2

I suspect somebody has installed a spyware in my android smartphone. I have done factory reset, which is supposed to uninstall all apps in SD card and internal memory. I am curious about following.

Is it possible to store an android apk in SIM card (not SD card) and install it from there ? If yes, does a factory reset uninstalls such an app (or spyware) ?

Improve this question

1 Answer 1

Reset to default
8

No. SIM card is generally very small (32kb ~ 64kb) and stores only TLV records, which is not really suited for apk (though technically it can still be possible to store it as a binary record, but is technically very challenging).

Factory reset restores an image which is stored in a system partition on the phone, so if the spyware has somehow been able to successfully corrupt the factory image, then it would again be restored on factory reset. However, such modification can be done only when your phone is rooted (has su binary) or when your bootloader is replaced by an infected bootloader (Most android phones have specific key sequence to be pressed in order to access bootloader, check xda forum for your phone model). Probably that is how malware is able to reinstate back on factory reset.

Improve this answer
5
  • great reply, thanks , that was helpful. cud u plz tell me the followings. 1) how to find the storage capacity and contents of a SIM card ? 2) how to detect if my factory image is corrupted ? 3) can password protected androids be compromised assuming the attacker does not know the password ?
    – user2917687
    Commented Nov 18, 2013 at 10:39
  • Also 4) also (refer your reply), if attacker rooted my phone and corrupted the factory image and then i unroot it, what will happen then. will i still have corrupt factory reset ?
    – user2917687
    Commented Nov 18, 2013 at 10:42
  • 1
    Generally the storage of SIM card is accessible by specialized smart card readers (SIM card is smart card which follows specific standards), you would also need special software that can understand the SIM card data format (google "sim reader" for more info).(2) its very difficult to determine, easy task is to dump the image and calculate its sha1 hash and compare it against image obtained by manufacturer's site or another phone which you believe to be not infected.
    – adarshaj
    Commented Nov 21, 2013 at 3:01
  • 1
    (3) I think you meant to say encrypted android storage, I'm not very sure, but I'd think that once you are running, attacker would have access to filesystem in unencrypted state, so infecting it would be as easy as non-password protected one. But ofcourse, if the attacker tries to do it when your phone is not in running state, then you'd have an advantage as its very difficult to decrypt the storage.
    – adarshaj
    Commented Nov 21, 2013 at 3:01
  • 2
    @user2917687: (4) unrooting will simply remove su binary executable and probably replace the bootloader, infected image would still remain, the only possible way is to either figure out the exact corrupt file or reflash the ROM with factory image (the process varies greatly across various devices, refer xda forums)
    – adarshaj
    Commented Nov 21, 2013 at 3:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .