Smartphone Hardening: Samsung

A smartphone like the Samsung S4 bought only a few years ago will most probably run Android 4.4.x "Kitkat" (or 5.x  if upgraded), as this is the stock ROM it contained right after market introduction. New devices are still sold for ~ 150€ running Android 5.x "Lollipop" which is nearly equally old. I already flashed Cyanogenmod 11 back then to have more control over the device along w/ root access which enabled me to configure netfilter and install VPN S/W. But if you follow the Android OS version history it becomes immediately clear that  - as the ppl at LineageOS state - 7/10 run outdated operating systems on their phones. This is a matter of upgrading your device, and that is what I just did, involving testing of lots of different ROMs and Android versions, which I'm going to skip in this post.

GT-I9506

The steps to upgrade a S4 LTE (official release date may 2013) from 4.4.x to a quite actual and rooted 8.1 "Oreo" are as follows if you reduce them to the minimum and exclude all the time spent on testing and research: Step 1: Use heimdall to flash TWRP recovery system onto the device. This can simply be done from the commandline after you put the phone in Download Mode (by pressing VolumeDown+Power while turning the phone on):

sudo heimdall flash --verbose --RECOVERY recovery.img

Step 2: Use heimdall to flash an updated baseband firmware containing an updated kernel and phone/modem related firmware. I prefer the GUI for that step as it gives a far better overview of what we are doing. This is not as hard as it looks: After you downloaded the .tar file, extract it to a temp folder and see which files it contains. Afterwards, use heimdall to download the devices partition layout table (PIT). Next thing to do is select the PIT file, then hit the "Add" button and select each partition and its according file from the folder you extracted the .tar file, select "No Reboot" and "Resume" and finally hit the start button. Step 3: Flash a new ROM onto the device via TWRP. Start the Device by pressing VolumeUP + Home + Power to enter its recovery mode. From there, select relevant files in the right order (and compare its checksums) which in my case were:

lineage-15.1-20180915-UNOFFICIAL-ks01ltexx.zip d3213c4895e2565ee3a7f3dd0d47aedcbe9f621eb8f89f9c51351d92573ae5dd
addonsu-15.1-arm-signed.zip  b5cc465abb3d9b7ad0177e74693e1bbd085775fd38808f640be537e8dcd1a3e8
open_gapps-arm-8.1-nano-20181013.zip  e544ad0aea8702d73f2b2451e42c83cb96157881ce7879dcdea11e2bb4835718

It appears to me that it is easily possible - and even by means of only using freely available S/W - to update all those horribly insecure smartphones out there, and it's even far more easy to achieve than back in the days. So - I ask myself - why is there no public service offered by the shop you bought your phone at that enables non-technical ppl to get this done eradicating that bad thing called planned obsolescence

SM-T585

Upgraded from stock Android 6.0 onto LineageOS 15.1 / Android 8.1 on a SM-T585 Tablet (2016) as well (search for "sm-t585" or "gtaxllte" for relevant TWRP and LineageOS images):

sudo heimdall flash --verbose --RECOVERY recovery.img
Initialising connection...
Detecting device...
      Manufacturer: "SAMSUNG"
           Product: "Gadget Serial"
...
100%
RECOVERY upload successful
Ending session...
Rebooting device...
Releasing device interface...

Interesting to note that this time the device itself does not really get identified. Last but not least: Do not forget to create and redundantly store  backups of the device(s) when finished w/ configuration et al.

GT-I9195i

Doing the same for a S4 mini LTE a.k.a. GT-I9195i a.k.a. serranoveltexx (official release date june 2014) running stock android 4.4.4. TWRP already flashed, important to note that heimdall v1.4.2 - as for the two previous devices - had to be built from source to really work:

git clone https://gitlab.com/BenjaminDobell/Heimdall.git
cd Heimdall
cmake . && make && sudo make install

Remember to install some dependencies (like libusb-dev, libqt5 etc.) mentioned in cmake warnings / errors and it builds w/o error and flashes the device successfully. Flashing a lineage 14.1 image now is only a matter of copying relevant ZIP files and MD5 sums of OpenGapps, addonsu and the image itself to SD (or USB-OTG) and booting the device into recovery, doing a factory reset and installing the following sha256 checksummed files:

lineage-14.1-20191010-UNOFFICIAL-serranoveltexx.zip 92715821b7dd4c1906512e75dd8327c50af3eeb5865626a65a04907b1e900704
open_gapps-arm-7.1-nano-20191012.zip 97420755446608ea226817322883192ba0c56ce4703feed9c52dc3344656ab2b
addonsu-14.1-arm-signed.zip 1c0953b2eb3c5d2e88eeb7df4d60709aeb18e8acf56fb380ce83f5acb3dcbb8f