Adam Outler made a comment on Security on G+ although I don't know what he's exactly referring to:
https://plus.google.com/1047110401102224722...sts/gu7bXTWstoM *Did you know that every AT&T/Verizon Samsung Galaxy S4 device has a huge security vulnerability that you can't patch? *
Same goes for the Note 3!
You know what's more important than Carrier Unlocking? Bootloader unlocking.While politicians are arguing over being able to use your phone on a different network at the end of your contract there's a huge security issue plaguing Android. This issue is compounded by the fact that even though there are fixes available, those with the knowledge cannot fix them because modifying the kernel is prohibited by the boot loader under policies enforces by the carriers, and implemented by manufactures designed to
prohibit you from being able to do things which they didn't intend for you to do with your device. This would be fine, except it takes months for the manufacturers and carriers to apply their tweaks to the latest versions of android/kernels and deploy them.
On the other hand, hacker tools like Xposed and +Jay Freeman's Substrate can have the necessary modifications available within hours, for every device. But again, with an locked bootloader, many times it is impossible or impractical for any user to be able to apply an exploit, and then a security-enhancing modifications to their device.. Especially before the bad guys apply the exploit, their tweaks, and a patch to ensure it cannot be removed.
In 1 year, every carrier-provided Galaxy S4 will hit its 18-month update window and become a huge security risk. The Galaxy S3 stops receiving updates in 6 months. The Galaxy S2 has already stopped. These devices are not just a risk, but a security hazard to even have share a WiFi network with a desktop compute (especially Windows). So we really need to stop beating around the bush with requesting carrier unlocks and ask for bootloader unlocks.
UPDATE: This is the vulnerability (Adam Outler provided the link to my question)
https://www.codeaurora.org/projects/securit...i-cve-2013-6282Looks like our wonderful friends at vroot are using this vulnerability to make rooting possible.
This post has been edited by joytest: Nov 16 2013, 03:46 AM