After reading this paper I observed a little and I realized that an SNMP socket (exactly two: v4 and v6) exists when I use ls /proc/1/net. I see them clearly.

My question is simple, do the bootkits exist on Android? I suppose yes, if it is the case would you have documentation to recommend me at the security level? Especially the use of SNMP, is it normal? For example a use by the phone operator for material supervision? But this phone is a second hand with a different operator that does not make sense for my case.

Two days ago I asked a question here related to mediatek and strange files and files saturating the memory space. But I did not find an answer in relation to audio_dump folder in the paper of blackhat, but some matches that are cold in the back.


There is no piece of software that has zero probability of being infected by some kind of malware. But in general, Windows by design is more prone to infections as compared to Linux and other UNIX based operating systems. Android is also based on Linux kernel, plus it has additional security mechanisms related to booting part, such as locked bootloader and Verified Boot. So generally we don't see Android devices hijacked by bootkits.

That said, init is the very first userspace process started by kernel with PID 1. It's a generic piece of AOSP, developed by Google and not modified by phone OEMs or network operaters (AFAIK). However its configuration files *.rc can be modified / added / removed easily to start / stop services and daemons on boot.

Presence of /proc/[PID]/net/snmp indicates that your kernel has ability to support an SNMP agent if run on your device. This is common, modern kernels are built so. Alarming is if there is an agent running in background on your device, something listening on UDP port 161 from an SNMP management console. You can analyze all listening ports using netstat or ss. Both are shipped with Android.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.