From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like secret messaging, which he had modified via a third party hacker/developer?

There were custom phones which had these kinds of apps, but I'm wondering whether this is doable without making a custom ROM or rooting the device (because then the actor has full control).


2 Answers 2


First of, you cannot rely on your "rooted" detection. The device could have been rooted, modified, and then all traces of intervention carefully erased.

Also, if the attacker has stolen an OEM certificate, they can "upgrade" any system app, injecting malware, without rooting and without manufacturer consent.

And, finally, as @Andrew-t explained, there may be backdoors in specific OEM version of the system, exploited by the attacker.


Yes if there is a vulnerability in the version of Android you are running, including a 0 day (undiscovered) vulnerability then that vulnerability can be exploited. You can never say something was not exploited. You can only say you have no evidence of the exploit. Sorry that's just how security works...

  • Welcome to the community. Sorry, but this has barely have something to do with 0 days in the apps themselve. But the comments answeered my question already and someone is welcome to sum it up in a well written answer though ;-) Mar 9, 2023 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .