Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

If I downloaded a non-market application and installed it and discovered it may be malicious, does removing it from the list of applications completely discard it and help mitigate any security issues? If not, does resetting the phone back to its factory settings mitigate any security issues?

share|improve this question

1 Answer 1

up vote 7 down vote accepted

I don't know that there's a definite way to answer this. It would be almost entirely dependent on how exactly the app was attempting to infect your phone and how successful its attempts were.

In the simplest case, maybe the app is sniffing data or something of that sort. For that case, uninstalling would basically remove the threat since the app would be gone. Nothing is left behind when you uninstall, including the /data directories for the app.

Slightly more complex would be an app that put a malicious payload somewhere on your system's publicly writeable storage. In that case removing the app would not necessarily be enough, depending on what exactly the payload did and how it was designed. Uninstalling could potentially cause the malicious code to become inert on reboot since the app may need to fire up a service on boot, but that's hard to say. Formatting your SD card and doing a factory reset would probably clean it up in its entirety.

The most nefarious case would be an app that gained elevated privileges on your device, either through an exploit or effective social engineering in which you grant access yourself. In that case a factory reset would not necessarily be enough, since the entirety of the /system partition would be unaffected. If the app were to stick a payload on /system then the only way you could really be sure you're clean is if you completely wiped all of the internal memory of the device and then reinstalled a new ROM, I would say. Even worse would be if it somehow managed to write a malicious bootloader or something of that nature, since in some circumstances it's possible to write to the bootloader partition from userspace (given proper permissions).

share|improve this answer
    
Thanks. When you say 'gain' elevated privileges, what do you mean exactly? –  PeanutsMonkey Apr 25 '12 at 23:32
1  
@PeanutsMonkey: Basically if the app finds an unauthorized way to get root. There was at least one instance I recall where an app included a root exploit (gingerbreak, if I'm remembering right) and used it to grant itself root permission without any user interaction. –  eldarerathis Apr 26 '12 at 1:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.