3 ms·

I'm really confused. How is it possible something like this survives a factory reset? To be fair, I have a very limited knowledge of hardware like this, but my

by 40four 7y ago

I'm really confused. How is it possible something like this survives a factory reset? To be fair, I have a very limited knowledge of hardware like this, but my assumption is a factory reset should remove EVERYTHING that didn't come on the phone put of the box. Some other comments are questioning weather this is happeneing to 'budget' devices sold by sketchy manufacturers. Would that explain something like this. I sure as hell hope thats not the case on a phone from reputable manufacturer. If I can't wipe everything, including malware from my android device by doing a factory reset, I'm going to throw it in the garbage tomorrow & buy an iPhone.

mindslight 7y ago
Android devices have multiple storage partitions. "Factory reset" generally refers to wiping the data partitions, but not the system partitions. It does not mean reflashing the phone's entire storage from an external image as you would expect. I would imagine this malware modifies one of the partitions that is not customarily wiped. And I would expect that doing a proper full reflash from a computer (eg starting from `fastboot flash bootloader ...`) would remove it, assuming it wasn't already baked into that image at the manufacturer.
- 40four 7y ago
  Thanks for explaining!
  - hunter2_ 7y ago
    And the "not customarily wiped" partitions are not wiped because they are not customarily writable in the first place. Rooting a phone by a prominent manufacturer requires discovering an exploit which overcomes this write protection. This is why manufacturers try to protect against exploits, and why you probably shouldn't use a second-hand phone that has known exploits, where second-hand means touched by basically anyone in even a seemingly-legitimate supply chain.
    - mindslight 7y ago
      > you probably shouldn't use a second-hand phone that has known exploits, where second-hand means touched by basically anyone Clearly unpublished exploits are also bad, meaning this essentially applies to every phone. That's a pitfall of the closed security paradigm - even if you are willing to trust the manufacturer, you still can't be sure that their control has not actually been usurped by some unknown third party. So you either need to double down and choose the closed system that receives the highest scrutiny (Apple), or opt for a device that has been opened by the community for long enough that any stateful hiding places are known.
jklinger410 7y ago
Probably calling as pre-installed service in the ROM. Definitely baked in by the manufacturer.
- baroffoos 7y ago
  Certainly the most likely case. Laptop OEMs have been bundling malware for a long time now.
baroffoos 7y ago
>but my assumption is a factory reset should remove EVERYTHING that didn't come on the phone put of the box A simple proof that this isn't the case is the fact that factory resets do not revert your phone back to the same OS version as it came with out of the box and it does not download an OS image to install. The only device I know that does this is macbooks have a built in recovery which can be used to download a fresh OSX image and install that. On an unrooted/unexploited phone a factory reset should remove every bit of data bad app has access to. On a rooted phone you can wipe everything by downloading the vendor image (Google supplies these but not all OEMs do) and then you can flash that over the entire phone which replaces everything on the storage.
- 40four 7y ago
  I'm not sure this is the case. I have a Samsung Note 5. Its been a while since I factory reset, but Im almost positive it was back to the old android version. I always remember having to upgrade again. Maybe my memory is incorrect, but I'd be surprised if it did not revert back. I'm thinking of reseting soon, so if I do I'll report back :)

by 40four 7y ago

mindslight 7y ago

Android devices have multiple storage partitions. "Factory reset" generally refers to wiping the data partitions, but not the system partitions. It does not mean reflashing the phone's entire storage from an external image as you would expect. I would imagine this malware modifies one of the partitions that is not customarily wiped. And I would expect that doing a proper full reflash from a computer (eg starting from `fastboot flash bootloader ...`) would remove it, assuming it wasn't already baked into that image at the manufacturer.

40four 7y ago
Thanks for explaining!
- hunter2_ 7y ago
  And the "not customarily wiped" partitions are not wiped because they are not customarily writable in the first place. Rooting a phone by a prominent manufacturer requires discovering an exploit which overcomes this write protection. This is why manufacturers try to protect against exploits, and why you probably shouldn't use a second-hand phone that has known exploits, where second-hand means touched by basically anyone in even a seemingly-legitimate supply chain.
  - mindslight 7y ago
    > you probably shouldn't use a second-hand phone that has known exploits, where second-hand means touched by basically anyone Clearly unpublished exploits are also bad, meaning this essentially applies to every phone. That's a pitfall of the closed security paradigm - even if you are willing to trust the manufacturer, you still can't be sure that their control has not actually been usurped by some unknown third party. So you either need to double down and choose the closed system that receives the highest scrutiny (Apple), or opt for a device that has been opened by the community for long enough that any stateful hiding places are known.

jklinger410 7y ago

Probably calling as pre-installed service in the ROM. Definitely baked in by the manufacturer.

baroffoos 7y ago
Certainly the most likely case. Laptop OEMs have been bundling malware for a long time now.

baroffoos 7y ago

>but my assumption is a factory reset should remove EVERYTHING that didn't come on the phone put of the box A simple proof that this isn't the case is the fact that factory resets do not revert your phone back to the same OS version as it came with out of the box and it does not download an OS image to install. The only device I know that does this is macbooks have a built in recovery which can be used to download a fresh OSX image and install that. On an unrooted/unexploited phone a factory reset should remove every bit of data bad app has access to. On a rooted phone you can wipe everything by downloading the vendor image (Google supplies these but not all OEMs do) and then you can flash that over the entire phone which replaces everything on the storage.

40four 7y ago
I'm not sure this is the case. I have a Samsung Note 5. Its been a while since I factory reset, but Im almost positive it was back to the old android version. I always remember having to upgrade again. Maybe my memory is incorrect, but I'd be surprised if it did not revert back. I'm thinking of reseting soon, so if I do I'll report back :)