Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

I wonder if is possible for those people who download the Android source code and customize it then release their custom roms to hack the API or any other part of the codebase like GMail client or network stack so to push in the rom some kind of spyware, virus and so on...

my main concern is that I like to experiment custom roms made available by any developer online but I really would not like to get my traffic sniffed or my Google Account pwd stolen.

Any idea? is Android safe by default in this way or could it be altered?

share|improve this question
add comment

2 Answers 2

up vote 12 down vote accepted

No piece of software that you install on any hardware of any form is 100% safe unless you are the author or you've read all of the source code, verified its safety, and built it yourself. Okay, so this may be something of an oversimplification, but it's actually not too far off in most cases.

Custom ROMs are no exception to this. Yes, a ROM author could put spyware, a backdoor, or just about anything else they wanted into a ROM if they wanted to maliciously exploit it. With AOSP ROMs I suppose the possibilities are somewhat magnified since the Android source itself could be modified to contain some kind of exploit or spyware.

It's also worth noting, however, that running a manufacturer stock ROM isn't necessarily a safer option if you're concerned about privacy.

The question "is Android safe by default" is in some ways kind of a meaningless question. Is it designed to be safe? Well yes, data is protected at the application level and apps are sandboxed. Any OS is intended to be safe, but all of that goes out the window when you run a ROM that's not pure AOSP. On top of that, the nature of code is that it has bugs, with Android being no exception. Custom ROMs and manufacturer ROMs alike can absolutely have the potential to introduce (either intentionally or unintentionally) ways for your data to be sniffed or stolen.

share|improve this answer
    
This is one reason why open source has such high value. You know exactly what you're getting and you can help fix problems if you find them. –  earthmeLon Mar 14 '12 at 0:25
add comment

While this question is not often asked, it is one of the best concerning Android safety out there. Custom ROMS are not safe at all. Ise only official firmware and OS.

share|improve this answer
2  
It's very interesting that you should recommend avoiding custom ROMs because they might contain spyware, and using official ROMs instead, when several are known to contain spyware. –  Dan Hulme Aug 31 '13 at 14:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.