7

I just bought a "new" Galaxy S7, but the box was already open when it arrived.

Condition of the phone was perfect, so I don't mind if it's used/refurbished. What I worry about is whether the device has a keylogger installed or some other malware.

It successfully accepted an over-the-air update. This gives it some credibility (I don't know how indicative this is, but I believe OTA updates are only offered to stock firmware).

Samsung KNOX is enabled, and hasn't complained yet.

I've rebooted into recovery, and see the following text:

Android Recovery
MMB29K.G930FXXU1BPHJ
samsung/heroltexx/herolte
6.0.1/MMB29K/G930FXXU1BPHJ
user/release-keys

Those are real build numbers for stock firmware I have been able to find online.

I've rebooted into ODIN mode, and see the following text:

ODIN MODE
Download speed: fast
Product name: SM-G930F
Current binary: Samsung official
System status: official
FAP lock: ON
Secure download: enabled
Warranty void: 0 (0x0000)
RP SWREV: B:1 K:0 S:0

The KNOX counter (warranty void) is still set to 0. This suggests further that it has not been tampered with.

Are the checks that I have performed already sufficient? There are some further checks I would like to know how to do:

I expect anybody can just type a build number in. I would like to compare the checksum of the firmware with the real build. I also would like to check if it has been signed with a Samsung certificate.

There are no custom User certificates in its security section. But I would appreciate some way to compare my System certificates to confirm they are genuine.

Improve this question

1 Answer 1

Reset to default
7

IMO, your firmware is original, because it

  • Received OTA - most clinching reason ( see edit for details)

  • Knox isn't tripped

  • Firmware number matches

For Samsung phones, there is a handy app that provides a lot of information about the phone, including Refurbishment Check. It also shows if the device is original. It is Phone INFO Samsung. App developer thread on XDA here

This question shows you to verify the checksum of OS. You could try that with the checksum available on OEM site or SamMobile Is there a way to verify stock ROMs?

Edit

Starting from Android 5.0 Block based OTA, in which the device can get an OTA when the entire /system partition matches with that does on their servers. Concerns of OP in comments are addressed here- if the system is modified OTA would fail

....File OTA tolerates some changes to the partition, such as the addition of files that are not part of the source or target build. However, block OTA does not tolerate additions to the partition, so users will need to install a full OTA overwriting any system partition modifications) or flash a new system image to enable future OTAs

(Emphasis supplied)

Improve this answer
5
  • Thanks; that gives me a bit more confidence. Is it possible for other parts of the phone's preloaded software to be malicious? When I first used it, it opened to a first-time setup wizard. But maybe this was just a malicious app rather than the real wizard.
    – Birchlabs
    Commented Oct 12, 2016 at 12:52
  • Thanks for providing a link to where I could lookup a legitimate checksum. But to compare it, I need to know also how to find the checksum of what's installed on my phone. I have the build number but I don't know the hash of its contents.
    – Birchlabs
    Commented Oct 12, 2016 at 12:56
  • 1. Pre loaded software implies part of system- if the system is modified, then you won't get an OTA or have Knox intact 2. Why do you suspect first time setup wizard ? - it's normal for phones to have that 3. IMO, there isn't a way to verify the checksum on your phone, simply because the checksum corresponds to a file format like tar/ zip which is a compressed format and on your device it is unpacked and installed
    – beeshyams
    Commented Oct 12, 2016 at 12:56
  • The reason I am wary of the first-time setup wizard, is: the merchant could get the phone with stock firmware, complete first-time setup, install an app which is a fake first-time setup, open it to enable all its privileges, and then sell the phone. There is a question though of "where would the app come from?"; you couldn't put it on the app store, so developer mode and "unknown sources" would need to be enabled (they weren't when I received the phone). Additionally, making a perfect fake would be hard. I suspect the Android SDK privileges it requires would not be available to developers.
    – Birchlabs
    Commented Oct 12, 2016 at 13:01
  • 1
    I am not a developer so can't comment on developer privileges. The moment you install a fake system app, wouldn't the system change? It would and OTA would fail. So I don't think that's a concern
    – beeshyams
    Commented Oct 12, 2016 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .