1

For this scenario let's assume the following:

  • The phone is stolen and locked. The thief does not know the lock combination and cannot determine it.
  • There is no external SD slot.
  • USB debugging is disabled.
  • The bootloader is locked.

In case it matters, the phone is a Moto G from Motorola (i. e. not the Google play edition)

Is this enough to hinder a smart thief from resetting or flashing my phone? If not, what else could go wrong?

  • 1
    This will most likely depend on the phone, so I don't think you'll be able to get an entirely generic answer. On a Nexus device, for example, the answer would be "no". You can use fastboot to unlock the bootloader and re-flash the phone even in the circumstances you've described (your data should be wiped in the process, though). – eldarerathis Feb 6 '14 at 16:49
  • 1
    I guess what eldarerathis wrote is valid for most devices. If I had such a device (not stolen, of course), I would simply enter recovery-mode and do a factory-reset. Voila, a virgin device (not necessarily on the Virgin network, of course). // If the thief could access your data is a completely different case; for that, above mentioned measures already offer a decent protection. – Izzy Feb 6 '14 at 17:42
  • @Izzy Thank you for that insight! - even though it's a pity :(. Despite that protecting access to all my Google data is obviously more important which is comforting. – king_julien Feb 6 '14 at 17:51
  • 2
    A lost device can be replaced with "a little money" provided. But nothing can pay you for lost data (make good backups!) or your personal data gotten into the wrong hands! – Izzy Feb 6 '14 at 18:10
  • @Izzy I'll always upvote posts that recommend to make good backups :) – king_julien Feb 6 '14 at 18:12
9

Although difficult to generalize, in a pretty good number of cases, using a lock screen PIN/password is not going to be sufficient to prevent someone from wiping your phone and/or flashing it with a new ROM. It may be an effective enough deterrent to prevent them from accessing your personal data, but there are a few considerations that go along with that, as well.

Firstly, if the bootloader is unlockable, then there is effectively no way to prevent someone from reflashing the device. The fastboot utility will give them the ability to flash unsigned images once the bootloader is unlocked, and unlocking it will not be prevented by any userspace security (like a PIN/password or keeping USB debugging disabled). Nexus devices always have unlockable bootloaders, so those are a given. For other devices, you can typically find out if your device has an unlockable bootloader by visiting the development portal of your manufacturer's website. Samsung devices will use Odin/Heimdall instead of fastboot (excepting some outliers, like Nexus devices made by Samsung which also have fastboot), but you can generally find out if a Samsung device will accept unsigned images via a bit of searching (in many cases they will).

Some devices have other ways of accessing fastboot/recovery, some more esoteric than others. It's not terribly uncommon for there to be a key combination that will boot a device into its stock recovery system, which will provide some means of performing a factory reset, thereby removing any lock screen security that was configured on the device. Another complication can be if the device recognizes a factory cable. The Kindle Fire, for example, would let you flash an unsigned image with a factory cable, meaning you could actually get a custom recovery installed without wiping the device. This would put all of your data at risk if the attacker was properly equipped and technologically savvy.

There are probably other concerns that I'm not considering here, as well, but these are the basic ones aside from bootloader exploits and the like, which are not really predictable in the long-term. In general, though, there is a saying about security which Microsoft sums up as such:

If a bad guy has unrestricted physical access to your computer, it's not your computer anymore

...and that's a pretty accurate way of putting it for an Android device. If your concern is securing your data then userspace security like a lock screen password, locked bootloader, and keeping USB debugging off are going to be great defenses. If you're looking to secure your device such that no attacker could make use of it, then you've got a significant uphill battle, and the odds of winning are going to be very slim (and quite possibly zero).


NB: For your specific scenario: the Moto G is supported by Motorola's bootloader unlock program. Therefore, userspace security will not prevent someone from resetting or reflashing your device.

  • Wow, this is a very elaborate answer and it addresses all the concerns that I had! Thank you very much for the time you took to write it. I've come across the saying that you quote before and was worried, yet Google's android device manager description says that it "locates lost devices and helps you keep your **device**—and the data inside it—safe and secure." Since keeping the data safe is more important for me, I won't have to be too paranoid about loosing my phone thanks to this answer. :) – king_julien Feb 6 '14 at 18:05
  • One other thing, unless you have full disk encryption, then it would not be too terribly difficult for a determined attacker to bypass userspace security to read your data from the storage. If you have full disk encryption, then obtaining your data should not be possible without some fundamental weakness in the implementation of the disk encryption (e.g. as in recent iPhone vs FBI debacle) – Lie Ryan Mar 22 '16 at 10:14
0

If you flash a custom ROM with a bootloader that cannot be unlocked for any reason and that does not have a factory reset option, disable data transfer if stolen, prevent safe mode of any kind, enable gps tracking with no signal in or out of the phone/tablet except gps, encrypt the device, then you could possibly prevent a thief from using your phone. I do not know of any such custom ROM.

  • Sidenote: You can't flash a ROM with a locked bootloader. But some manufacturers allow relocking of their bootloaders. – GiantTree Jan 27 '15 at 14:53
0

If you have a motrola phone ( Moto G as you have described it) with locked bootloader then your safe thief cant unlock bootloader without having access to your email.

In short if you have any motorola phone and you have not unlocked your boot loader and you have a lock screen password or pattern then your phone cant be reflashed or reset.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.