Am I hacked or not?

Hello. I currently use an android 11 os. About a few months ago I noticed strange activity on my phone. I checked the security of the device it was red. I tried to update it said it was up to date but says the last update was 9/1/2022 which I found odd so I couldn't update it. I've observed apps opening randomly and scrolling through them sometimes and clicking random notifications as if someone was remotely controlling my phone! Even closing out applications before I'd be done with them like emails FB etc. I was also receiving phishing text messages that I would block and mark as spam. Such as settle your parking ticket at the link below and blah blah. Or saying I had a warrant and stuff.

So I paid for bitdefender and got a free version of Malwarebytes. This didn't detect anything and didn't stop the odd behavior. After a few more weeks the behavior became more noticable. When I would run manual scans the apps would close out and stop scanning sometimes. I determined this odd activity was mostly prominent between 10pm-12pm CST/CDT (about a 14 hour period).

After more research and consideration I decided to do a hard reset on my phone. I noticed when I was promoted to accept resetting my phone that there was 2 Facebook applications and 2 reddit applications that it said the accounts would be completely removed. One Facebook application was just the icon with a bunch of numbers. The other said "Facebook".

Anyway after the reset I thought I was good. But less then 24 hours later this activity began again. Randomly I got notified "live view is on"?? Then Amazon opened up and my notifications for messages among other things were being gone through again with apps opening and closing as if someone was reading my messages plus notifications before closing out apps and opening new apps. And messing with my defensive software settings.

So I don't know what to do? Am I hacked? Why wouldn't the reset fix this problem? Why doesn't the malware defense software pick up on any malware?! How do I make it stop?

Thanks.

in cybersecurity_helpby MisterOberg

100%

16d

View all comments

handsawillinformedan

15d

The factory reset should have you covered. There is a chance an attacker is involved, but only if the answer to either of the following questions is yes:

Did you at any point enable USB debugging?
Are you using a custom ROM?

I could see how ADB over WiFi (only possible if USB debugging was enabled at some point) could have allowed someone with network access to mess with your phone. The "Live View is on" thing is from Google maps being opened.

Does it appear haphazard? Or is it truly "as if someone was reading [your] messages"? Think about how you interact with your device, likely scrolling through it and accessing successive conversations in an ordered way. But if it seems random and haphazard, it's also possible this is due to damage to your touch screen. Is your screen cracked? Have you dropped your phone, or has it suffered water exposure?

MisterOberg

15d

I appreciate you a ton these are all great points!! And to my knowledge the phone was never debugged or anything like that. All I know is that apps on my phone would open and emails, text messages, Facebook notifications would all be "clicked" on, I would watch it and think wtf is happening!.

One example that really got me was when my Amazon app opened. I thought okay just another weird glitch. But then the app went to my account information. And from there it went out of there and into recent orders and opened invoice details on my last order. At that point I shut my phone off. To me that is not a glitch that's just looking for personal information.

My screen is not cracked on that phone. Though it has been dropped quite a few times but no visible damage. I've never noticed any glitches until maybe late May it started. I started getting these bizarre text messages about warrants and parking fines and click this link to avoid late fees etc. I never clicked any link because I'm well aware of phishing schemes.

I don't know what a custom ROM is. And again I don't recall ever administration debugging my phone. I may have years ago for USB tethering though I think that was done on a previous phone in 2020-2021. But it may have been the phone that is having issues.

If I missed any questions let me know.

handsawillinformedan

14d

If you do not know what a custom ROM is, then I think it is unlikely you have installed one onto this device. You would definitely know if USB debugging was enabled, as this involves enabling "developer options" by clicking build number 5 times in the settings. If there is no damage to the screen, and the problem persists after performing a full factory reset, then one must be sure that the device has not been physically compromised.

Have you ever lost your phone, or have you ever given it to somebody (i.e., your friends or parents)? What's most important here is that they were able to get into the device by either knowing your password or by you typing it in for them.
- If yes, how long did they have access to the device? If it was only for a few seconds (say, less than minute) then its unlikely (but still possible) they put anything malicious on your phone. If they had the phone for a long time (anything longer than a minute or two), then they could have installed a parental controls app without your knowing.. If they had it for an hour or longer, then a malicious custom ROM could have been installed.
Tied into the previous bullet point, are there any apps on your phone that you don't recognize and that do not seem like system apps? You can see a list of all installed .apks by going to Settings > Apps > See all [some number] apps. If you did in fact perform a factory reset (Settings > System > Reset Options > Erase all data (factory reset)), then any apps that would provide remote access to your phone would have been wiped. I find this scenario unlikely, since you said the behavior persisted after the factory reset. Unless somebody got physical access to your device after you reset and they installed such an app, there is no way for someone to have remote access to your device that I am aware of (again, assuming you properly performed a factory reset wiping all data).

If you have reviewed every app on your device and made sure none of them are a remote access app (or possibly a parental control app), then there is still one scenario to rule out. This is entirely hypothetical: if someone got remote access to your device and installed their own custom ROM with their own custom default apps, or altered the source code in such a way to allow them remote access, then the factory reset would not stop them from accessing your phone after the wipe. The factory reset simply restores the phone to the default state determined by whatever ROM is installed. If the ROM is malicious, then a factory reset cannot help.

If your device has been physically compromised, then a malicious threat actor could have conceivably (by guessing your password or gaining access to it by social engineering) installed a custom ROM without you knowing.

You can pretty easily rule out whether or not you have a malicious custom ROM installed. In order for this to happen, your device's bootloader must be unlocked (info). You can find out if your bootloader has been unlocked by the following methods:

Method 1: Turn off your device and turn it back on. Is there a (usually scary/alarming) screen saying "your bootloader has been unlocked"?
Method 2: Some phones may not tell you so obviously. Here is another method. Turn off your phone. Turn it on by pressing and holding the power button and volume down key simultaneously. You should be presented with a scary looking screen. You might have to fiddle around with those key combinations to get this screen to open. Does it say "Device state: Unlocked" or "Lock state: Unlocked"? If so, then your bootloader has been unlocked. Your can turn off your phone by holding the power button and power it on normally. On my device I can start it right from this screen by just pressing the power button once.
Method 3 (does not work on all devices): Go to your phone app and go to the place where you dial numbers. Type in exactly: *#*#7378423#*#* and you may (or may not, in which case refer to the other methods) have a window automatically open. In this window, go to Service Info > Configuration. If you see "Bootloader unlock allowed - Yes" then your bootloader is locked we have eliminated a malicious ROM. If you see "Bootloader Unlocked - Yes" then your bootloader is unlocked, and given what you have said here, it is then likely someone has gained remote access to your device.

If your bootloader is locked, then I'm afraid I do not know of any way someone could retain access to your phone after a full reset. This is assuming you have ruled out someone getting on your phone after you reset it and installing some parental control app, as mentioned above.

MisterOberg

14d

I appreciate this information a lot. Nobody has had access from the time of the factory reset. I did the method 2 though it was a different combination of buttons and here's what popped up.

"AP fastboot flash mode (secured)" Then a bunch of info about serial numbers CPU dram etc "Console [NULL] : null" "Tools mode config: DISABLED" "Power OK" "oem_locked" "Connect USB Data Cable"

I never noticed any unusual apps and again all the phishing texts with images and links I never opened. I know how to check device apps so I did that before the reset. Nothing suspicious.

Over the last 2-3 years I have had my phone in compromising situations either through public WiFi connections or around potential malicious actors. But nobody or no WiFi connections that were suspect in quite a few months.

handsawillinformedan

14d

This would not have anything to do with phishing texts or spam, especially if you did not succumb to these. From what you describe, it seems your bootloader is locked, so there is most likely not a malicious ROM installed. We have eliminated:

~~The bootloader unlocked suggesting a malicious ROM installed.~~
~~The phone fell into the possession of a malicious party for a period of time leading to a remote access app being installed.~~
~~ADB over WiFi allowed remote access for a period of time after an initial period of physical access~~

In my opinion, that this is due to a threat actor is seemingly far less likely than it having other, more banal, reasons. Remember Occam's razor. Can you tell me what kind of phone you have (Motorola, Pixel, Samsung, something else)? I would guess it is an older model device, since Android 11 is itself pretty old. I'd put my bets on this being some software glitch causing screen lag, or some damage to the screen via liquid ingress. I've experienced my phone screen seeming to do things on its own on some of my older devices, but usually it was something I was trying to make it do only moments before.

As for damage, do you have a habit of taking your phone into the bathroom while you shower (not necessarily into the shower, but simply setting it on the bathroom counter)? The high humidity can actually permeate into your phone. While it is impossible to confirm that this is the cause of your issue, it is not possible to rule it out. Did you drop it into sand (e.g. at the beach or outside in some dirt)? Ingress of solids can also cause issues, not just liquids. Perhaps check the IP rating (ingress protection rating) for your device. If it's low, then it's possibly related. Have you left it in hot enviroments like the car, or just simply on your window sill where the sun shines? This can also conceivably damage the screen.

While I cannot fully rule out a threat actor gaining remote access to your device through other means, I can tell you that it is unlikely. This is because it is almost certainly not the result of some malicious app or software on your device, as we have ruled out a custom ROM being installed, and the issue persists even after a factory reset. At this point, it would need to rely on system-level exploits (as in, some sort of backdoor at the level of the actual code running on your device). These more sophisticated ways of gaining access to individuals' devices are usually targeted toward high-profile figures (think of people working at big tech companies in any position, CEOs, senators, congressmen, or journalists). If these do not apply to you, or someone in your vicinity, then I would say it is extremely unlikely to be related to hacking. I'd suggest seeking guidance on r/techsupport if this continues. It simply might be time to get a new phone...or perhaps you could try flashing a new ROM onto your phone (e.g. GrapheneOS) if you're up for a challenge and you don't want to buy a new phone. Keep in mind this task can be difficult and risky, so only do that if you're desperate. Can't promise it'll solve the problem, especially if it's a hardware issue.

MisterOberg

14d

Your advice and insight is priceless! Yes I do take my phone everywhere. Including the bathroom to shower etc. I had originally purchased the phone off the street years ago so I was already worried about it being stolen or having malicious stuff installed already.

To be precise. It's an android 11 as mentioned but the phone is a Motorola G9 Plus. I would hope this is just glitchy stuff with the software. And I'm glad that with your help we were able to rule out a lot of vital things.