2

Is it true that you can not unlock the bootloader of an android device remotely and the only way you can infect the firmware or bootloader is to have physical access to the device.

What about rooting? Can a hacker root your device remotely?

So if it is true does that mean that no matter what kind of malware your device is infected with you can remove it by simply performing a factory reset?

6
  • again, no answer without knowing phone model. for example if device is exploitable with mtk-su, malicious app could gain root access remotely (on tap). for some devices bootloader unlocking is possible by modifying devinfo or seccfg partition (can be done with root access). in case system partition is modified too, simple factory reset won't fix
    – alecxs
    Aug 7, 2022 at 9:36
  • @alecxs: What about Huawei or Samsung phones? If there is difference between models then what about huawei p or y series or Samsung s or a series? (I have many phones)
    – User4857
    Aug 7, 2022 at 16:03
  • @alecxs: So do you think if I got infected by the pegasus spyware on a huawei phone, I can remove it by performing a factory reset?
    – User4857
    Aug 8, 2022 at 4:40
  • Pegasus depends on zero-day exploits, I don't think your huawei phone got infected. simple factory reset won't remove root kit
    – alecxs
    Aug 8, 2022 at 6:56
  • @alecxs: But since rootkits by definition infect the firmware and you said huawei and Samsung phones can't be rooted or unlocked remotely so the installation of a rootkit without physical access should not be possible right?
    – User4857
    Aug 8, 2022 at 14:39

1 Answer 1

2

If you can dream it up, it can be accomplished ;) I do not know of any PUBLIC methods to do this at the moment, but I assure you it's possible.

For example, there is a malware called "xHelper" and also matryoshka. You'll see that in this particular example, the kit abuses root privilege to silently install xHelper by directly copying malicious package files to the system partition (/system/bin folder) after re-mounting it in the write-mode.

It also has a sister-kit called Triada. These kits take the extra steps of making their core files immutable, and overwrites to system library /system/lib/libc.so.

This means that you would need to enter into Recovery mode, chattr the libc.so to mutable, delete and replace it with a good version, then re-image. Did I mention this malware family removes your root access? ;) You can get very evil with Android or any OS if you want to.

As far as your second question, factory resets are usually enough to shake malware infections, but if you have an advanced adversary, it can enter parts of the boot process that would be extremely difficult to detect and remove. That said, we're talking government-level attackers.

Most phone malware can be shaken by uninstalling the offending app and/or even rebooting. If you look at 'Exploit Brokers' that buy malware professionally, one of the biggest and most expensive things they pay for is PERSISTENCE. That's because maintaining the malware on the device is increasingly difficult these days.

1
  • modifying /system/bin will trigger avb/dm-verity and deny boot. therefore it is necessary to disable dm-verity, but that is not possible on locked bootloader. so this kind of infection does apply to old insecure devices with weak/broken secure boot implementation only
    – alecxs
    Aug 9, 2022 at 11:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .