1

There has been at least one notable case of a minor seller/brand shipping android phones with malware pre-baked, and some threads have already discussed that a factory reset won't necessarily kill everything if the system level has been tampered with.

Normally I presume if I get my phone from a carrier or major seller it can be relatively trusted, but what steps can/should you take getting a new device from a less trusted third party?

From a strict standpoint, nothing can ever be 100% secure in any meaningful way, but there's still generally a few categories for outcomes such as "low effort, decently audited" and "high effort, very audited"

1

I remember the case I had bought two cheaper Android phones from an eBay seller.

The two phones were factory packed as far as I could tell, taken right from the factory in China, and shipped to me directly. I found out that wasn't the case at all.

About 12-14 days after purchase, I noticed that the web browser would open an advertisement page once every so often. At first though, I thought it was a case of a rouge addon or something, but that wasn't the case. It got to the point that random apps would be installed on the phone without any warning or consent.

What in fact was the case was that the YouTube app was replaced with a clone that silently updated and maintained another rouge app that ran in the background. There was a logic bomb inside this rouge app (seemed to be a "authentic" lenovo factory baked app) that would run 12-14 days after a factory reset was done.

There was no user level or kernel level rootkit involved here. It seems to be quite hard to do, or at least hide them, because recent Android versions verify the device at the file system level with hashing on data blocks. A previous version of the android source page made reference of this, but I can no longer find it. I've added a link below for those interested.

https://source.android.com/security/

In my case, I found an alternative ROM to flash, but that still included rouge apps. In the end, I used the new ROM, and manually removed the rouge apps with ADB and a few other tools (ADB insecure and KingoRoot).

The lessons I learned from this include:

  • Physical authenticity does not translate to virtual authenticity
  • Modifying the "ROM" for android can be relatively easy to do
  • MediaTek chipset phones make this process even easier
  • IMEIs are quite easy to change on MediaTek chipsets
  • ADB (From Google's Developer Tools) is the only way to remove ROM based malware effectively
  • ADB insecure allows for PC access to a device's root user
  • The rouge app's install source must also be removed for a permanent fix.
  • Google's app verification doesn't seem to scan factory installed apps.
  • Removing rouge apps by hand is a long process.
1

If you are buying from an untrusted seller seems like the best you would be able to try is obtaining the images/ROMs (system.img, recovery.img, bootloader, any other firmware images)from a source that could possibly be trusted. It's been a long time since I looked at AOSP and I think CyanogenMod isn't what it used to be either... That being said putting images from a known source (if they can be obtained) would be a start; however, that wouldn't necessarily address hardware backdoors or firmware that could exist on the device that isn't flash-able. This also assumes that you could replace the bootloader or utilities that you would use to flash the device. jtag might be an option that you could explore as well.

Hope that helps some.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.