Scanning my whole rooted phone for malware - General Questions and Answers

I just got a cheap Chinese phone which, according to the Amazon reviews, was full of adware and malware.
First thing I did was installing a custom TWRP and a custom rom, which I had to download from a russian forum.
I'd like to scan my mobile, to make sure that there is no malware. I have TWRP and root access, so I should be able to dump all the partitions on my computer (or to scan it directly on the phone as well)...
Is there any app or software that would look for malware into all the software on my phone (including recovery, kernel and system files)?

Related

How are Android Phones different from PCs; making them harder to modify?

Out of curiosity, someone please explain to me what we are doing at the hardware level when we flash/root etc. I have an excellent understanding of PCs and Windows hard drives, but I don't understand why Android is much more complicated to modify and how the carriers are able to permanently mess up (in our opinion) our phones using OTA updates when there is not a computer virus that exists that can permanently mess up my computer to the point that a wipe and reinstall wont fix it?
My specific questions are as follows:
1. Most thread instructions usually say to root the phone before installing custom recovery (TWRP). If we are doing an ODIN flash, is rooting actually needed to install TWRP? Is root part of the ROM? Or is it a deeper hardware thing unrelated to the ROM?
2. If we are installing a custom rom (cyanogen mod) and we want root, is it necessary to root with a separate method (superuser.zip etc), or does flashing cyanogen mod give us root automatically?
3. If we are flashing images to the phone's hard drive, why does the current operating system on the phone matter? Why is there a different root/TWRP install method (and .tar images?) for android 4.1.1 than there is for 4.1.2 or 3.x.x? Shouldn't the same ODIN images work regardless of what operating system the phone has on it? As in, why do I even need to look at what is currently installed on the phone? If I have a computer and I want to install a new operating system, the current OS doesn't matter, I just wipe the drive and install the new OS. Why are the phones different? Why is it possible to buy a brand new computer, wipe the drive, and install Windows XP, or even DOS, but I can't buy a brand new phone and install Android 1.0.0?
4. How are the carriers able to cause developers so many problems with their OTA updates? If someone upgraded their i747 to 4.3 why can't they just format the phone's drive and reinstall an older operating system like I can on my computer? Even a computer infected with the worst computer virus can still be wiped and reinstalled with any processor compatible operating system, so how do the OTA updates cause irreversible phone problems when nasty computer viruses can't do this?
Basically explain to me what makes the Android phones different from PCs and makes everything so much more complicated than it is to format a Windows drive and install Linux and then format again and install something totally different? I just don't understand what makes them so different? Lastly, if the carriers encrypt a bootloader, like ATT did with the S4, why can't we just erase the bootloader and flash our own not-encrypted bootloader to the phone? Is the bootloader some sort of chip that we would have to physically remove and replace? Or is it 1's and 0's on the drive that we can format and rewrite?
scubapilot said:
Out of curiosity, someone please explain to me what we are doing at the hardware level when we flash/root etc. I have an excellent understanding of PCs and Windows hard drives, but I don't understand why Android is much more complicated to modify and how the carriers are able to permanently mess up (in our opinion) our phones using OTA updates when there is not a computer virus that exists that can permanently mess up my computer to the point that a wipe and reinstall wont fix it?
My specific questions are as follows:
1. Most thread instructions usually say to root the phone before installing custom recovery (TWRP). If we are doing an ODIN flash, is rooting actually needed to install TWRP? Is root part of the ROM? Or is it a deeper hardware thing unrelated to the ROM?
2. If we are installing a custom rom (cyanogen mod) and we want root, is it necessary to root with a separate method (superuser.zip etc), or does flashing cyanogen mod give us root automatically?
3. If we are flashing images to the phone's hard drive, why does the current operating system on the phone matter? Why is there a different root/TWRP install method (and .tar images?) for android 4.1.1 than there is for 4.1.2 or 3.x.x? Shouldn't the same ODIN images work regardless of what operating system the phone has on it? As in, why do I even need to look at what is currently installed on the phone? If I have a computer and I want to install a new operating system, the current OS doesn't matter, I just wipe the drive and install the new OS. Why are the phones different? Why is it possible to buy a brand new computer, wipe the drive, and install Windows XP, or even DOS, but I can't buy a brand new phone and install Android 1.0.0?
4. How are the carriers able to cause developers so many problems with their OTA updates? If someone upgraded their i747 to 4.3 why can't they just format the phone's drive and reinstall an older operating system like I can on my computer? Even a computer infected with the worst computer virus can still be wiped and reinstalled with any processor compatible operating system, so how do the OTA updates cause irreversible phone problems when nasty computer viruses can't do this?
Basically explain to me what makes the Android phones different from PCs and makes everything so much more complicated than it is to format a Windows drive and install Linux and then format again and install something totally different? I just don't understand what makes them so different? Lastly, if the carriers encrypt a bootloader, like ATT did with the S4, why can't we just erase the bootloader and flash our own not-encrypted bootloader to the phone? Is the bootloader some sort of chip that we would have to physically remove and replace? Or is it 1's and 0's on the drive that we can format and rewrite?
Click to expand...
Click to collapse
Reason being is that the manufacturers have control over everything and completely lock you out.
Its not like you have a bios on these phones or you can install a new hard drive with a different OS on it.
They lock it down so much.
It's also not impossible to root any of the phones.
All you need to do is use uart or jtag to talk to the device straight up.
Rotting is part of the rom.
An odin flash will work great for flashing recovery(For samsung devices only)
And roms.
But odin flashes whole partitions only.
Rotting is not a hardware thing.
Its basically finding a way to place a file on the /system partition in the bin folder.
Then being able to execute that file. (File: su)
The su executable changes your uid(User id) to 0 which indicates the root user giving you full access over the device.
To get the su executable on to the device you will have to find exploits in the software to allow you to write to the /system/bin directory.
One such exploit is zergrush which gave you a root shell where you copy the su binary over to the device.
What is rooting?
Pretty much every rom here will be given root access by default.
Some roms(Usually indicated with stock) have no root.
In which case recovery will allow you to flash a zip putting the su files onto your installed rom.
(Recovery is like running a live cd to repair windows.)
A good place to learn is xda-university
What is recovery?
These phones have flash memory.
Not magnetic.
And like I said Odin flashes whole partitions.
So it would completely wipe whatever partition you are flashing to.
/system would contain android.
So an odin package with a system img would wipe the current OS and flash the contents of your odin package to the place where the old OS was.
To summarize, Odin packages are not dependent upon the installed OS at all.
Now that is an interesting question.
The reason that you can't just install any OS is because we don't just have generic drivers built for generic hardware.
We have millions of different phone models.
There really hasn't been any movement for standard compliant hardware in the phone scene.
So building generic stuff for all of the different kinds of phones would be a nightmare.
And the last one.
Its because we rely on software security bugs to break into devices.
Google has made it easy for us to do anything that we want with our devices with a simple command.
samsung's download mode isn't a sure fire way of doing any modding because you would have to build a rom from stock. (Samsung doesn't release their stuff very often. An exception to this is : sammobile )
And again, you could do this with an underlying knowledge of the hardware using Uart or jtag. (Conneting to the board directly and speaking to the processor)
Seriously think about that for a second, how do you install windows. A cd drive.
How do you configure devices. a bios.
In short : These phones aren't made to be messed with for security reasons and because manufacturers are too lazy to make it easy for modders. (Nexus devices are made in mind for modders though)
Need anymore info just ask. :highfive:
Thank you so much Lgrootnoob. A few more questions.
1. When you say
To get the su executable on to the device you will have to find exploits in the software to allow you to write to the /system/bin directory.
Click to expand...
Click to collapse
Do I understand correctly that this is only true when adding root to a stock rom? If I flash cyanogen mod to the system partition, it does not require an exploit because it just erases and overwrites the entire partition? I have been rooting, and then installing TWRP, and then installing Cyanogen Mod. If I understand you correctly, me rooting the stock rom is an unnecessary step, as I am just erasing and overwriting it with Cyanogen Mod later?
Google has made it easy for us to do anything that we want with our devices with a simple command.
Click to expand...
Click to collapse
2. So modding the Google Nexus does not require that we use the exploits you mentioned are needed to modify the other phone(s)?
3. I understand that Android 4.3 has security features that prevent gaining "true root"? As long as Nexus leaves the "easy access" you mentioned, it will still be possible to flash a custom rom that does allow true root, no matter what security features Google puts into its version of Android?
4. Does the Google Play Edition Galaxy S4 require the exploits? Or do the Google Play edition phones have the same "easy access" you mentioned the Nexus has? Is the "easy access" the fastboot function I've read about?
5. With a carrier that encrypts all of their bootloaders, I will most likely be forced to buy only Nexus products or Google Play edition phones if I want to have Cyanogen Mod with full root? I haven't wanted a Nexus because it doesn't have a removable battery or SD card, but having custom firmware is the most important thing to me.
scubapilot said:
Thank you so much Lgrootnoob. A few more questions.
1. When you say Do I understand correctly that this is only true when adding root to a stock rom? If I flash cyanogen mod to the system partition, it does not require an exploit because it just erases and overwrites the entire partition? I have been rooting, and then installing TWRP, and then installing Cyanogen Mod. If I understand you correctly, me rooting the stock rom is an unnecessary step, as I am just erasing and overwriting it with Cyanogen Mod later?
2. So modding the Google Nexus does not require that we use the exploits you mentioned are needed to modify the other phone(s)?
3. I understand that Android 4.3 has security features that prevent gaining "true root"? As long as Nexus leaves the "easy access" you mentioned, it will still be possible to flash a custom rom that does allow true root, no matter what security features Google puts into its version of Android?
4. Does the Google Play Edition Galaxy S4 require the exploits? Or do the Google Play edition phones have the same "easy access" you mentioned the Nexus has? Is the "easy access" the fastboot function I've read about?
5. With a carrier that encrypts all of their bootloaders, I will most likely be forced to buy only Nexus products or Google Play edition phones if I want to have Cyanogen Mod with full root? I haven't wanted a Nexus because it doesn't have a removable battery or SD card, but having custom firmware is the most important thing to me.
Click to expand...
Click to collapse
1. Well, devices that have no way of flashing at the bootloader must be rooted on the stock rom to flash other roms. (Exception: Nexus devices that have fastboot flash system.img functions) But custom roms come su in /system/bin all the time. (Unless said otherwise in their thread)
2. Yup, google gives exclusive access on the nexus phones.
However, you have to unlock the bootloader to flash anything.
Unlocking the bootloader will use the command:
Code:
fastboot oem unlock
Unlocking the bootloader wipes all data.(/data partition) but leaves the system partition intact.
Reasone being is when someone flashes a recovery:
Code:
fastboot flash recovery.img
They could use recovery to dump your data partition.
3. The way processes work in android 4.3 and above is different from 4.3's ancestors.
Root can be obtained with Supersu
But exploits to gain root on the android system have been pretty much put out of business.
Most exploits are bootloader exploits these days. (Or oem rom exploitsem's theming makes their devices vulnerable usually.[They have less tested code or just don't care.])
So root is still widely available on just about any rom out there thanks to chainfire!
^He is an awesome developer by the way.
4. I would figure that the google play editions have easy access with fastboot that would normally be stumped by samsung.
Google makes everything awesome.
" Is the "easy access" the fastboot function I've read about?" In short yes.
It allows you to flash recovery which can dump the whole system and allow you to modify the system however you like and put it back on the device.
There is even an app for recovery by the way: Aroma fm
5. The removable battery doesn't matter unless you wan't to swap batts on the fly.
But it does have a function for restarting the phone without pulling the battery. Hold power button + volume up until it restarts.
And even if you wanted to replace the battery you could take the nexus device apart and disconnect the battery and find a replacement. (Maybe ordered from the manufacturer.)
The devs here are awesome and find exploits in almost all of the bootloaders or the oem (skinned) android versions.
So the nexus devices aren't the only option, but they usually get more development unless your device is truly a powerhouse like the gs4 international.

Backing up and Restoring - Stock ROM

is there a non intrusive (as in rooting not required) method
for "backing up" and "restoring" a Samsung S6 (SM-G920I) stock ROM.
thank you in advance.
note: not interested in any custom rom nor any tinkering. this is strictly for recovery option should the operating system ever get corrupt or get mal-ware.
UaVaj said:
is there a non intrusive (as in rooting not required) method
for "backing up" and "restoring" a Samsung S6 (SM-G920I) stock ROM.
thank you in advance.
note: not interested in any custom rom nor any tinkering. this is strictly for recovery option should the operating system ever get corrupt or get mal-ware.
Click to expand...
Click to collapse
Smart switch can backup every thing u need with out a custom recovey theres no way to make a complete img backup
given the lack of response here and limited results via any search engine/forum.
perhaps there is no such method available.
given that said. all these "stock" rom floating around available for download.
these must be all rooted stock rom then.
if not. how did the owners of these stock rom rips the original rom off the device?
for further clarification. simply looking to back up the original operating system and could care less about the latter data/updates.
UaVaj said:
given the lack of response here and limited results via any search engine/forum.
perhaps there is no such method available.
given that said. all these "stock" rom floating around available for download.
these must be all rooted stock rom then.
if not. how did the owners of these stock rom rips the original rom off the device?
for further clarification. simply looking to back up the original operating system and could care less about the latter data/updates.
Click to expand...
Click to collapse
As said before, Smart Switch is the tool to use. In case of emergency you factory reset your phone and use this tool to recover broken system files and restore your data.
Stock roms are compiled with the official firmwares you get from sammobile.
The following method has been used from the begging of the android i think.
http://www.techrepublic.com/article/how-to-create-a-full-backup-of-your-android-device-without-root/
(If external links are not allowed ,inform me and i will remove immediately! )
Please note that i have not personally tested the ADB backup method,but i dont see any reason to not work with user apps and data.
Dont know about system files on the other hand.
Also you dont need to install the whole Android SDK, just the adb files and drivers (google them).
nighthawk696969 said:
The following method has been used from the begging of the android i think.
http://www.techrepublic.com/article/how-to-create-a-full-backup-of-your-android-device-without-root/
(If external links are not allowed ,inform me and i will remove immediately! )
Please note that i have not personally tested the ADB backup method,but i dont see any reason to not work with user apps and data.
Dont know about system files on the other hand.
Also you dont need to install the whole Android SDK, just the adb files and drivers (google them).
Click to expand...
Click to collapse
This method works for the APKs off the installed Userapps but not for data. And it's definitely not working for system files because you would need root for that.
It's a good question how to backup data of userapps without root. But nowadays most apps sync their data to the cloud.
thank you all for trying to help. greatly appreciated.
however this is not getting anywhere.
one last time. "this is strictly for backing up and restoring the operating system (android 5.1.1) incase of corruption or malware." not the user application. not the user data. not user settings.
for restore - looks like odin can handle the restore. just have to root the device first. and then it will be back to factory stock.
for backup - want the current stock rom on the s6 in my hand and keep it 100.0% original. is seems to be a dead end.
why? have a "stock" note3 that got malware so bad. malware has embedded itself into the root. even a master reset does not get rid of the malware. just bought a S6. does not want history to repeat itself. hence looking for a non invasive backup/restore method.

[Completed] how to clean malware from kingo rooted android 4.1.1 huawei y300-100 phone

hi. really i just want my phone to be sure to clear from any malware, but this could also be a request of how to flash a new OS if this is needed. the phone runs as slowly as it ever did so i can't see any major difference in that. one thing is that a data usage app shows no increase in data since the possible infection, even though i know i am using the mobile data. and this seems strange as though something could be blocking this to hide its own communications.
i rooted my UK android phone with kingoroot a while back to gain SU access to allow me to store apps on the external SD card. that was ages ago and i don't access to the same windows PC. (i have a linux'd laptop)
foolishly i clicked on a whatsapp message with a 'free voucher offer' link, even though i though this was too good to be true and i knew i shouldn't click on this kind of nonsense.... i have since installed norton antivirus and it says the phone is fine, though i am still dubious that the app can check for any malware that may have entered into the lower levels of the system given kingoroot has messed with the access controls. for now i have removed any apps that have my bank details
i have read that in these circumstances even factory reset may guarantee clearing anything. is this correct? so am i right that the only way to be sure the phone is clean is to re-install a new boot loader and OS?
if so, this is a little beyond me and i find conflicting instructions as to what to do, or where to download the correct files. i find more links to installing non- standard android 4.3 or 4.4, with reports that these maybe aren't stable. if they are OK i'd happy with these, but 4.1.1 does most of what i want (apart from the lack of internal memory and not being able to store apps on the external SD)
would doing a firmware update to a newer version B209 do the same? (mine is currently B197) i can find a link from a place i trust from github, and if this helps the phone run better then i would be up for doing that anyway but again would not know how to.
do i have to undo the Kingoroot before i start any of this? is the CNET download link for kingoroot safe to use as the kingoapp.com website doesn't work for me anymore.
massive thanks in advance for any thoughts on this
flyaway76 said:
hi. really i just want my phone to be sure to clear from any malware, but this could also be a request of how to flash a new OS if this is needed. the phone runs as slowly as it ever did so i can't see any major difference in that. one thing is that a data usage app shows no increase in data since the possible infection, even though i know i am using the mobile data. and this seems strange as though something could be blocking this to hide its own communications.
i rooted my UK android phone with kingoroot a while back to gain SU access to allow me to store apps on the external SD card. that was ages ago and i don't access to the same windows PC. (i have a linux'd laptop)
foolishly i clicked on a whatsapp message with a 'free voucher offer' link, even though i though this was too good to be true and i knew i shouldn't click on this kind of nonsense.... i have since installed norton antivirus and it says the phone is fine, though i am still dubious that the app can check for any malware that may have entered into the lower levels of the system given kingoroot has messed with the access controls. for now i have removed any apps that have my bank details
i have read that in these circumstances even factory reset may guarantee clearing anything. is this correct? so am i right that the only way to be sure the phone is clean is to re-install a new boot loader and OS?
if so, this is a little beyond me and i find conflicting instructions as to what to do, or where to download the correct files. i find more links to installing non- standard android 4.3 or 4.4, with reports that these maybe aren't stable. if they are OK i'd happy with these, but 4.1.1 does most of what i want (apart from the lack of internal memory and not being able to store apps on the external SD)
would doing a firmware update to a newer version B209 do the same? (mine is currently B197) i can find a link from a place i trust from github, and if this helps the phone run better then i would be up for doing that anyway but again would not know how to.
do i have to undo the Kingoroot before i start any of this? is the CNET download link for kingoroot safe to use as the kingoapp.com website doesn't work for me anymore.
massive thanks in advance for any thoughts on this
Click to expand...
Click to collapse
Greetings and welcome to xda. Factory resetting or reflashing stock firmware should wipe any offending program so you will be ok there. If you ask your question here
http://forum.xda-developers.com/android/help
hopefully the experts there can help you with kingroot
Good Luck
Sawdoctor

[Resolved] How to properly root with magisk

Hi. My phone is: NXT-L29 ( Huawei Mate 8, Europe, unlocked bootl., Marshmallow, EMUI 4.0 ). I installed official TWRP for this device via fastboot, tried all 8 versions available but black screen is all I achieved (probably because they are all for EMUI 4.1). Used SRKtools and TWRP asked me for password to decrypt data, which I don't know. Can I flash magisk with fastboot over encrypted data? Won't that brick the phone? Or should I update to EMUI 4.1? Or what else do you suggest? Also, should I somehow disable dm-verity and RMM or should I just format data partition? Will it get reencrypted on next boot? Any help appreciated.
EDIT: One more question: is firmware update possible with unlocked bootloader or must I relock it first?
Every time I rooted a phone you erase and format data partition first. Nothing encrypted or otherwise should be on the phone iirc... Then flash custom recovery, then rom, then modem / whatever else. Then sideload root script or whatever method to root. Nowadays since there are so many payment methods and ways to get ripped off on phones, I use LineageOS which has a radio button in settings the switches root over adb on or off. Serves my pruposes and avoids the danger of having open bootloader and root 24/7 and brainlessly easy. Don't know if LineageOS supports Mate 8 but it should, it's a popular phone here in USA. Good luck!
PS. If it's not too personal, what are you wanting to achieve once you get root access? All I use it for is to run powermanager over adb and remove bloatware and change hosts files to block malware hosts and social media (internet cancer). I only need to gain root once to do this so no need to run it all the time, too risky to me imo.
SublimeFoxTheater said:
Every time I rooted a phone you erase and format data partition first. Nothing encrypted or otherwise should be on the phone iirc... Then flash custom recovery, then rom, then modem / whatever else. Then sideload root script or whatever method to root. Nowadays since there are so many payment methods and ways to get ripped off on phones, I use LineageOS which has a radio button in settings the switches root over adb on or off. Serves my pruposes and avoids the danger of having open bootloader and root 24/7 and brainlessly easy. Don't know if LineageOS supports Mate 8 but it should, it's a popular phone here in USA. Good luck!
PS. If it's not too personal, what are you wanting to achieve once you get root access? All I use it for is to run powermanager over adb and remove bloatware and change hosts files to block malware hosts and social media (internet cancer). I only need to gain root once to do this so no need to run it all the time, too risky to me imo.
Click to expand...
Click to collapse
Hello and thanks for your reply. I'll try that tomorrow if time allows me. I need root mainly to get rid of ads! There are so many brilliant apps ruined by ads and AdAway is the solution. Bloatware removal also is a good enough reason. Previously I rooted Galaxy Note 3 and it was a breeze, no problem at all, so I hadn't realised how things changed for worse. I found LineageOS but beta version so I think I'll stay with the current system which works absolutely fine for me.
Ok let us know what you did and if it works. I have never heard of AdAway I just add offending urls to hosts file. To do this you need to have root and mount system and edit the hosts file, then reboot even back to rootless and it still works. If you need to block and unblock fast then I could see an app being needed but if you know what you want to get rid of you only need root and to edit human readable hosts once and you're done.
SublimeFoxTheater said:
Ok let us know what you did and if it works. I have never heard of AdAway I just add offending urls to hosts file. To do this you need to have root and mount system and edit the hosts file, then reboot even back to rootless and it still works. If you need to block and unblock fast then I could see an app being needed but if you know what you want to get rid of you only need root and to edit human readable hosts once and you're done.
Click to expand...
Click to collapse
On reflection, I think I won't rush into things. I must read more on dm-verity and other protection mechanisms so at least I have a foggy idea what I'm doing and what can go wrong. AdAway is a great ad blocker working with websites and apps and the idea of doing all this manually seems rather tedious. As for safety, I only ever use one pre-paid card without overdraft and loaded with tiny amounts at a time that's connected to my google account, so if it gets compromised that won't be the end of the world - not that it ever happened.
most fraud comes from social engineering, catfish, etc.
I used supersu back in the day even worked stock rom, as long as bootloader and flashing are unlocked.
The Dev zipped the binary and a script to copy it wherever it goes and make it only accessible to you (after lock screen)
Then install supersu apk and you'll be asked to give root when an app wants it
I used this to use a game editor to give myself more in game currency haha.
I beat people in the game and they did in app purchase to devs in China, received nothing, so I had no problem exploring this flaw and handing out Justice to those in deep nerd rage haha.
In app items, come on bro that ain't what money's for.
I'm immune to social engineering, mate I still have supersu on my Galaxy Note 3 with SlimRom, but I notice it's no longer maintained, so that's how I found out about Magisk which is opensource into the bargain and attemps to hide root so maybe my banking app will work for a change.
I used this to use a game editor to give myself more in game currency haha.
Click to expand...
Click to collapse
Did you use custom editor to hack into the game? Cause I assume the devs weren't so accommodating to provide one for your convenience.
Ok, it works. Got tired of inaction and just did it and no catastrophic scenario materialized. Job done!

Please help: Can a malicious app that had root acces do lasting damage after device is unrooted and the app is deleted?

Many thanks for reading my post. I really apriciate your time .
I think I recently installed an app that used a rootkit to temporarily give itself root acces. The bootloader of my device is still locked (Huawei Ale-L21, I know the phone is old ).
After I found out, I deleted the app and factory recet the phone. I checked with root checker and my phone doesn't have root acces anymore.
Is it possible that the app has injected code into the system partion of my phone that will remain after a factory recet. I haven't found any traces on the data partion of my device and haven't noticed any suspicious activity after the factory reset. The app also didn't convert itself to a system app. And to reitterate, the bootloader of the phone still seems locked.
My main concern would be that malicious code could get acces to for example my camera without me knowing. Is this a realistic threat to worry about.
My second question would be: does malicious code manifest itself as a system app persé or could it affect my device in another way without me noticing.
Agin thanks to everyone who took the time to read and (hopefully) answer my questions.
HumboBumbo said:
Many thanks for reading my post. I really apriciate your time .
I think I recently installed an app that used a rootkit to temporarily give itself root acces. The bootloader of my device is still locked (Huawei Ale-L21, I know the phone is old ).
After I found out, I deleted the app and factory recet the phone. I checked with root checker and my phone doesn't have root acces anymore.
Is it possible that the app has injected code into the system partion of my phone that will remain after a factory recet. I haven't found any traces on the data partion of my device and haven't noticed any suspicious activity after the factory reset. The app also didn't convert itself to a system app. And to reitterate, the bootloader of the phone still seems locked.
My main concern would be that malicious code could get acces to for example my camera without me knowing. Is this a realistic threat to worry about.
My second question would be: does malicious code manifest itself as a system app persé or could it affect my device in another way without me noticing.
Agin thanks to everyone who took the time to read and (hopefully) answer my questions.
Click to expand...
Click to collapse
You will probably need to flash your stock firmware
Rootkits, the worst of the trojans... go full nuke with the reflash option.
Note that a factory reset leaves the phone's system partition (the "ROM") untouched. If there were made any changes to the system partition (such as rooting), those will remain.
Only re-flashing phone's Stock ROM helps to get rid off of changes made to the system partition.
jwoegerbauer said:
Note that a factory reset leaves the phone's system partition (the "ROM") untouched. If there were made any changes to the system partition (such as rooting), those will remain.
Only re-flashing phone's Stock ROM helps to get rid off of changes made to the system partition.
Click to expand...
Click to collapse
Here's one of those:
xHelper malware: What it is, how it works and how to prevent it | Malware spotlight | Infosec Resources
Research shows malware spreading and directed specifically at mobile users. Check Point’s 2019 Mid-Year Trends Report shows that cyberattacks targeting
resources.infosecinstitute.com
The newer OS's aren't vulnerable to this one but it shows how insidious these rootkits can be.
@blackhawk
Because you tagged me:
I have never had the embarrassment of a phone I had or still have got infected with malicious software ( rootkits ).
I know how to protect myself from this.
And I never have bricked a phone because I know how to proceed correctly when it comes to rooting Android.
jwoegerbauer said:
Note that a factory reset leaves the phone's system partition (the "ROM") untouched. If there were made any changes to the system partition (such as rooting), those will remain.
Only re-flashing phone's Stock ROM helps to get rid off of changes made to the system partition.
Click to expand...
Click to collapse
I recently read up about bootloaders but would a locked bootloader not check the signature of the rom, so that if changes were made to the system partion the phone wouldn't boot or something allong those lines. Apologies if that is not how it works, I'm only just recently starting to learn about it.
blackhawk said:
Rootkits, the worst of the trojans... go full nuke with the reflash option.
Click to expand...
Click to collapse
Could you mabey rephrase that? I don't fully understand what you mean.
blackhawk said:
Here's one of those:
xHelper malware: What it is, how it works and how to prevent it | Malware spotlight | Infosec Resources
Research shows malware spreading and directed specifically at mobile users. Check Point’s 2019 Mid-Year Trends Report shows that cyberattacks targeting
resources.infosecinstitute.com
The newer OS's aren't vulnerable to this one but it shows how insidious these rootkits can be.
Click to expand...
Click to collapse
Would a virus like this show up in the apps section in your settings or do you think it wouldn't be noticable in any way?

Categories

Resources