0

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is probably running on the OS/firmware level, I'm going to try and do a clean install of the OS. However, I'm not sure as to how I can safely back up my personal data first. I don't want to back up any app data or settings whatsoever, just some documents and pictures and a messenger chat backup, using Google drive and an external USB drive. But every time I plug the USB in via OTG cable, all these unnecessary system files like com.kms.free, com.sec.android.gallery3d, com.google and such automatically get loaded onto the USB. I'm guessing these files are coming from my external sd card, as I read in another thread here that the OS creates some back up files on external media in case it fails to boot from the system partition. But assuming some malicious exploit is running on firmware level, these files could potentially infect both the USB and sd card, and thus by restoring any files from them, I will probably risk reinfection.

Is there any way to stop this autobackup of system files and safely backup and restore only my personal data from the USB and Google Drive? I learnt that if the exploit is in firmware or OS level, formatting doesn't help either, so I'll probably have to ditch the external SD card altogether. But I want my USB drive to avoid this infection, so that the personal data on it can be restored safely on the clean device. Same goes for the documents I have on Google drive, how can I be sure that the data uploaded to it is clean and therefore safe to restore?

Please help me out a little, I'm really in a bind here. Need some guidance urgently, phone has become very unstable.

0

Great question. Sorry to hear about your phone. If your phone still functions, you can back up to cloud. Google Drive being one highly integrated options. Just save your files to your cloud (I'd create a separate folder so you can clearly see if any malicious looking files end up there somehow, unlikely but worth looking). Then do a OS reset and wipe the SD.

This phone also has a wifi-direct option so you could use that to transfer files. https://www.verizonwireless.com/support/knowledge-base-210398/

If you can't make those happen, and assuming you are correct that the USB backup options is dumping malware... really the only option left is manually wiring into the storage on the phone and that is pretty next level hardware stuff. I'd say worse case take the full back up to usb, then sort through for your files and delete the rest. Be careful to make sure you do the backup to a computer you can "wipe" if needed or infected (not likely as different OS, but I'd be careful).

  • thank you for the response. I understand wiping a SD card/USB is different from a simple format as in wipe overwrites all data and makes it irrecoverable? Could you recommend some good wiping software for all kinds of drives - SD card, USB drives, hard drives? Because I've searched online and while I found a few, I don't know which would be a trusted one and will do its job efficiently. – Sabi Dec 14 '18 at 17:02
  • Also, worst case, if I had to use the USB for backup, I could just scan the drive using an antivirus on a computer, would that work? Because I wonder how effective Windows antiviruses are in detecting android malware, though the companies for both the products are always the same. I have a Total Security suite right now that claims to run PC to mobile scans, so wondering if it could detect the USB infected with Android malware – Sabi Dec 14 '18 at 17:03
  • I'm trying to back up to cloud but don't think storage will be sufficient @bashCypher – Sabi Dec 15 '18 at 6:58
  • @sabi you should be able to puchase as much cloud space as you need. Also you can try and scan the drive but I honestly can't say if it will detect it. I know some scanners will detect mulit platform virus. – bashCypher Dec 17 '18 at 19:06
  • Thank you very much for your detailed answer. Appreciated. – Sabi Dec 18 '18 at 12:02
0

Assuming your attacker has no way to persist through firmware flashing then I advice you check and see if you can install Lineage OS or other custom ROMs to your android Infecting firmware is one thing but I know rare cases where it’s much deeper than that. Hopefully it’s not else you’ll really have to throw away your phone and get a new one. I also suggest finding a way to check and see if your modem/router has been infected too as most threat actors of this level infects even network devices.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.