• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Stranger had his way with my phone

P

phatfinger

Newbie
Since then, weird things have been happening.

I've always been generous in letting others use my cell phone. There are very few public phones left. I use a pay-as-you-go plan so the worst damage I could suffer is the draining of that pre-paid account. Maybe a hooker might call her crack dealer. So what? I expect the police listen to all my calls anyway.

I got my first android phone about a year ago. The idea that someone might install a bug into my phone never occurred to me. I've been thinking a lot about that lately however.

I'm surprised I can't find more about this aspect of security. There are countless articles written about how secure the Android OS is and how hackers can't break into your phone. What about if someone picks up the device? What sort of havoc could be spawned if a bad guy were to get his hands on the phone itself?

I befriended a young fellow who claimed to be homeless. I introduced him to an iPhone guy I know who's eyes and hands are not so steady. He asked the young stranger to make a repair to a phone. I have the tools at my place so a deal was struck. Fix the phone in return for board and fast tracking to a welfare cheque.

In the morning, the young stranger was gone. The iPhone, some RAM and some other goodies also gone. My android phone now has a bunch of apps installed and my desktop machine sports a new moniker and some ios hacking tools. Why did I sleep all day? Ghb is my best guess. I was g-holed - slipped a mickey. The bastard poisoned me. He must have previously shoulder surfed my phone's screen lock. I must have crashed without shutting down my computer because it was still on and logged in when I recovered.

The stolen iPhone turned up. The cheeky bastard sold it to another friend who brought it to us for jailbreaking a few days later.

What to do? I could wipe and reset everything now, but that won't solve the mystery of his real intentions. It's become clear to me that this guy is part of a larger gang. This gang knows me to be a high value target. I won't get into details, but I have been the object of pointed attacks for years due to the huge sums of electronic transfers that I safeguard in the course of my job.

So I just isolated the Android and the PC and have been using replacements since. I really do need to get to the bottom of why I was jumped and what these people's angle is or I will never feel secure again.

I have also had problems with women snooping my text messages - jailers too. Nothing prevented any of them from also installing spy software or copying off my phone book.

I must make a new plan to protect my phone from these criminals.

So, how do I determine if my android is spying on me? Is there any sort of system like Hijack this! I can run? I did root the phone thinking that maybe the bad code is running as another user but there is just so much stuff to go through and I don't have the tools to pick it all apart.

Any insight or advice is most welcome.
 
Think it's game over for any security if a complete stranger, crack dealer, hooker, etc, is getting hold of an unlocked phone, You're losing sight of it and they're doing what they like to it. They might as well have your wallet.

If you get the phone back, provided it's not rooted, a complete factory reset should clear everything. Also a very good idea to change passwords for any accounts associated with the phone. As soon as a phone goes missing, my first steps would be to try and remotely erase it via Google, also report it to the the carrier as stolen, so they can IMEI/ESN blacklist it.
 
As far as for spyware on your phone, you can install SRT app scanner and it works pretty well. It also tells you if your device is running with security vulnerabilities or 'bugs'. Which those can be fixed with rooting and installing Xposed installer and using the master key fix module for it. If you can find anything on here about xposed look to XDA forums. I know there's a thread on there detailing it. I hope you get this figured out. :)
 
Perhaps I made my post too long.

I never lost the phone. I still have it and it acts weird.

I know I can reset it and change passwords but, as I explained, it's more important to understand what has happened.

It's only a phone, one of many in my realm.

I want to know what has been done to it and what could be done to a phone under these circumstance.

I hope you guys will read more carefully my original post.

thanks!
 
Without seeing the actual phone and evaluating the processes, comparing what is running now to a purely stock version of the same phone, we can only speculate.

If you are asking what is possible, then given that your phone was out of your possession and out of your sight for an extended period of time (longer than 10 minutes), then pretty much anything is possible. Spy apps for sure. Key loggers. Spoofing or account piracy ... you name it.

Look at it this way ... If I let a stranger in my home and during the night I left my wallet in such a place as to have free access, if they stole it outright, I'd simply call the police and cancel the credit cards. I'd be out the cash and the hassle of replacing my ID and cards. However, if they took the time to copy the numbers off all the cards, and copied my identification and social security cards, they could make charges and spoof my identity for days or even weeks before I caught on leaving me with a credit nightmare and compromised identity.

So, are you asking what's possible? Are you asking for suggestions on how to fix your current phone? Or, are you asking for suggestions on better practices to prevent this sort of thing in the future?
 
I've read your first post, but let me transcribe it for you:

* Someone I don't know had full, unsupervised access to my phone and computers for an extended period
* I have reason to believe they did something bad. Tell me what & how I can work out what they were up to?
* The phone "acts weird".

I'm sure you see the problem: the question is way too open for anyone to answer reliably.

TBH the most promising sign for your android phone is that you can see they installed some extra apps. If they were actually smart they'd have put something on you couldn't see and left it at that. If the phone isn't rooted (but best to check!) a factory reset will clear it. If it is, a clean ROM flash will do the same (because that will wipe anything that was installed to system). If apparently unrooted but you want to play safe, flash a replacement set of stock software. If you want to work out what has been done you'll need to become more expert than the person who had access, and guess correctly what they might have been up to. As we don't know how adept they are or what their intentions were that's a tricky one - might get lucky, might not. So I'd say see what you can spot that is untoward, then nuke them from orbit - it's the only way to be sure.
 
This whole story is weird. But IMO the scariest part is that someone with the following responsibility...

phatfinger said:
...but I have been the object of pointed attacks for years due to the huge sums of electronic transfers that I safeguard in the course of my job.
Click to expand...

...would willingly and repeatedly place him/herself in potentially compromising situations.

That said, I agree with Hadron... either re-flash factory images, or factory reset if you can be certain the device was never rooted. There's really no way to know what was actually done to the phone, but given enough time (which appears to have been the case), ANYTHING could have been done. To be safe, assume any information on the phone, or any information that could be accessed using information contained on the phone (i.e. account names/numbers, passwords, etc) is now in the hands of a stranger.
 
phatfinger said:
He must have previously shoulder surfed my phone's screen lock.
Click to expand...

Or just seen the finger smudge you left on the screen when the screen is off?

Involve the police, get new phone, create new accounts, different passwords... move on.

I've only ever lent an old 'dumb phone' to someone to make a call & then I was right in their face, so to speak. Today, on a smartphone (personal computer), no chance.

BTW, they are not hackers if you have given them your phone.
 
You guys are putting to much focus on saving the phone from the unknown. I don't care about the phone as stock. Now I have a real treasure. A working example of mine enemies' tech. Why would I want to throw that away? Once I understand their tack, I might use the device(s) to counter by red herring or stir up intel.

Factory reset? No. Understanding what they have done to the phone is not a question for a pat answer. I want to know the techniques I can use to discover and understand. TI want to know the enemy's moves.

> would willingly and repeatedly place him/herself in potentially compromising situations.

Why would this incite you to chastise me? I know about pointed attacks from my comprehensive experience. Now I'm expanding that knowledge by studying what sort of attacks on an android could be attempted. I do the comptroling (if you will) because the stakeholders trust me best. They know me as a tenacious hacker. You insinuate that I am incompetent. My track record shows otherwise. The cheap Android I let the hookers call their dealers from is not any part of a financial structure. Why would you think otherwise?

OK, do we have any service that can analyze the running processes for rougues? Anything like Hijack this! that can help me find bad settings or running code? Do we use anyhting like WireShark to capture and analyse packets for evidence of spies calling home?

What tools and techniques are we using to discover intrusions to these tiny computers in our phones?

> Or just seen the finger smudge you left on the screen when the screen is off?

That is also likely. I have been looking at the smudges on others' phones and getting the swipe pattern too often. Obviously it's not good enough defence.

> Involve the police,
Heh. Absolutely not. The biggest enemy I have directs the police against me.

> BTW, they are not hackers if you have given them your phone.

A hacker is anyone who determines to use a technology in a novel way to an end result not intended by the designer. I know what a hacker is.

> So, are you asking what's possible?

Yes, but the answer "anything" is not helpful and cannot be correct.

> Are you asking for suggestions on how to fix your current phone?

No no no no no. And it's not my current phone. As I explained, the phone has been isolated as infected since the compromise occurred.

> Or, are you asking for suggestions on better practices to prevent this sort of thing in the future?

Yes and No. I'm looking for the tools and techniques to discover what has been done and how it has been done. I'm looking for the knowledge to be able to actually find the bugs and spies that could be put in a phone.
 
mikedt said:
Think it's game over for any security if a complete stranger, crack dealer, hooker, etc, is getting hold of an unlocked phone, You're losing sight of it and they're doing what they like to it. They might as well have your wallet.

If you get the phone back, provided it's not rooted, a complete factory reset should clear everything. Also a very good idea to change passwords for any accounts associated with the phone. As soon as a phone goes missing, my first steps would be to try and remotely erase it via Google, also report it to the the carrier as stolen, so they can IMEI/ESN blacklist it.
Click to expand...

Too late now but, if you would of had aVast installed and configured, you can instantly lock the phone, record audio, take pictures, and use the locate phone services, as well as other functions.
 
03bluecoupe said:
Too late now but, if you would of had aVast installed and configured, you can instantly lock the phone, record audio, take pictures, and use the locate phone services, as well as other functions.
Click to expand...

Would not have helped in the situation. Avast requires the owner to be awake and activate those features remotely. In this case the guy was asleep and the stranger could have done anything during that period.

03bluecoupe said:
lol at what? (Note to self: put a rant in the rant thread about folks not quoting... )
Click to expand...

The title. READ IT SLOWLY. I initially thought this was a satiritcal or troll thread because of the title.
 
You must log in or register to reply here.
Back
Top Bottom