4 ms·

I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware. That kinda blo

I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware. That kinda blows my mind.

abrookewood 6y ago
That's a pretty extreme and expensive option. I think I would have just gone for a factory reset.
- 3pt14159 6y ago
  At the very least, yes. But I read something from a former NSA hacker once and he mentioned he replaces his computer and phone every quarter, in addition to a bunch of other paranoid things. I'm not that extreme, but I did replace my computer once I got back from Kiev. I'd rather not worry about it.
- prox 6y ago
  I had an attack that kept the Malware after a factory reset, and I contacted Lenovo about it. They confirmed it was indeed still intact. We even did a low-level reset (a representative guided me through it) but to his own surprise the malware was still there. I was out of warranty and I had to pay a sum to get it fixed, which was more expensive than buying a new tablet.
growt 6y ago
That would be reasonable if the phone owner was likely the victim of some targeted attack (beeing politician or something similar). But if it's just regular malware that was installed with a drive by download, I would trust the android security model that much.
- prox 6y ago
  I wouldn’t. Some malware can hide a lot deeper than a factory reset can erase.
  - fomine3 6y ago
    Such behavior needs privilege escalation thanks to sandbox. I don't believe crap app can do privilege escalation for constantly updated phone.
Shivetya 6y ago
I do not use an Android phone, is there an easy means to restore one to factory condition? Is there a simple process to save and restore your phone to your PC/Mac similar to how Apple does it? (my father has an android phone and now I suddenly find myself curious about save/restore and how to find malware on his phone)
- goldcd 6y ago
  Yes - it's very easy to do a factory reset on your phone. No - There is no 'easy' way to store/restore the entire phone as I believe Apple does. (I had a miserable day doing this, when my old Pixel started playing up and had to migrate across to a replacement) - and this was best case when I had the two phones next to each other. Core 'google' stuff seems fine - either all tied to your account (e.g. contacts) or google app data (texts, pictures etc) which can be backed up to cloud, or directly migrated between phones. What doesn't work is the logins/settings for all the random apps. Some do store on cloud. Some allow manual export/import of settings. Some you're going to have to setup again from scratch. Back in the day when I did root my phone, TWRP and similar things let you image/restore the whole phone.
  - userbinator 6y ago
    Older Mediatek platform phones let you read/write the entire internal flash (eMMC) directly, which is AFAIK the full extent of persistent writable storage. That is the true "factory reset", as it's how they were first loaded with software in production. I believe the more widely-known and generic Android reset is merely restoring from an internal partition.
    - gruez 6y ago
      AFAIK since android uses read-only system partition, there's nothing to restore. It just wipes the data partition and that's it.
      - goldcd 6y ago
        Indeed. If you look at the storage requirements of an app, you can see it's split between "App Size" and "User Data" (along with a cache). AFAIK there's no way to actually backup/move the user data without rooting. Now I can see why Google might not want to store all that (and why I might not want them to) - but it's somewhat silly not to have any options.
r1ch 6y ago
Doing so would mean you don't trust the Android security model. No app can be granted permission to affect the OS or other apps unless the phone is rooted and you give it root.
- 3pt14159 6y ago
  I mean, I don't trust as a binary. I have continuums of trust from very little to very much. I know that people are capable of privilege escalation and persistence. I've seen it with my own eyes. I know it's unlikely that that specific piece of malware was able to get persistent root, but it could have and it also could have exfiltrated cryptographic keys or certificate or bearer tokens while it was on there. Better to just get a new phone if you're such an experienced software developer that you literally helped build Android.
  - drewmol 6y ago
    If you don't fear as a binary then threat assessment and mitigation cost may be a factor. Could be a closet ios user.

I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware. That kinda blows my mind.

abrookewood 6y ago

That's a pretty extreme and expensive option. I think I would have just gone for a factory reset.

3pt14159 6y ago
At the very least, yes. But I read something from a former NSA hacker once and he mentioned he replaces his computer and phone every quarter, in addition to a bunch of other paranoid things. I'm not that extreme, but I did replace my computer once I got back from Kiev. I'd rather not worry about it.
prox 6y ago
I had an attack that kept the Malware after a factory reset, and I contacted Lenovo about it. They confirmed it was indeed still intact. We even did a low-level reset (a representative guided me through it) but to his own surprise the malware was still there. I was out of warranty and I had to pay a sum to get it fixed, which was more expensive than buying a new tablet.

growt 6y ago

That would be reasonable if the phone owner was likely the victim of some targeted attack (beeing politician or something similar). But if it's just regular malware that was installed with a drive by download, I would trust the android security model that much.

prox 6y ago
I wouldn’t. Some malware can hide a lot deeper than a factory reset can erase.
- fomine3 6y ago
  Such behavior needs privilege escalation thanks to sandbox. I don't believe crap app can do privilege escalation for constantly updated phone.

Shivetya 6y ago

I do not use an Android phone, is there an easy means to restore one to factory condition? Is there a simple process to save and restore your phone to your PC/Mac similar to how Apple does it? (my father has an android phone and now I suddenly find myself curious about save/restore and how to find malware on his phone)

goldcd 6y ago
Yes - it's very easy to do a factory reset on your phone. No - There is no 'easy' way to store/restore the entire phone as I believe Apple does. (I had a miserable day doing this, when my old Pixel started playing up and had to migrate across to a replacement) - and this was best case when I had the two phones next to each other. Core 'google' stuff seems fine - either all tied to your account (e.g. contacts) or google app data (texts, pictures etc) which can be backed up to cloud, or directly migrated between phones. What doesn't work is the logins/settings for all the random apps. Some do store on cloud. Some allow manual export/import of settings. Some you're going to have to setup again from scratch. Back in the day when I did root my phone, TWRP and similar things let you image/restore the whole phone.
- userbinator 6y ago
  Older Mediatek platform phones let you read/write the entire internal flash (eMMC) directly, which is AFAIK the full extent of persistent writable storage. That is the true "factory reset", as it's how they were first loaded with software in production. I believe the more widely-known and generic Android reset is merely restoring from an internal partition.
  - gruez 6y ago
    AFAIK since android uses read-only system partition, there's nothing to restore. It just wipes the data partition and that's it.
    - goldcd 6y ago
      Indeed. If you look at the storage requirements of an app, you can see it's split between "App Size" and "User Data" (along with a cache). AFAIK there's no way to actually backup/move the user data without rooting. Now I can see why Google might not want to store all that (and why I might not want them to) - but it's somewhat silly not to have any options.

r1ch 6y ago

Doing so would mean you don't trust the Android security model. No app can be granted permission to affect the OS or other apps unless the phone is rooted and you give it root.

3pt14159 6y ago
I mean, I don't trust as a binary. I have continuums of trust from very little to very much. I know that people are capable of privilege escalation and persistence. I've seen it with my own eyes. I know it's unlikely that that specific piece of malware was able to get persistent root, but it could have and it also could have exfiltrated cryptographic keys or certificate or bearer tokens while it was on there. Better to just get a new phone if you're such an experienced software developer that you literally helped build Android.
- drewmol 6y ago
  If you don't fear as a binary then threat assessment and mitigation cost may be a factor. Could be a closet ios user.