data, and malware may be able to access both private personal and business data on devices. As such, security applications and business applications often attempt to identify rooted devices and report them as compromised.In this talk, we analyze the most popular Android security focused applications along with market leading BYOD solutions to discover how "rooted" devices are identified. We dissect the aforementioned applications with commonly available open source Android reverse engineering frameworks to demonstrate the relative ease of circumventing these root checks. Finally, we present AndroPoser, a simple tool that can subdue all the root checks we discovered, allowing "rooted" devices to appear "non-rooted."

Slides