1

*For the purposes of this post, Software OS Update == Firmware Upgrade. For instance when the device notifies you that there is a OS Software Update, this could also modify the firmware of the device.

QUESTION: I have been given an untrusted Android device recently which may or may not have malware of any type on it. Let's be clear, there is no suspicious activity, but I cannot personally confirm its history. Let's assume the worst case scenario, and that the device is infected with some sort of unknown sophisticated malware. Under these circumstances, is it:

  1. Preferable to first wipe the device in order to remove any malware that may interfere with the firmware upgrade?

  2. Or it is preferable to first upgrade the firmware and then wipe the device to prevent any malicious firmware with interfering with either the wiping of the device or the upgrading of its firmware?

*POSTNOTE: I know many will suggest it won't make a difference. Please pick the best option, and explain why. Also, I would like this question to pertain to more than just Android, to avoid posting duplicate Windows/Linux based questions. If possible please address any differences if the OS and firmware will affect the answer. Thank you.

  • why not both to be on the safe side? - is it hurting you if you first wipe the device, then install/upgrade the firmware from a trusted source and after installing, wipe it again? --> many tutorials for installing custom roms advise exactly this... – DJCrashdummy Jan 4 '17 at 10:56
  • I was particularly interested in the correct order. I know most malware is not sophisticated enough to interfere or slipstream itself with a software update, however something in the firmware may be able to survive. In this case, the only option is an OTA update, so the other answer by Surendra Patil is probably safest but not necessary applicable to every scenario. – user58446 Jan 5 '17 at 22:02
1

Get recovery tool from original website or trusted source. Grab a memory card, scan it properly using antivirus tool using your laptop. Later flash the firmware from memory card, along with it wipe all data of mobile ( custom options are available in recovery). After the firmware is installed, remove memory card (before booting for first time). Factory reset it once it is booted for first time...

Note: Download original firmware from trusted site. Avoid using custom Rom's made by non-experienced user. You can use apps like "Netstat plus" to monitor your device activity while you are connected to internet.

I have a personal experience, I have seen some custom ROM's tracking all my activity.

  • And what if an OTA Update, meaning updating only through the operating system while it is running, is the only type available? – user58446 Jan 5 '17 at 22:04
  • 1
    OTA will retain previous installed applications, it will only have security patches. So if an application like "mspy" is installed, then even after OTA update the application "mspy" will still be present. Using OTA your device still remains compromised. – Surendra Patil Jan 6 '17 at 2:34
  • Also not only having purchased tool , there might be an application installed made by someone having a payload and name as "security policy update" or anything which looks similar to some system file name then even after OTA update the file still will be present in your device. It depends why the OTA was sent, if it was to patch that security bug already present in all devices of that manufacturer with same version of software then it will remove that bug. But if you think someone manually did some changes in it then OTA will not be able to remove it. – Surendra Patil Jan 6 '17 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.