3

I've just bought a Jiayu G4 and it came with android installed (rooted).

My question is - how can I tell that nothing nasty has been installed on the phone? Or best practices to ensure that it's safe to use. I've had a look but I haven't seen any accounts of malware distributed Android OS's, but I'm sure it can happen.

Obviously there's an (un)healthy amount of paranoia here, but it'd be nice to know that data isn't being siphoned off somewhere it shouldn't be.

Improve this question
1
  • 1
    It's hard to give a generic advice, especially when there's no specific hint included (like suspicious behaviour of some kind). You might still want to check other questions tagged "security", or, more specific, security+malware. Those at least give some "real world examples" and (hopefully) countermeasures, which might point to "prevention and detection" possibilities as well.
    – Izzy
    Commented Oct 29, 2013 at 23:32

1 Answer 1

Reset to default
2

The bad news: You very probably can't.

If the manufacturer decides to backdoor your phone's firmware, it's hardly detectable by individuals.

Phones consist of many components of which only a tiny fraction is really authored by the manufacturer.

Think of drivers and firmwares for various chips like the baseband, wifi, sensors, the various open source parts like the linux kernel, the Android system itself, the closed source Google apps and additional 3rd party packages from other other companies, that are preloaded.

To be sure, you would need all of the firmwares' source code and a way to compile it in a way such that the official builds and your build match bit by bit to prove that the source code matches the firmware (and nothing was secretely altered). Now one still needed to audit all the source and scan it for backdoors/vulnerabilities.

To get an idea: TrueCrypt is a popular disk encryption software for many operating systems. In the wake of the NSA scandal its sources have recently been binary matched with the official windows releases which was a very tedious process (report here). A source code audit hasn't been conducted yet, but there's a (now) still running indiegogo project for funding that audit with currently ~35k US$ pledged for doing it.

Improve this answer
2
  • 1
    Right, I mean that's what I was expecting the answer to be... and I suspect the only real way to get an idea would be to run wireshark on the same network and see what the device is actually doing.. I mean I suspect it's probably fine, after all, if it came out that a particular manufacturer was manufacturing spyware it'd be pretty detrimental to their reputation. Anyway, thanks for the answer :)
    – patrickdavey
    Commented Oct 31, 2013 at 18:11
  • If you really care about free software as in freedom, you might want to have a look at the replicant project: replicant.us they however don't support many models: fsfe.org/campaigns/android/liberate.html
    – ce4
    Commented Oct 31, 2013 at 20:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .