Security on a Nexus 6P purchased on Ebay

Question

I purchased a used Nexus 6P on ebay to replace my current 6P, because the camera has failed.

The seller indicates that the new phone has been factory reset, but I'd like to be sure that there is no spyware hidden deep in the system.

On a desktop machine I would erase the hard drive, install the operating system of my choice, and be confident that most reasonable vectors of attack were removed. (Sure, he could've hidden something in the firmware of a device or whatever else, but I'm not worried about that level of sophistication).

I'm not sure how Android factory resets work, but given that the phone's memory is never completely erased, I worry that a malicious actor could have put bad software into the image that the factory reset restores from.

Is this a valid concern? If so, is there a way to address it and be sure that my phone is not sending all of my information to some one else (other than google)?

Answer 1

Theoretically, a factory-reset wipes data only while any deep seated malware that injects itself into the /system partition isn't wiped. To that extent you have a valid concern.

Fortunately, you have a Nexus device. Google provides factory images for Nexus/Pixel devices (here). You can flash the factory image for your device following instructions on that linked page. See adb tag wiki, if you aren't familiar with adb. It might look a little complicated if it's the first time you are doing this, but it isn't.

Answer 2

In addition to the accepted answer, by flashing the official image and applying bootloader lock you have 100% spyware-free guarantee.

This because Android devices with a locker bootloader won't boot if the boot loader is not genuinely signed by the manufacturer, and the public key is buried in the firmware.