I'm thinking of buying my next phone refurbished rather than new, since I can easily get something that meets my needs for a lot cheaper. But one concern is whether something might get surreptitiously installed on the phone before it gets to me.

The phone will be an Android of some description (haven't picked a model yet, but leaning towards a refurbished Samsung S8).

Once I get the phone, what's the ideal way to ensure that it's completely clean. I'm planning to at least do a factory reset, but I'm looking for other things I can do to ensure that the image being used is clean (e.g. getting an image direct from the Manufacturer and use it as the recovery image).

I'd like to be able to get this down to a reasonably solid checklist of precautions and checks to perform.

Threat-model wise, I'm more concerned about malware here than nation-state actors, so I can live with being unable to protect against possibilities that require a highly sophisticated and well resourced adversary (e.g. hardware implants).

  • Factory reset, flash new firmware, and you are good to go.
    – ThoriumBR
    Commented Nov 15, 2019 at 0:36
  • That covers the basics - are there any other steps to consider or checks that are worth performing? Commented Nov 15, 2019 at 0:38
  • Even model specific checks (e.g. for a Samsung, it may be worth checking the status of the Knox e-fuse - though I'm not sure if there's anything extra that can be done if it's been tripped). Commented Nov 15, 2019 at 0:39
  • We can't list all the different possible model-specific checks. So, in general, the duplicate has your answer. If you have a specific model question, then you could ask over at android.stackexchange.com
    – schroeder
    Commented Nov 15, 2019 at 9:03


Browse other questions tagged .