3

If I install malicious app accidentally can it copy itself onto the system partition? Or if a hacker gains access to my phone remotely can he install spyware onto the system partition?

I have read that malicious apps installed on system partition cannot be removed by factory reset or wiping the cache and the only way to remove them is by flashing the original firmware. Is this correct?

If possible then how can I prevent an unwanted software installing or being installed permanently?

Improve this question
3
  • 1
    On newer Android versions at least, chances aren't much. /system is read-only, protected by dm-verity, very strong framework. Apps are strictly sandboxed in DAC and MAC. Though vulnerabilities are never zero, what you suspect doesn't happen very often. Also Android's/Linux's executable code isn't that much open to accept viruses as Windows' is. So malware can't propagate that fast. Another margin is the hardly available administrative/root privileges on *NIX-like OSes.
    – Irfan Latif
    Commented Oct 17, 2019 at 23:40
  • 1
    You say newer versions are better protected. What versions do you mean?
    – Linux_user0987
    Commented Oct 18, 2019 at 3:48
  • 1
    New security mechanisms are added to new versions, bugs are fixed, so every new release is better than previous. Also security updates are released on monthly basis to fix any security vulnerabilities. So the priority should be to keep updated AMAP.
    – Irfan Latif
    Commented Oct 18, 2019 at 7:13

1 Answer 1

Reset to default
1

Yes, under certain circumstances it is possible to install software remotely on your system partition. And yes, once a software is installed on the system partition it is immune to a factory reset, as the factory reset never changes the system partition.

However for doing so your device must be vulnerable to an exploit that allows to modify the system partition, as this is normally not possible from within a normal app.

Consider the two scenarios which are common ways to infect your device:

  1. You install an app that contains malicious code that uses an exploit to temporary root your device and then installs itself onto the system partition.

  2. You are surfing the web using a browser that has a vulnerability. You end up on a web site that exploits the vulnerability of your browser to download malicious code into browser. Afterwards the code additionally exploits your system similar to the first infection variant.

If you don't want to be affected by malicious code that installs itself permanently onto your device there are some basic guidelines:

  1. Don't download apps from the internet or other untrusted app stores.
  2. Or even better, don't install apps you don't know.
  3. Always install the updates for your favorite webbrowser app(s).
  4. Use a device that regularity gets security updates from the vendor (the more often the better, for some devices there are security updates monthly). Hopefully this allows you to fix the security problems before an malicious app can use it.
  5. Don't use a device that no longer receives security updates. If your device is no longer supported I would recommend to to root/unlock the device and install a recent version of LineageOS. Of course this usually means that you should consider this when buying a device (possibility of unlocking plus supported by LineageOS).
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .