I remember the case I had bought two cheaper Android phones from an eBay seller.
The two phones were factory packed as far as I could tell, taken right from the factory in China, and shipped to me directly. I found out that wasn't the case at all.
About 12-14 days after purchase, I noticed that the web browser would open an advertisement page once every so often. At first though, I thought it was a case of a rouge addon or something, but that wasn't the case. It got to the point that random apps would be installed on the phone without any warning or consent.
What in fact was the case was that the YouTube app was replaced with a clone that silently updated and maintained another rouge app that ran in the background. There was a logic bomb inside this rouge app (seemed to be a "authentic" lenovo factory baked app) that would run 12-14 days after a factory reset was done.
There was no user level or kernel level rootkit involved here. It seems to be quite hard to do, or at least hide them, because recent Android versions verify the device at the file system level with hashing on data blocks. A previous version of the android source page made reference of this, but I can no longer find it. I've added a link below for those interested.
In my case, I found an alternative ROM to flash, but that still included rouge apps. In the end, I used the new ROM, and manually removed the rouge apps with ADB and a few other tools (ADB insecure and KingoRoot).
The lessons I learned from this include:
- Physical authenticity does not translate to virtual authenticity
- Modifying the "ROM" for android can be relatively easy to do
- MediaTek chipset phones make this process even easier
- IMEIs are quite easy to change on MediaTek chipsets
- ADB (From Google's Developer Tools) is the only way to remove ROM based malware effectively
- ADB insecure allows for PC access to a device's root user
- The rouge app's install source must also be removed for a permanent fix.
- Google's app verification doesn't seem to scan factory installed apps.
- Removing rouge apps by hand is a long process.