4

My company has some Android devices that are available for our customers to use. Customers have nearly full access to the devices, and unfortunately a customer recently installed Android Device Manager, added their Play account, registered the device to themselves, and then disabled the phone.

I was able to recover the devices by factory resetting and logging in with one of our existing play accounts, but I'd like to prevent this from happening in future.

Is there a way to prevent device administrators from being added to an Android device? I know I can create an administrator app and set it as Device Owner to ensure it's always an admin, but I don't think this will prevent this scenario from occurring again.

Improve this question
3
  • Password on the settings? Then they cant mess :)
    – Dan Brown
    Commented Dec 12, 2016 at 21:30
  • We use AppLock on some of the devices for this, but I've found ways around to disable it that our customers may have found too. Are there other suggestions for non rooted devices?
    – Malcolm Crum
    Commented Dec 13, 2016 at 6:21
  • Switch applock - some do much better than others. Short of that, Use a custom launcher, and Hide ALL ways of getting into the settings. Or just trap the device in overview mode - They can only use one app, and need the system password to leave it.
    – Dan Brown
    Commented Dec 13, 2016 at 10:23

1 Answer 1

Reset to default
3

Physical control is total control.

If they have full physical access, if they try hard enough (and that customer obviously didn't do that by accident) they'll always be able to mess with the phone.

You can, however, make this much harder. As @Dan Brown suggested, you can lock the settings away with a password. Something else that comes to my mind is creating a new user on the phone (that is possible if you have at least Android Lollipop or a custom ROM based on it), again locking the main account which has administrator access away behind a password and then giving the phone to the customer with only access to the restricted user. Again, if they try hard enough they will still be able to break this if they have the device and enough time and knowledge. But a seperate account should be one of the easiest built-in ways to make this harder. You can also try some apps which offer parental controls - these apps need admin access but in turn can lock many rights away. But they often cost money and/or don't always work right.

I'll do a bit more research on this and edit the answer in case I find a better solution

Improve this answer
4
  • they can smash it with a hammer anyway.
    – Display Name
    Commented Dec 13, 2016 at 11:24
  • @SargeBorsch But that is destroying, not taking unauthorized control over it
    – Namnodorel
    Commented Dec 13, 2016 at 11:42
  • in this case it's almost the same, the attacker tries to hijack or disable the device while temporarily possessing it, they might as well steal it (claim it was stolen from them) or physically destroy it. if the device is intact, it can be reflashed and everything that's software related is not a problem anymore. and if the attacker is determined enough to plant hardware-level malware, then there's no way to protect from it (except that there's some chance to detect physical tampering by visually inspecting device guts)
    – Display Name
    Commented Dec 13, 2016 at 12:47
  • Looking at this issue again, forgot I asked the question already. In my case customers don't have physical access to devices, they install apps and control devices remotely, so I don't worry about hammers.
    – Malcolm Crum
    Commented May 30, 2017 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .