How can I verify my phone's Bootloader, OS, and ROM haven't been tampered with?

Question

I just purchased a Galaxy S7 for a really cheap rate... and it makes me wonder if the phone has been hacked in some way.

I know the phone supports Samsung Knox, and am new-ish to Android overall.

Question

• What can I do to verify if this phone was untampered with?
• How can I reset it (restore ROM?) to a known-trusted state?
• Is there a general process for all Android phones, or is the verification method and technique manufacturer-specific?

Would love to know about any notable Android hardware security solutions (I already researched Blackberry Priv and Samsung.)

Answer 1

There are a few indicators of modified/unmodified devices, depending on what was modified and how.

Depending on the manufacturer and model, some of these indicators are not available.

These should apply to any recent Samsung phone:

1. : Go to Settings -> About phone -> Status -> Device status.
   As long as the ROM/firmware hasn't been tampered with, it should show Official.
   This can be Official, even when using custom ROMs, so it's not the best indicator, but the easiest to access.
2. : Hold Volume-Down+Home when powering on the device to boot towards the bootloader (used to install official and custom firmware, recoveries etc) and press Volume-Up without connecting it to a PC (just to be sure).
   It will show some information about the state of the device like
   the binary status ("Custom" means it's modified), the system status (I rarely seen this not reading "Official")
   or KNOX warranty void status (just voids any warranty around KNOX, not anything else; hardware warranty and non-KNOX software warranty is still valid) that indicates tampering with the system at any point in the past (not even reinstalling an official firmware will reset this).

Devices which utilize fastboot, can be queried using the fastboot command (from the Android SDK, but there is a package with only the required files).
The command should be fastboot flashing get_unlock_ability (not tested, I don't have a device with fastboot capability).

Answer 2

Just to be sure you can simply download stock firmware for your phone model and flash it, if someone has played with something it will be gone. (Not sure about bootloader lock state, on some phones it reverted back to locked but on some doesn't).

Answer 3

Turn off your phone then press volume down + home button + power a warning screen appears press volume up

WARRANTY VOID should be 0. 1 means the system was or is an an NOT official feature, but if the current binary & system status show official everything should be safe.

After that you can run an antivirus scan with the built in Virus scanner