Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like secret messaging, which he had modified via a third party hacker/developer?
There were custom phones which had these kinds of apps, but I'm wondering whether this is doable without making a custom ROM or rooting the device (because then the actor has full control).
First of, you cannot rely on your "rooted" detection. The device could have been rooted, modified, and then all traces of intervention carefully erased.
Also, if the attacker has stolen an OEM certificate, they can "upgrade" any system app, injecting malware, without rooting and without manufacturer consent.
And, finally, as @Andrew-t explained, there may be backdoors in specific OEM version of the system, exploited by the attacker.
Yes if there is a vulnerability in the version of Android you are running, including a 0 day (undiscovered) vulnerability then that vulnerability can be exploited. You can never say something was not exploited. You can only say you have no evidence of the exploit. Sorry that's just how security works...
