Android 14 blocks all modification of system certificates, even as root
No, it doesn’t. It moves the certificates to an APEX that gets updated rather than letting the five year old storage full of expired and otherwise distrusted certificates rot when manufacturers stop caring about your device.
Rooted phones have full control, especially the Magisk rooted ones. The root daemon is packaged into the boot image, it runs before Android can bootstrap its APEX mechanism.
Someone will have to write a new Magisk module to work around the sandboxing. That’s annoying, but I’m sure the moment Android 14 actually hits the majority devices used in the real world (usually a quarter to half a year later) I’m sure someone will have written one. Worst case scenario, someone will write an LSPosed module to hook the API calls for the system certificate store.
This is inconvenient but not the end of the world.
Previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing Magisk or any tools at all, just by writing to disk. Right now, that’s widely used and included in the setup guides for lots & lots of tools. All of that will start breaking for users when Android 14 arrives.
I totally agree it is possible to work around this restriction, but it’s going to be significantly more complicated, and those changes will only be required because the OS used to let you read & write these files all by yourself, and now it doesn’t.
I don’t think Android should move further in a direction where it’s impossible to directly control anything unless you install a 3rd party modification to the root daemon. That’s not a good result. These are important settings and the OS itself should allow you to control them (behind reasonable safeguards & warnings, but still).
What tools are injecting certificate authorities into the system image?
Android is still open source and AOSP and other ROMs will work without this APEX. That means system image modification tools should also be able to overrule Google’s package and set up their own certificates.
Users haven’t had control over their devices without root from Android’s inception and the system certificate store has been out of normal people’s control since Android 7.
In my opinion, this whole issue is just a minor inconvenience caused by a major improvement to the Android OS as a whole. People will figure it out.
And then Google will punish them for figuring it out by letting apps block access. That’s the issue. If you could do all this without Google integrity checking, we wouldn’t have to worry.
This is modifying system CA certs on your own device, with root access. There’s plenty of examples in the article, but most commonly you’d want to add your own CAs so that you can intercept and inspect your own network traffic. There’s a wide world of developer/researcher/reverse engineering tools that do exactly that, there’s a demo here: https://httptoolkit.com/android/
It could plausibly be malicious, but it requires direct root access on the device, and if somebody has root access there’s already far more malicious options available to them so it’s not a meaningful threat in any sense.
No, it doesn’t. It moves the certificates to an APEX that gets updated rather than letting the five year old storage full of expired and otherwise distrusted certificates rot when manufacturers stop caring about your device.
Rooted phones have full control, especially the Magisk rooted ones. The root daemon is packaged into the boot image, it runs before Android can bootstrap its APEX mechanism.
Someone will have to write a new Magisk module to work around the sandboxing. That’s annoying, but I’m sure the moment Android 14 actually hits the majority devices used in the real world (usually a quarter to half a year later) I’m sure someone will have written one. Worst case scenario, someone will write an LSPosed module to hook the API calls for the system certificate store.
This is inconvenient but not the end of the world.
Previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing Magisk or any tools at all, just by writing to disk. Right now, that’s widely used and included in the setup guides for lots & lots of tools. All of that will start breaking for users when Android 14 arrives.
I totally agree it is possible to work around this restriction, but it’s going to be significantly more complicated, and those changes will only be required because the OS used to let you read & write these files all by yourself, and now it doesn’t.
I don’t think Android should move further in a direction where it’s impossible to directly control anything unless you install a 3rd party modification to the root daemon. That’s not a good result. These are important settings and the OS itself should allow you to control them (behind reasonable safeguards & warnings, but still).
What tools are injecting certificate authorities into the system image?
Android is still open source and AOSP and other ROMs will work without this APEX. That means system image modification tools should also be able to overrule Google’s package and set up their own certificates.
Users haven’t had control over their devices without root from Android’s inception and the system certificate store has been out of normal people’s control since Android 7.
In my opinion, this whole issue is just a minor inconvenience caused by a major improvement to the Android OS as a whole. People will figure it out.
And then Google will punish them for figuring it out by letting apps block access. That’s the issue. If you could do all this without Google integrity checking, we wouldn’t have to worry.
Wait, what tools, and why would they need you to modify existing certificates? That’s super sketchy.
This is modifying system CA certs on your own device, with root access. There’s plenty of examples in the article, but most commonly you’d want to add your own CAs so that you can intercept and inspect your own network traffic. There’s a wide world of developer/researcher/reverse engineering tools that do exactly that, there’s a demo here: https://httptoolkit.com/android/
It could plausibly be malicious, but it requires direct root access on the device, and if somebody has root access there’s already far more malicious options available to them so it’s not a meaningful threat in any sense.