Hacker News Reader

Comment by ck2 | Hacker News Reader

Bet the attack doesn't work on CM10 (Cyanogenmod) which people should be running anyway instead of basic android, it's amazing.

View on HN

You are correct, this does not affect CM. But you are completely wrong implying having CM protects your device. To get CM you have to unlock your bootloader giving you full access to everything on the device. Unless you explicitly relocked your bootloader after you installed CM your phone is about as wide open as it can get if someone stole it.

Pardon my ignorance, is there another option besides relocking? I believe in the Nexus One days, relocking took quite some time to solve. I'm wondering if that's still the case.

And my last ignorant question, if you relock are there any complications running a custom ROM such as CM? Specifically, on reboot. Thanks.

I cant remember specifically for the Nexus One, but i believe its the same as the modern nexus and samsung devices(devices that provide an official way to unlock).

When you unlock a device it wipes the entire device, so your data would not be at risk.

I do not know if it wipes it when it relocks it, but no it is not a complicated task. All it requires is one command.

"fastboot oem lock" to lock

and

"fastboot oem unlock" to unlock(wipes device).

CM has an option now to encrypt your whole storage?

Does that not help?

I am not sure to be honest. I know of the feature your referring to, its actually a feature of Android 4.1 or 4.2. AFAIK it encrypts your device, if i had to guess this would mean it encrypts the /data partition, idk about removable storage. If i had to guess this data is only encrypted on access while the OS is booted, so yes this should keep your data save from access via recovery or other bootloader.

It doesn't work on basic android(the article clearly states that). Only Samsung's braindead changes to android are the cause of this.

I have yet to see a single instance where Samsung actually improved android with their changes instead of just making it uglier, harder to use and less secure.

A reasonable assumption, yes, given that it's in Samsung's code.

'People' shouldn't all run stock though, the beauty of Android as that people can run what they want (well, mostly, anyway...)

Reply on news.ycombinator.com