Database Info

How safe are used phones?

I am looking to buy a used captivate soon and I had an alarming thought..
To make purchases from google market you do have to enter credit card info..
So what if someone bought the phone, installed monitoring software on the phone, turned around and sold it.. They could break even on cost.. *AND* if they were lucky when someone else went to use the phone.. they would get the cred card info of that person..
And on ebay/craigslist... its not like you could pin it back to the person very easily..
Assuming I bought a phone and master reset it would that fix any possibly problems? I know in windows you reinstalling the OS will usually wipe just about anything out..
However, I know that if you have root.. on a phone you can do far more.. I don't know if having root would be enough to put something on the phone that could not be gotten rid of with a simple master reset.
I am sorry if this sounds paranoid.. But, I am a comp sci major.. Software security isn't my specialty.. but, I am hoping to dev for phones soon and think this is a pretty fair question, since the information is handled differently in linux (and I suppose now android) than it would be on a comp running windows xp for example..
I am asking because i know even after a master reset some things linger on most phones... so if someone installed a keylogger of some sort.. would it be able to survive a master reset?
x.x

Just because you're paranoid doesn't mean the're not after you.
Sent from my SGH-T959 using XDA App

Lol... Let me put it this way.. I once read an article hear with some one talking about how he doesn't want "google knowing where he is" and "google reading his mail" ect ect ect.
And I understand privacy concerns.. but, he was well.. reaching the point of flat out goofy.
I am asking based on what I perceive to be a valid fear looking at it from a logical perspective.
If someone installed some sort of keylogger for the phone, would it be able to survive a master reset?
I mean I know that whats on your sim card is not usually deleted.. and I forget if this phone has dedicated or removable memory or some combination of both..
However, assuming its a 16gb removable.. You could hypothetically install it to the flash memory.. If its not removable.. I am less certain how that dedicated storage is handled on phones. I know that you generally format a hard drive before installing an os.. or it gets partitioned off..
So if a logger was installed onto the dedicated/removeable memory would it be partitioned off and allowed to continue working?
If I didn't see valid cause for concern I wouldn't be here.. But, I'm sure the devs around here know more about this and can give a good answer!
If this is all coming to my mind... I'm sure some crazy cracker out there has already thought of and either created/working on implimenting it.

google will nevr read your mail. google is your friend!
if you have a virus on it or think you have, plug it in your computer and scan with av software.
i don't think that a virus could survive master reset.
and why are you worrying about this? ive bought second hand phones before and they have been ok.
try eBay.

You don't seem to have read my thing properly.
What I am trying to say is I have read an thread with a guy who was paranoid google was going to read his mail ect.
What I am saying is I'm worried about a second hand person creating a virus.
I could be wrong but, plugging the phone into a computer would do absolutely nothing as far as antivirus protection if I'm worried about protecting the phone.
The reason why is because anti virus protection only picks up virus's it is designed to pick up.
It is designed to pick up viruses that are a threat to computers.
I would imagine that computer anti virus software would worry about a different set of exploits than a linux based phone.
Making scanning with a computer completely useless.

yes, keylogger can survive hard reset. you have to reflash your phone completely to be sure. or don't provide your credit card number in any market

Hard reset and reflash official software. Everything will be like it just rolled out of the factory.

Pretty silly thing to ask really.
obviosuly if teh key logger was cooked into the rom then a master reset wont do sweet FA as it would simply be re-installed with the rom.
As mentioned your only way is flash the phone with a fresh rom.

What is best way to make phone literally UNSTEALABLE??

Hi,
Recently my phone got stolen. It was HTC Desire. And I never thought it would happen, so was not prepared for it to happen.
And now in wake of that I was wondering what is the best mechanism available to recover lost phone.
To be precise, I am looking for something which will work even if thief removes the SIM, SDCard, does a factory reset, or install an entirely fresh ROM.
And if it could.. send an SMS/Email to a fixed destination (with phone number and GPS location) upon request/fixed-event in the background, it would be great.
So that virtually, the Phone would be unstealable as long as someone uses it with a new SIM(send SMS) or connects to internet (Email) even after wiping everything clean and installing a fresh ROM.

Complete protection is not possible, unless there is some option from the phone manufacturer build-in.
And I think even that can be circumvented.
However if your phone is rooted, you can install some apps which hide themselves and even survive a factory reset.
Lookout Security & Antivirus
Cerberus anti theft
And I think most thieves are not that smart to flash a new rom.

cool.aquarian said:
Hi,
Recently my phone got stolen. It was HTC Desire. And I never thought it would happen, so was not prepared for it to happen.
And now in wake of that I was wondering what is the best mechanism available to recover lost phone.
To be precise, I am looking for something which will work even if thief removes the SIM, SDCard, does a factory reset, or install an entirely fresh ROM.
And if it could.. send an SMS/Email to a fixed destination (with phone number and GPS location) upon request/fixed-event in the background, it would be great.
So that virtually, the Phone would be unstealable as long as someone uses it with a new SIM(send SMS) or connects to internet (Email) even after wiping everything clean and installing a fresh ROM.
Click to expand...
Click to collapse
Lizard said:
Complete protection is not possible, unless there is some option from the phone manufacturer build-in.
And I think even that can be circumvented.
However if your phone is rooted, you can install some apps which hide themselves and even survive a factory reset.
Lookout Security & Antivirus
Cerberus anti theft
And I think most thieves are not that smart to flash a new rom.
Click to expand...
Click to collapse
Lizard is right. It's not possible to do what listed. Only way to make it unstealable is to chain it to yourself

It's pretty hard, unless the guy who's steals your phone is a noob
// sent from a galactic Ars Sss

Lizard said:
Complete protection is not possible, unless there is some option from the phone manufacturer build-in.
And I think even that can be circumvented.
However if your phone is rooted, you can install some apps which hide themselves and even survive a factory reset.
And I think most thieves are not that smart to flash a new rom.
Click to expand...
Click to collapse
Yes, Thief himself may not be that smart, but where I belong to, stealing phones is a well-known racket.
So they have people who specifically know how to handle stolen phones.
Plus the police/manufacturer/carrier here is not of much help afterwards to track the thief down or block the IMEI.
Thanks for the links. Though they may not be exactly what I am looking for, any level of protection is better than none.
I am hoping someday there could be a better means to have more control/personalization of phone at hardware level.
like permanently associating phone's hardware identity with the online profile of original owner.

Complete protection is not possible..
There are many apps that can give phones position by sending an sms but thief r smart..
First they do is a reset..
Sent from my GT-I9100G using xda app-developers app

I'd say you're looking at this the wrong way. Software to locate a stolen phone is a measure that can only possibly help if your phone has already been stolen.
Better to think about how your phone was stolen and what you can do to prevent that from happening. Stop it being stolen before it is actually out of your hands.

Buy a GPS locator and embed it into the phone physically, if anything small enough is even available to the average consumer...
It would have to be fed power from the battery as well, which is far from impossible of course, but still quite the ordeal.
And since your police is obviously useless, learn to fight or buy a gun
Sent from my GT-I9000 using xda premium

Pennycake said:
Better to think about how your phone was stolen and what you can do to prevent that from happening. Stop it being stolen before it is actually out of your hands.
Click to expand...
Click to collapse
Trust me.. in my case, the theft was done in a very planned way by two guys (with one guy distracting me, and other guy snipping-off the phone from within my car at a busy traffic signal...
More than losing the phone, I am pissed about how it all happened..
I was considering teach those fu**ers a good lesson.

Locking your phone in Ft. Knox would still have the potential of disappearing.
Sent from my Amazon Kindle Fire using xda app-developers app

[Q] Password-protected bootloader. Is it possible?

Hi everybody
I thought that if someone steals my phone, the thief has simply to flash a fresh rom to make the device usable (don't consider the IMEI lock, because, at least in EU, if the phone is taken in another country this lock is useless), even if I am able to protect my data with many programs that lock the phone when it's urned on. I was thinking about something that makes the device not usable at all, for example a password-locked bootloader to prevent unauthorized flashing. What do you think about it, is it makeable? Does it makes sense or is it simply a bad idea?

Actually, that does sound like a good idea, its simple enough putting a phone into boot loader and flashing a new ROM, I have no idea if its make able but it is a good idea
Sent from my One V using xda premium

I guess u cannot do that...so far no one did it....
But good idea.

gigsaw said:
Hi everybody
I thought that if someone steals my phone, the thief has simply to flash a fresh rom to make the device usable (don't consider the IMEI lock, because, at least in EU, if the phone is taken in another country this lock is useless), even if I am able to protect my data with many programs that lock the phone when it's urned on. I was thinking about something that makes the device not usable at all, for example a password-locked bootloader to prevent unauthorized flashing. What do you think about it, is it makeable? Does it makes sense or is it simply a bad idea?
Click to expand...
Click to collapse
Intel has implemented anti theft technology (Intel AT) for laptop processor which locks down the hardware itself but no such solution for mobile processor. Just hope that Intel/ other manufacturers brings it to mobile processor in the future

At least I was thinking that before flashing with ADB or with RUU could be checked if the PC is logged in with the same google account on the phone...phones cost to much and are too easy to be stolen =s but in my opinion it's impossible to do something like that in unofficial way, manufacters could care about that but they don't...I wrote a couple of e-mails to some manufacters, some of them answered that they are not interested in that.

Any security concerns about data recovery?

Pretty soon, I plan to sell my current phone, and some old tablets, in order to make money towards the new Nexus devices. I'm wondering, though, are there any security concerns for someone potentially being able to recover my data if I sell my phone off? Obviously, this is a big deal to me, because I have all my Google accounts (my primary one being the one I use my credit card through) connected to me phone. Being that my devices all have TWRP installed, my primary thought would be to use that to wipe the internal storage, and do a factory reset. But is it possible someone could still manage to recover my data somehow?
I hear people talk about this for PCs, and hard drives, about how if someone really wanted to, they could theoretically recover your data even if you reformat your computer. Is that possible on smartphones as well, or is it different, due to phones using what I assume is flash memory (or whatever type of memory, that's different from a computer HDD)?
I just want to make sure I take every precaution before I sell my phones off. Granted, I already use two-step authentication on all my Google accounts, anyway, but still. I don't want any risk of something bad happening.

Just make sure to flash a stock ROM on each of them a few times and you will be fine. Can it be done? Yes only if the space has not been over written. That is the reason for the extra Flash's.

zelendel said:
Just make sure to flash a stock ROM on each of them a few times and you will be fine. Can it be done? Yes only if the space has not been over written. That is the reason for the extra Flash's.
Click to expand...
Click to collapse
So how many flashes should be enough to be safe? And do you have to boot up the phone in between flashes? Or could I just sit in TWRP, flashing the ROM over and over and over again?

mrw1215 said:
So how many flashes should be enough to be safe? And do you have to boot up the phone in between flashes? Or could I just sit in TWRP, flashing the ROM over and over and over again?
Click to expand...
Click to collapse
I would just flash a few times in recovery. No real reason to reboot.

So "a few" would be what? 3? 5? 10+? What's a safe number?

mrw1215 said:
So "a few" would be what? 3? 5? 10+? What's a safe number?
Click to expand...
Click to collapse
3 To 5 times should be enough. This is the same thing a DOD wipe does. It over writes the system a bunch of times so any data in unrecoverable.

Okay, thanks for the info.
I guess, alternatively, I could just change all the passwords to my stuff while I'm in between phones, because then, even if someone was able to recover my data, they wouldn't be able to log in since the passwords would have changed, eh?
I dunno. That's going to be so much work, but I'm super paranoid about keeping my data safe, so I'm not sure I can put my faith in making my data unrecoverable by flashing a ROM multiple times. I was kind of hoping that phone memory worked differently than a computer HDD, in that regard, and that it wouldn't have been an issue, but...

mrw1215 said:
Okay, thanks for the info.
I guess, alternatively, I could just change all the passwords to my stuff while I'm in between phones, because then, even if someone was able to recover my data, they wouldn't be able to log in since the passwords would have changed, eh?
I dunno. That's going to be so much work, but I'm super paranoid about keeping my data safe, so I'm not sure I can put my faith in making my data unrecoverable by flashing a ROM multiple times. I was kind of hoping that phone memory worked differently than a computer HDD, in that regard, and that it wouldn't have been an issue, but...
Click to expand...
Click to collapse
You could but ill be honest. Anything that would be needed to recover any real useful info like passwords or such would take a level of skill most people do no posses. The easiest thing to recover are pic and such as that is stored on a different partition then the info your trying to protect.
I am also super careful when I sell old devices. So a simple couple of extra min in recovery is worth it. I also make sure to return the device to stock before I let it go. Just to be sure.

What is proof that my ex spies on my phons

So my recent ex boyfriend did something to my phone and was spying on me. He knew things that he would only know bc he had access to everything on my phone. Before u think I'm just paranoid I will say that he has been charged with a crime for doin this to someone else years ago. I think he flashed my phone to do whatever he did. He's very very smart when it comes to technology, he has about 6 laptops and works with computers. He even made the comment once that if he wanted to spy on my phone that it wouldn't matter bc I could never prove it. With one of my phone's I used to could put it in recovery mode but then one day it wouldn't go into recovery mode anymore, I have two build prop files when I used to have only 1. My question is where exactly would a folder be that has a file that wpild prove he spies on me, he's too confident that he can't be caught and admitted he's done it to his exes. This is illegal and wrong and he shouldn't get away with it. I saw something called conspy and cttyhack but I'm not sure if he put it on my phone or if that's just on some phones help me please, there has to be something in a folder I'm just unsure where to look

You could try Malwarebytes and scan your phone. I seem to mention this a lot around here but I've had good results helping friends and family when they screw something up.
Best bet is to wipe and factory reset.

KernelCorn said:
You could try Malwarebytes and scan your phone. I seem to mention this a lot around here but I've had good results helping friends and family when they screw something up.
Best bet is to wipe and factory reset.
Click to expand...
Click to collapse
Factory reset doesn't help. I know he flashed my phone so idk what he has programmed in the phone but he did something and I need to find the proof

Really really good question but you will hate the answer lol
To answer your question, you would need to seek someone with a reasonable level of tech (ideally) who is preferably certified or holds some form of IT credentials to present your case to the authorities. They would use a forensics program (such as EnCase® Forensic ) to make an exact replica of your phones data. Not to mention you would also need someone else (with a very high tech skill set) to be able to actually identify the malicious behaviour of your phone.... not super hard but can be.... if you were to just take your phone straight to the police yourself with your story .... I highly doubt much would come from it. Even if you can prove what you are saying is true AND you have your infected phone as evidence..... you still have no evidence he did it. Even if your friend was there with you and both watched the entire re flashing etc.... You are still beat... I am going to guess you would need no less than full video of him doing it and even then it would be very shaky.... who's phone was it etc etc ....non malicious hacks (to non celebs and elites) is run of the mill and they probably have about 0.1% of the IT personnel needed at their disposal.... long story short.... errr longish ... I would HIGHLY suggest replacing your phone or taking a chance and getting help from random "tech" Those are your two options.... or you could also get famous overnight I guess..... your call. :good:

Basically you can't prove he did it
But you can testify that he manually flashed a rom to your phone
You can get any decent intelligent tech company to dump your Rom
And compare it to the original rom for changes..
And if those changes are detrimental you have a civil case against him..
But for what it will cost you in tech fees and lawyer bills
Buy 10 new phones and don't let anyone touch them.

cutie28345 said:
So my recent ex boyfriend did something to my phone and was spying on me. He knew things that he would only know bc he had access to everything on my phone. Before u think I'm just paranoid I will say that he has been charged with a crime for doin this to someone else years ago. I think he flashed my phone to do whatever he did. He's very very smart when it comes to technology, he has about 6 laptops and works with computers. He even made the comment once that if he wanted to spy on my phone that it wouldn't matter bc I could never prove it. With one of my phone's I used to could put it in recovery mode but then one day it wouldn't go into recovery mode anymore, I have two build prop files when I used to have only 1. My question is where exactly would a folder be that has a file that wpild prove he spies on me, he's too confident that he can't be caught and admitted he's done it to his exes. This is illegal and wrong and he shouldn't get away with it. I saw something called conspy and cttyhack but I'm not sure if he put it on my phone or if that's just on some phones help me please, there has to be something in a folder I'm just unsure where to look
Click to expand...
Click to collapse
Use a firewall and see which apps have UNUSUALLY many permissions.
i think he used d*****ack, (sorry, i will not post the name of the hack)
Its quite easy to use and CAN be combined with an existing app
it can be used to record voice/video
can even see call logs, messaging history, whatssap etc.
so boot into recovery mode and wipe factory reset FROM recovery, not settings.(if you dont want to check each app manually)

I think he used d- r- o- i- d- j- a- c- k

cutie28345 said:
So my recent ex boyfriend did something to my phone and was spying on me. He knew things that he would only know bc he had access to everything on my phone. Before u think I'm just paranoid I will say that he has been charged with a crime for doin this to someone else years ago. I think he flashed my phone to do whatever he did. He's very very smart when it comes to technology, he has about 6 laptops and works with computers. He even made the comment once that if he wanted to spy on my phone that it wouldn't matter bc I could never prove it. With one of my phone's I used to could put it in recovery mode but then one day it wouldn't go into recovery mode anymore, I have two build prop files when I used to have only 1. My question is where exactly would a folder be that has a file that wpild prove he spies on me, he's too confident that he can't be caught and admitted he's done it to his exes. This is illegal and wrong and he shouldn't get away with it. I saw something called conspy and cttyhack but I'm not sure if he put it on my phone or if that's just on some phones help me please, there has to be something in a folder I'm just unsure where to look
Click to expand...
Click to collapse
you are just paranoid.
about the build.prop, whenever a change is made, the system saves the original as a backup. so youll have 2. if you dont want to be paranoid anymore, in twrp or cwm recovery, wipe the system then flash another rom or a factory image. wiping the system will delete any rom or anything that was added into your system. you will need to flash a rom before you could boot up again.

I think getting a new phone will be the most hassle free and likely cheapest solution. Turn off the other phone, take out the battery and you will have nothing to worry about it anymore.
Yes you can go and do al kinds of checks yourself, reset it and have some people look at it. But will you ever be sure that there is nothing malicious left on your phone? Just holding the phone that was once (or still is) infected by your (evil?) ex-boyfriend might bring up many emotions. Please don't lose your sleep over this. Spare yourself the trouble and get a new device.
Maybe it was time for an update anyway
Good luck!

If it is a good device, give it to me
Or even a crappy one I have a collection of both)
I'll use it
That will mess with your exs mind..