I have Android phone that fails to boot after working happily some time.

I'm trying to install official firmware update zip from manufacturer's site, but update fails with errors:

  E: footer is wrong
  E: signature verification failed
  E: install package error, result = 7

Google results suggest that official updates can fail integrity verification only if the device is rooted (yes, I've re-downloaded the update several times, the file is ok). As the phone does not boot, I cannot use the "root check" app or terminal etc. On top of the recovery menu, after the ROM version (I guess) there's a line: user/test-keys.

Is this a sign that the device is rooted?

  • 1
    I don't think so but which device? – beeshyams Jun 4 '17 at 0:32
  • HOMTOM HT16 Purchased 3 months ago. The user does not remember rooting it but I guess it could be remotely hacked. – ddbug Jun 4 '17 at 0:38
up vote 1 down vote accepted

It means that firmware on your device is not signed by release keys and is vulnerable

The Android tree includes test-keys under build/target/product/security. Building an Android OS image using make will sign all .apk files using the test-keys. Since the test-keys are publicly known, anybody can sign their own .apk files with the same keys, which may allow them to replace or hijack system apps built into your OS image. For this reason it is critical to sign any publicly released or deployed Android OS image with a special set of release-keys that only you have access to.

(Emphasis Supplied)

This SO question supports

Release-Keys and Test-Keys has to do with how the kernel is signed when it is compiled. Release-Keys means it was signed with an official Key from an official developer. Test-Keys means it was signed with a custom key generated by a third-party developer. From a security standpoint Release-Keys generally means the kernel is more secure, which is not always the case

and hence is a security risk as reiterated in this XDA post

Does it mean my device is rooted?

The fact that you have not been able to apply official firware updates ( which check for root ) indicates that the device may be rooted (in addition ). You can verify in alternate ways (other than apps ) as mentioned here How can I tell if I have root?

Related Can I 'trick' my device into thinking it's unrooted?

  • beeshyams, I didn't remember installing other firmware updates on this phone before. What official updates do you mean: apps from the Google Store? – ddbug Jun 4 '17 at 1:21
  • So, the line "user/test-keys" does mean that the current firmware (whatever it is) built with these test keys? – ddbug Jun 4 '17 at 1:23

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.