47

Recently, the Australian Prime Minister Anthony Albanese gave some advice to regularly reboot your phone to boost its security.

Apparently this advice is somewhat commonly given to legislators. This article from 2021 cites Angus King (independent U.S. Senator from Maine) giving the same advice. In that article, Neal Ziring, the technical director of the NSA is cited, as is an NSA publication for best practices on mobile phone security.

How does that work? How would rebooting your phone regularly make a meaningful difference to your security?

1

2 Answers 2

46

Rebooting a phone regularly helps cleaning non-persistent malware, i.e., malware that only exist in memory – and non-persistent malware alone, as explained in Paul Ducklin's Sophos blog article on the advice from Anthony Albanese. The article also lists other good tips for mobile security, as rebooting the phone regularly is not sufficient alone.

Executing arbitrary code on a system is a different task than achieving persistence, i.e. making the code run automatically after a reboot. It depends on the operating system how easy it is to a) write a binary to the disk and b) run that binary when the system starts or the user logs in, e.g., by adding a scheduled task or a registry key on Windows or a cronjob on Linux. While it is harder to gain similar persistence on iOS, there have been different kind of methods: preventing the reboot or making the user believe the system has rebooted while it didn't; see Persistence without “Persistence”: Meet The Ultimate Persistence Bug – “NoReboot” by the ZecOps research team.

The National Security Agency's Mobile Device Best Practices does not only list the mitigation, but it has a chart joining different kind of threats to the suitable mitigation. Turning devices off and on regularly is suggested as a mitigation for:

  • Spearphishing (To install Malware)
  • Zero-Click Exploits

Zero-click exploits are often non-persistent as, e.g., Costin Raiu describes in Kaspersky Daily blog:

How to protect from advanced spyware on iOS

Reboot daily. According to research from Amnesty International and Citizen Lab, the Pegasus infection chain often relies on zero-click 0-days with no persistence, so regular reboot helps clean the device. If the device is rebooted daily, the attackers will have to re-infect it over and over again.

This refers to Amnesty International's Forensic Methodology Report: How to Catch NSO Group’s Pegasus from 2021. On page 26, the report says:

Amnesty International’s investigations, corroborated by secondary information we have received, seem to suggest that Pegasus is no longer maintaining persistence on iOS devices. Therefore, binary payloads associated with these processes are not recoverable from the non-volatile filesystem. Instead, one would need to be able to jailbreak the device without reboot, and attempt to extract payloads from memory.

In other words, for advanced persistent threat (APT) actors there is an additional reason for not gaining persistence even when it could be possible: it is easier to hide the evidence of espionage when the malware is not written to a permanent storage.

7
  • 3
    Does this reasoning apply equally to computers that are not phones? Commented Jun 23, 2023 at 11:56
  • 8
    @preferred_anon It does, but legacy-ish desktop OSes make it a lot easier for malware to gain a persistent foothold than mobile OSes do, and much harder for AVs to detect them.
    – Sneftel
    Commented Jun 23, 2023 at 12:50
  • 12
    This answer leaves part of the picture unstated: rebooting doesn't prevent your phone getting hacked. But it makes it much less likely that it's compromised while you're sending an important text or email, or making any given phone call, or doing online banking. Instead of months of your data, the bad guys get maybe 1 day. That's not perfect, but it's still a lot better. Commented Jun 23, 2023 at 18:10
  • 1
    @preferred_anon, computers, not so much -- most computer malware is persistent. But router/IOT malware usually isn't persistent, so rebooting will clear it until the next time you get infected.
    – Mark
    Commented Jun 24, 2023 at 1:25
  • 1
    I don't disagree what is written here, however it's worth mentioning that for an individual under active attack persistent rebooting at a regular interval will not resolve the threat of infection. If the goal is to remove attackers access without patching, then you'll need to reboot before any sensitive information is entered into the device, and after it has been deleted. Commented Jun 26, 2023 at 0:58
0

Short answer: it might, but it depends.

To use an analogy, you could ask if changing your payment card PIN increases your card's security. The answer would be again that it depends:

  • If you didn't use your card today, changing your PIN to a new (equally complex) PIN doesn't increase security (unless you gave it to someone or had your password database stolen).
  • On the other hand, if you were in a Third World country and used your card at 10 distrusted stores, then changing it could increase security, since one of these stores could have spied on you.

So the long answer is that it depends on what your handheld did since its last reboot. If it stayed locked all the time and disconnected from networks, it is (almost) impossible that rebooting helps. Otherwise, it could help:

  1. If your handheld was connected to the Internet, there is a chance that an OS flaw caused it to be infected (in particular if its OS is outdated).
  2. If you opened a legitimate app like a browser, there is a risk that a vulnerability in it caused you to acquire malware.
  3. Most importantly, if you opened a malicious app, it could have activated malware.

In any of these cases, rebooting won't help if the malware installed itself permanently, but as explained by Esa Jokinen here, there is a significant chance that the malware is not permanent.

So the answer to your question is that yes, on average, rebooting reduces vulnerability.

Now, if you were to ask if the advice you refer to makes sense, you would need to consider the costs. The value of that advice for a given person depends on how much it uses its handheld, how much it knows about security, how secure the device is, and how sensitive their use is.

Rebooting has some costs:

  • Environmental impact
  • Lost utility from the device
  • Potentially having to reopen certain apps

And, assuming the reboot is manual:

  • Time spent launching the reboot
  • Mental stress to think about rebooting

In my case, I will definitely not be rebooting daily. And unfortunately, I'm afraid the less someone knows about security, the more misleading this kind of advice can be (unless its value is properly explained).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .