4

I have a Samsung S9 phone that has been exploited by my neighbor, however I am unsure as to how to prove/verify it, how in depth the access is to my phone, or how I can re-secure my phone.

It seems as though they have access to everything on my phone. They have also talked through the speaker of my phone to me a couple of times as though the phone had a call in progress on speakerphone however there was no indication of it on the phone.

They have also been able to follow where I go using my cell phone. I ruled out them tracking me through location data in a Google account by removing all Google accounts from my phone.

I scanned for viruses and malware and on the phone using Kaspersky Endpoint Security and discovered a malicious .apk that was detected as a trojan virus (HEUR.RiskTool). I’m assuming this not a false positive because there is absolutely no information available anywhere online for it.

KasperSky Endpoint Security Virus Detection

I first tried removing/quarantining it using Kaspersky Endpoint Security, however I received the following error(s):

“File quarantine failed: file is in use or permission to delete file is missing”

“Cannot delete file: file is in use or permission to delete file is missing”

I tried to delete the file manually, however the phone is not rooted so I did not have the required permissions to do so.

Then I tried rebooting the phone into safe mode and disabling the .apk through the applications list, however it was not present in the applications list.

I then tried to remove the .apk by factory resetting the phone, however the .apk still present after the factory reset. After that I thought it might be due to a custom rom being on my phone.

I attempted to flash the partitions on the phone back to factory defaults, however I was unable to do so since the phone was not rooted. I thought that possibly they were able to un-root my phone, install a custom rom on it, and then lock the phone back up, but I am unsure as to how to verify that. Is this at all possible?

I checked the current build number on my phone, and it appears to be the correct current build: R16NW.G960USQS3ARIB

enter image description here

Any information that would help me understand, backtrace, and/or remove this would greatly appreciated...

  • How did it get there if I do not have root access and did not download the malicious .apk directly, and the hacker had no physical access to my machine? Is it possible to have a virus installed to the phone via wifi or bluetooth without me ever having known it happened?

  • How can I back trace it where it came from?

  • How can I check the permissions of the malicious .apk to see what it has access to on my phone if the .apk doesn’t show up in the applications list, even in safe mode?

  • How can I identify if a custom rom has been installed onto my phone allowing remote access to my phone?

  • Is it possible for the phone to have been rooted, and then locked back up after the apk/custom rom was installed to prevent me from removing it?

  • Is there any way to re-flash the partitions on the phone back to factory defaults to remove the malicious .apk even if I do not have root access? All of the methods I could find required root access to the phone in order to re-flash anything.

2

Check your CO detectors.

Jokes aside, I'd like to preface my answer with this: I find it highly unlikely that your neighbor is using remote exploits against you. The risk model doesn't support it. Unless you work for the government or are part of an international organization (legal or otherwise) no one is going to burn very valuable exploits on you. This is the sort of thing the CIA pulls. I don't believe you have been hacked.

Additionally, the virus scan report does not actually show anything amiss. CANID is a Verizon caller ID service and is not malicious as noted by the report. It "can" be used by attackers, however I've not been able to find any public reports of how this exploit works so I'm assuming it's either very old or just an incorrect flag in the database.

But to answer your question as asked:

Identifying the source

This is very unlikely in your situation as you don't actually have proof of comprise (and so have no where to start). Android does not log network traffic and so you don't have anyway to know where anything you may find came from.

Verifying OS authenticity

Barring exploits against the bootrom, the only way an attacker could have installed a different, patched firmware is through an unlocked bootloader. This status can be checked by rebooting your device to fastboot mode and running fastboot oem device-info with a connected machine. If the bootloader is unlocked, you can be attempt to relock the bootloader. If the device no longer boots/fails chain verification you can know that the firmware is inauthentic.

Additionally, since this is a Samsung device it has a KNOX e-fuse which is an additional indicator for tampering. This fuse, once tripped, is not generally resettable. The fuse is tripped by the bootloader if the bootloader has ever been unlocked. The fuse state can be checked by booting into download mode and pressing volume up.

Recovering

As noted above, I don't think you have been attacked. If you do, however, still believe something is wrong you can reflash the full system image using Odin. Note that this works no matter the bootloader state as these images pass cryptographic verification as they are signed by Samsung and are authentic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.