-1

With more and more people using custom ROMs and APKs from unknown sources (some with root access) it's inevitable that Android phones are getting compromised.

What are some methods that can be used to see if your phone is compromised.

Examples I've thought of so far include:

  1. monitor outgoing traffic (is there an app for this?)
  2. List on going processes (how can I see processes that aren't in the app tray?)
Improve this question
2
  • Define compromised here? Data leak and violation of privacy kind of happens all the time and users do that by giving permissions during installation time, so I don't assume that would count into compromised here.
    – Firelord ♦
    Commented Apr 29, 2016 at 18:38
  • Not a simple data leak. More like remote root access. Any type of malware that can't be removed by simply uninstalling a single app.
    – Philip Kirkbride
    Commented Apr 29, 2016 at 18:40

2 Answers 2

Reset to default
1

Partial answer

Network Monitoring: How to Get Started and Why You Should Consider it, a post which appeared on XDA portal explains this using Fiddler- The free web debugging proxy for any browser, system or platform

The XDA post explains, set up of Fiddler, creating a proxy, connecting your phone and laptop on the same WiFi network and analysing traffic.

Improve this answer
1

Power off your phone. Power on your phone. Note the Google logo. Is an unlocked padlock symbol underneath your Google logo? That symbol means you have an unlocked bootloader, which opens your phone up to bigger compromises.

Improve this answer
2
  • That's not much useful, really. If the bootloader had been unlocked without user's knowledge then the data would have been [automatically] wiped as well, in turn, triggering to user that device had been tampered with or was used without authorization.
    – Firelord ♦
    Commented May 24, 2016 at 5:23
  • Obviously I wasn't referring to someone unlocking the bootloader. Forgetting to re-lock the bootloader opens the device up to all sorts of potential attacks. As you pointed out, with a locked bootloader you know that nothing has been flashed, as that would automatically wipe the device. An unlocked bootloader, technically speaking is the definition of compromised.
    – andDevW
    Commented May 24, 2016 at 6:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .