Does rebooting a phone daily increase your phone's security?

Question

Recently, the Australian Prime Minister Anthony Albanese gave some advice to regularly reboot your phone to boost its security.

Apparently this advice is somewhat commonly given to legislators. This article from 2021 cites Angus King (independent U.S. Senator from Maine) giving the same advice. In that article, Neal Ziring, the technical director of the NSA is cited, as is an NSA publication for best practices on mobile phone security.

How does that work? How would rebooting your phone regularly make a meaningful difference to your security?

Answer 1

Rebooting a phone regularly helps cleaning non-persistent malware, i.e., malware that only exist in memory – and non-persistent malware alone, as explained in Paul Ducklin's Sophos blog article on the advice from Anthony Albanese. The article also lists other good tips for mobile security, as rebooting the phone regularly is not sufficient alone.

Executing arbitrary code on a system is a different task than achieving persistence, i.e. making the code run automatically after a reboot. It depends on the operating system how easy it is to a) write a binary to the disk and b) run that binary when the system starts or the user logs in, e.g., by adding a scheduled task or a registry key on Windows or a cronjob on Linux. While it is harder to gain similar persistence on iOS, there have been different kind of methods: preventing the reboot or making the user believe the system has rebooted while it didn't; see Persistence without “Persistence”: Meet The Ultimate Persistence Bug – “NoReboot” by the ZecOps research team.

The National Security Agency's Mobile Device Best Practices does not only list the mitigation, but it has a chart joining different kind of threats to the suitable mitigation. Turning devices off and on regularly is suggested as a mitigation for:

• Spearphishing (To install Malware)
• Zero-Click Exploits

Zero-click exploits are often non-persistent as, e.g., Costin Raiu describes in Kaspersky Daily blog:

How to protect from advanced spyware on iOS

Reboot daily. According to research from Amnesty International and Citizen Lab, the Pegasus infection chain often relies on zero-click 0-days with no persistence, so regular reboot helps clean the device. If the device is rebooted daily, the attackers will have to re-infect it over and over again.

This refers to Amnesty International's Forensic Methodology Report: How to Catch NSO Group’s Pegasus from 2021. On page 26, the report says:

Amnesty International’s investigations, corroborated by secondary information we have received, seem to suggest that Pegasus is no longer maintaining persistence on iOS devices. Therefore, binary payloads associated with these processes are not recoverable from the non-volatile filesystem. Instead, one would need to be able to jailbreak the device without reboot, and attempt to extract payloads from memory.

In other words, for advanced persistent threat (APT) actors there is an additional reason for not gaining persistence even when it could be possible: it is easier to hide the evidence of espionage when the malware is not written to a permanent storage.

Answer 2

Short answer: it might, but it depends.

To use an analogy, you could ask if changing your payment card PIN increases your card's security. The answer would be again that it depends:

• If you didn't use your card today, changing your PIN to a new (equally complex) PIN doesn't increase security (unless you gave it to someone or had your password database stolen).
• On the other hand, if you were in a Third World country and used your card at 10 distrusted stores, then changing it could increase security, since one of these stores could have spied on you.

So the long answer is that it depends on what your handheld did since its last reboot. If it stayed locked all the time and disconnected from networks, it is (almost) impossible that rebooting helps. Otherwise, it could help:

1. If your handheld was connected to the Internet, there is a chance that an OS flaw caused it to be infected (in particular if its OS is outdated).
2. If you opened a legitimate app like a browser, there is a risk that a vulnerability in it caused you to acquire malware.
3. Most importantly, if you opened a malicious app, it could have activated malware.

In any of these cases, rebooting won't help if the malware installed itself permanently, but as explained by Esa Jokinen here, there is a significant chance that the malware is not permanent.

So the answer to your question is that yes, on average, rebooting reduces vulnerability.

Now, if you were to ask if the advice you refer to makes sense, you would need to consider the costs. The value of that advice for a given person depends on how much it uses its handheld, how much it knows about security, how secure the device is, and how sensitive their use is.

Rebooting has some costs:

• Environmental impact
• Lost utility from the device
• Potentially having to reopen certain apps

And, assuming the reboot is manual:

• Time spent launching the reboot
• Mental stress to think about rebooting

In my case, I will definitely not be rebooting daily. And unfortunately, I'm afraid the less someone knows about security, the more misleading this kind of advice can be (unless its value is properly explained).