Should I be concerned about strange, new iPhone app appearing after repair?

Question

I had my iPhone battery replaced in a phone repair shop. After collecting it, I noticed that there is a strange new app installed, some "Chinese" web browser. It has no alphanumeric name and nothing in the interface was in English. I spoke with the technician who replaced the battery and he said that they didn't do anything with the phone, didn't even connect it to a PC.

Should I be concerned? There's plenty of sensitive data on it. It has never been jailbroken, I never visited any suspicious sites on it and I didn't connect it to any PC other than my trusty laptop.

Answer 1

Unless you can come up with some other explanation of how this happend, it sounds like your phone has been infected by some malware. It's impossible for us to say if the infection was the result of something the factory did or something you did. Either way, you should be very concerned. I'd recommend the following course of action:

• Make a backup of any data you have on the phone. (The backup could be infected, see this question, but if you have no earlier backup you either have to take the risk or lose your data.)
• Do a complete factory reset, wiping the phone clean.
• Change any passwords that has been stored on or entered on the device.

While you are only seeing one app, it might just be a symptom of a deeper infection. Just removing the strange chinese app may not be enough.

Answer 2

I would be very concerned. One thing I have learnt about security, in all the years I have been trying to understand it, is that if you didn't put something there, somebody else did, and if you don't know what it is doing then the only thing to do is reset, reinstall, and be happy with everything. If you don't know why that software is there, be assured, somebody put it there for a reason and it may be a good reason but it isn't your good reason so if that phone was mine I would save all my data, and only my data, and completely factory reset it.

Answer 3

Yes, and be concerned about more than your phone.

I can’t imagine a situation where an app was installed without your pin/password. without them first jail-breaking or otherwise significantly compromising your phone's OS. I think the only safe assumption is that anything your phone had access to, they also had access to.

So any account your phone has access to is suspect. Particularly any email account you have setup. Look for password reset emails, check your sent items etc. If you had any kind of financial app ( bank etc) check for odd transactions etc.

If that all looks fine, I’d follow the advice of others in terms of resetting the phone, but also go beyond the phone and reset all your important passwords etc.

Answer 4

The most concerning point is that the repair shop employee claims not to know anything about it.

The app may or may not be okay. If someone in the repair shop installs a new app, i.e. for testing if installing works again, this can be a problem, but doesn't have to be.

But if they tell you they do not know about it, either it was some malware installed it, or they are lying to you. And either way you cannot trust the phone anymore not to be infected with something which should concern you.

Answer 5

when the guy in store suggested to just delete it I did it without thinking. Here's the link to icon I found that looks the same, I suppose it's UC Browser. As I mentioned, everything was in Chinese, including name of the app. – Rafi Rosa

Yes, it was UCBrowser. This is a popular browser in China (since Google Play/Services are not available there) most Chinese phones actually come with this browser pre-installed.

I believe it was perhaps a way for the repair guy to test the phone in a familiar app... UCBrowser was found to have several flaws that would allow others to exploit, but mainly they'd only happen if you actually used the browser.

I have done a complete factory reset of my phone and changed all passwords that I used while using it. After that all of apps I have previously installed were restored by iPhone and all of my files were stored on iCloud, is it all I can do? – Rafi Rosa

I believe you did well. Even if it was just an app that the repair guy decided to use for testing, he might have done a lot more than just installing and using the browser. Not being honest/upfront about what they really did when they just needed to repair a battery is certainly not professional.

A factory reset and passwords change should be safe enough regarding your data. If the store does not have ways to profit from replacing other hardware in your phone, you won't notice any difference. However, if you need to be completely sure about its integrity perhaps a certified Apple store may perform a check and tell you what was really changed (not sure if they do this though).

Answer 6

I didn't see this addressed in the previous answers, so I thought I'd add:

If you are going to surrender control of your device, you should perform a backup and a factory reset beforehand. You should reset it again and then restore your backup when returned. It only takes a few seconds to copy your files or install malware.

It is too late in this case, but the mystery about "what happened" applies every time it leaves your control---not just this time because you noticed something wrong. Intruders usually try to avoid detection, so a good intrusion would be unnoticeable.

Answer 7

As already stated, anything done to your phone while out of your sight is definitely cause for concern and probably worth restoring from backup, as well as resetting passwords / 2FA for anything tied to that phone.

However, the exact way this icon got on your home screen would say a lot about how bad of a breach may be involved and how concerned to be. I can think of 2 options not already discussed:

1. An employee installed the app, but removed it from your list of purchased apps. You could check your purchase history in iTunes for hidden purchases to verify whether this has happened, even for a free app.

2. The icon was not actually an installed iOS App, but a bookmarked website / Progressive Web App that was pinned to the Home Screen for some reason to help with diagnostics. You could potentially verify this by checking your Safari history for any activity during the time your phone was at the shop. Clearing the history/cookies would erase the tracks for this, but if that's what happened then the 'app' itself isn't really a cause for alarm.

Answer 8

Yes you should be concerned.

Do a factory reset.

If you have backed up your iPhone since before the app, your in luck. If you didn't, less great but still preferable to wipe it clean and start over.

Answer 9

if you gave access to the phone to the store, the new app might not be in the list of your purchased apps, simply because an employee in the store logged off, and installed it with their user.

Nonetheless, I would still handle the phone and passwords used/cached there as potentially compromised.

However, as mentioned in my first paragraph, the app installation might be just routine, and someone forgot to delete it.

Answer 10

I would recommend you to replace your phone instead of resetting it. The store has had the access to the phone's hardware and firmware and could have replaced them with malicious counterparts in addition to installing this app.