8

This question is a simple one: how much can you trust the "factory restore/reset" option on an android device?

If the device has possibly been compromised, is it possible the "factory reset" will be compromised as well, leaving artifacts of the infection after it is run?

If the device has been rooted, or were to be rooted, would this change anything?

(Also, I recently posted this question about whether or not it is possible to backup and android so it can bu run on a virtual machine, if you would like some background on why this might be an issue.)

|improve this question
  • Not much, but it depends what the compromise was about. If it's just "automated" attacks like drive by downloads I don't think they would go through the hassle of creating code that can compromise the recovery partition (as it would need to be adapted to every single smartphone model). However, if it's a targeted attack then it's definitely possible. – user42178 Mar 31 '15 at 14:04
  • And this shows just how awful the Android ecosystem is, as no manufacturer is willing to provide clean images of their firmware to be reinstalled in case of compromise. Even Apple (a much more locked-down and proprietary platform) allows to freely download and reinstall their firmware images. – user42178 Mar 31 '15 at 14:06
  • More: if you choose to reflash your phone thinking it will surely restore everything, mind that, theoretically, a compromised bootloader can still survive reflashing the bootloader self. I said theoretically. – usr-local-ΕΨΗΕΛΩΝ Jul 19 '18 at 17:56
2

Might be a dup, see this answer: https://android.stackexchange.com/questions/6541/can-a-factory-reset-fix-malware-problem.

The short answer is that factory reset may not be enough to unroot your system if it has been rooted.

|improve this answer
1

According to "Security Analysis of Android Factory Resets"

"We recovered Google tokens in all devices with flawed Factory Reset, and the master token 80% of the time. Tokens for other apps such as Facebook can be recovered similarly.

These two alternative partial solutions from Hacker News (can't find original source)

  1. Remotely wiping the smartphone by hitting "factory reset" as if the phone were stolen
  2. Updating the phone to a new version of Android OS that allows for encryption with a passcode
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.