Hey Friends,
My S7 edge had a problem with the charging port and I sent it in for an exchange device today.
Previsouly I had Nougat installed so the device was KNOX Void and Rooted.
I read that If you want to ensure that noone can restore the Data from the Device (Online Banking records, passwords, images) you have to encrypt the device and then do a factory reset.
Unfortunately encryption did not work on Nougat (it would show the encryption icon and then reboot)
So I basically flashed the Stock Firmware of the Provider (4 Parts) (6.01) with Odin and hoped that I can find the encryption option in the Security Settings Menu but it wasn't there. I could only encrypt the SD card.
My question: Was the device encrypted as soon as flashed the stock firmware or was encryption simply unavailable on the stock rom?
I did multiple factory resets and also Installed an app to "delete empty space" which should overwrite any data that might hide in the free space.
I am worried that whoever gets the device next might be able to restore my banking data, images and e-mails.
What's your take on this?
Best,
Thomas .N from Germany
Related
I've spent the whole night trying to figure this out so hopefully the information is useful for some of of you
The usual scenario is that the phone is encrypted due to using Exchange email (eg. Corporate email) and now you can't upgrade or root it. The first thing to do is to delete that email account and hopefully the phone will decrypt itself or the option appears when you go to phone security settings. You can also try to access the corporate email via a browser and delete the mobile connection.
This worked for me previously but it doesn't now - I don't know if its because I'm using a non-stock rom. Either way a lot of people seems to be stuck with a Samsung rom as well. So you now have a phone with the exchange account gone and its restriction so you should in theory be able to removing the decryption but no it doesn't work. I don't know why as this is a basic OS stuff.
At this stage you can try to full wipe it - but this doesn't work, both through settings or CWM. The only way to sort this out is to copy / backup all your information then flash it to factory state and this means using odin and a stock rom. I've done this several times and there is no lasting issues.
I''m by no mean an expert and would be happy for anyone to correct me
I remember back in my old WM ROM cooking days there were some apps that could be baked into the ROM with pre-configured settings such as the phone number that way if the phone was stolen and SIM changed, it would automatically send an SMS to a backup number and from there you could issue hidden SMS messages to track and wipe the phone. I see there are quite a few aps out for android that can be installed, BUT with modern tech savvy thief's the first thing the do is wipe and then put in their own SIM so any security apps you had are gone and useless. I like the simple functionality of the build-in ADM but would like to know if there was any way to pre-configure the app before a CWM flash so it would survive a device wipe "just not a re-flash unfortunately unless we could lock the recovery in the future so that only Odin would reset". Thoughts?
Is there any way to exit Ultra-Power-Saving-Mode while locked out of my S5 using recovery mode, installing some update, etc? I have a lot of development experience with several languages and tools, but not Android.
I've been using my fingerprint for access for over a year and now I have no idea what my alternative password is... since I've never used it regularly and can't find any record of it. I usually right document such things, but apparently not this time.
Unfortunately, this last Sunday while in Ultra-Power-Saving-Mode something went wrong with my phone and now it only asks for the alternative password... which I can't recall. I've used the Android Device Manager 4 times since then to reset the lock PUK/PIK. After each time resetting it, the lock screen does show the new greeting I set via the Android Device Manager, but it still asks for the alternative password... instead of asking for the PUK/PIK that I just reset.
I am suspecting/hoping that if I can somehow get my phone out of UPSM that the lock screen will allow me to use the reset PUK/PIK to get back into my phone.
So, I am asking if you know of any app that can be installed remotely that will allow me to get my phone out of UPSM? Or, if there is any way to get it out of UPSM by rooting the phone, but installing an ADM update, etc.
Normally I would just do a factory reset because everything is synced up to my Google account. However, apparently my SD card, which was my primary storage, filled up on May 2, so everything since then has been stored on internal memory and thus will be lost if I do a factory reset. I've taken a lot of pictures and video of my 2 1/2 yr old boy and I am trying to avoid losing everything since May 2.
Thanks for any help.
rjlyders said:
Is there any way to exit Ultra-Power-Saving-Mode while locked out of my S5 using recovery mode, installing some update, etc? I have a lot of development experience with several languages and tools, but not Android.
I've been using my fingerprint for access for over a year and now I have no idea what my alternative password is... since I've never used it regularly and can't find any record of it. I usually right document such things, but apparently not this time.
Unfortunately, this last Sunday while in Ultra-Power-Saving-Mode something went wrong with my phone and now it only asks for the alternative password... which I can't recall. I've used the Android Device Manager 4 times since then to reset the lock PUK/PIK. After each time resetting it, the lock screen does show the new greeting I set via the Android Device Manager, but it still asks for the alternative password... instead of asking for the PUK/PIK that I just reset.
I am suspecting/hoping that if I can somehow get my phone out of UPSM that the lock screen will allow me to use the reset PUK/PIK to get back into my phone.
So, I am asking if you know of any app that can be installed remotely that will allow me to get my phone out of UPSM? Or, if there is any way to get it out of UPSM by rooting the phone, but installing an ADM update, etc.
Normally I would just do a factory reset because everything is synced up to my Google account. However, apparently my SD card, which was my primary storage, filled up on May 2, so everything since then has been stored on internal memory and thus will be lost if I do a factory reset. I've taken a lot of pictures and video of my 2 1/2 yr old boy and I am trying to avoid losing everything since May 2.
Thanks for any help.
Click to expand...
Click to collapse
Only option I can think of would be to install TWRP custom recovery and use the built in file manager to rename the UPSM app. This wouldn't work if you have an ATT or VZW model, as the bootloaders are locked down, not allowing installation of TWRP, but pretty much any other carrier model should be fine.
I have a Moto Z with stock image, Magisk Root and Turbo Z Custom Kernel.
As far as I see everything is fine except two one things:
1. Sometimes downloads aren't starting at all. Which is very weird because regular surfing with Chrome works flawlessly. But if I want to watch a video from YouTube (regardless whether YouTube app or within Chrome) the video won't play sometimes. The same happens with F-Droid downloads. Sometimes an installation/updated doesn't even start the download. The network is fine (it works perfectly with any other device).
2. I have a screenlock set up but I don't think there is encryption active. I have to type the password just once (device boots to GUI then SIM pin, then unlock PIN). On encryption the unlock PIN have to be entered bevore booting into the GUI — right? However, Security Settings claims that the phone is encrypted. I wanted to set / change the password with cryptfs password manager but the app doesn't even start claiming 'cannot get superuser access' (maybe it's not compatible to Magisk?). Is it possible to change/set the password in this state without risking data loss?
The stock kernel enforces encryption, the z-kernel doesen't. However, your stock kernel already did its deeds. So if you really want to remove encryption, here is what you might want to do:
Remove all phone passwords (pin/password/pattern etc), then make a backup of everything. (If you don't & then restore such a backup, you'll always end up with password/pin/pattern mismatch).
Then boot into TWRP recovery and format(!) data partiton (erase just doesn't cut it..). If there's still a problem, change data's filesystem to ext4 and then back to f2fs - that should remove any nasty residual settings.
Then reboot & enjoy. Maybe you can restore the backed-up data files to the unencrypted partition now, but I wouldn't bet on it...
Hi again @benzinerwin
However, I don't want to remove encryption. I want to enable it.
It says that it is enabled in settings but I strongly doubt that it actually is.
Just change the password, opt for boot password (or whatever it's called), boot into TWRP and see if it asks for password/pattern to unlock access to the data partition...
If you cannot get there, just do the above, end up with an unencrypted data partition and the go through the settings and trigger the encryption with boot pass etc...
benzinerwin said:
Just change the password, opt for boot password (or whatever it's called[…]
Click to expand...
Click to collapse
That was it
In retrospective this is pretty obvious. Thank you.
Now just the problem with the struggling downloads is left.
Hmm, about the strange download problem... that pretty much sounds like an app not having all the requested rights (look through all the settings, not just the app's properties... [sigh])
But it affects all apps. Even Chrome. Regular surfing is fine but for example loading a YouTube file sometimes doesn't even start.
NOTE:
This is a very basic guide only for newbies like me.
I'm not a developer or something even near to that. All information provided here is copied from different sources and according to the best of my knowledge. I'll not be responsible for any harm to you or your device. Try it on your own risk.
Any additions or corrections are welcomed.
Note: Unlocking Bootloader and Rooting breaks "Verified Boot". It can be dangerous.
Unlocking bootloader:
Disables signature checking of boot image and recovery image
Allows all fastboot commands to be executed
Zeros out /data partition i.e. filesystem is erased and then regenerated on next boot
To know further: BOOT PROCESS: ANDROID vs. LINUX
As compared to iOS, Android is considered less secure OS because it's an open source project and a large number of developers are involved contrary to iOS where things are kept secret. We can face two types of threats regarding mobile security:
Data theft or loss when using mobile phone.
Different types of malware (spyware, adware, bloatware, ransomware, worms, trojans, virus, cookies) or a hacker can directly attack your device to gain access to your personal data like contacts, pictures, credit card information or even can note your habits and then forcefully show you ads etc. Sometimes the purpose is just to harm you, rather than having some benefit. To avoid this:
Keep your phone as simple as possible. Avoid installing apps from unknown sources particularly KeyGens and cracked / pirated / hacked apps and MODs offered free of cost. Use an app store like PlayStore to install apps which provide security somewhat.
Some stock ROMs (manufacturer's operating systems) contain bloatware (unnecessary and suspicious apps) running as an app or in background. Try removing as much of these as possible by uninstalling or freezing or at least restrict their permissions and internet access.
In Android 6 and above, apps ask for permissions from user when run first time. Allow for these permissions carefully. Check your list of apps auto-starting up and running in background as well as accessing storage and phone / sms etc.
Permission regarded as "Normal" by Android cannot be revoked by simple means e.g. you can restrict an app's INTERNET permission. Either use a third party trustworthy permission manager or at least review the list of permissions requested by an app at install time.
Use some firewall app like AFWall+ to block hidden internet access of apps to internet.
If your phone is rooted, try to avoid granting root access to as less apps as possible particularly those from uncertain sources.
Use some anti-malware or commonly known antivirus app in mobile phone which can scan and filter apps, attachments, links, emails, sms and webpages etc. There are numerous paid and free apps available for the purpose, though most of them are themselves promoting some kind of malware for business purpose. av-test.org is a good place to start with selection.
Data theft or loss when phone is lost or stolen
In this thread I'm focussing this part and giving here a few technical tips and measures you should always take that can help you keep your data, device and yourself safe in case if your device is LOST or in case of THEFT. Otherwise your device and your data can be accessed and misused.
The very first vulnerability of our data to theft and misuse starts with the Unlocking of BootLoader which is locked by default for security on most of the new devices. Unlocking BL makes it easy to flash custom recoveries, kernels and ROMs. That's why, the internal storage can be accessed from any custom recovery or device is factory reset or new OS can be installed for a fresh use. Therefore vendors are making it harder and harder to unlock BL without proper authorization. Personal data is also prone to wrong hands due to insufficient security measures on device as explained below:
DATA PRIVACY
Always keep Screen Lock enabled (with PIN or Password or Pattern).
But keep in mind, this option alone is of no use. It takes only a minute or two to remove screen lock protection if a custom recovery is installed or BL is unlocked / unlockable.
Always use Internal Memory of Phone to store personal data like pictures, contacts etc.
External memory (SD cards) can be removed from device and easily accessed from computer or other devices. They aren't erased usually in case an app tries to erase data in case of theft. Also, Android doesn't offer encryption of SD cards by default. A few custom ROMs offer this feature or you have to use a third part app for encryption. Built-in kernel module dm-crypt is used by AOSP for full disk encryption (FDE). A similar service is needed which auto-mounts your memory card at OS boot. Good examples of encryption at filesystem level are EncFS and CryFS which offer a stackable transparent encryption with virtual filesystem. An easy way to implement EncFS on Android 5- is explained here.
However, in Android 6.0 and above, external memory swapping with internal memory is offered called adoptable storage. That's relatively more secure because it makes SD card not readable by other devices (at least not easily).
Old Devices with Low Internal Memory - in this case instead of putting personal data on SD card, try using SD card's 2nd partition to link apps & their data to SD card by Link2SD and keep your personal data on internal memory.
However, Link2SD may slow down your device or can be a battery hog. In this case, use Third Party Encryption apps to encrypt your targeted data instead of encrypting whole /data partition. There are numerous apps like KeepSafe which is more useful if you combine encryption with cloud backup or online synchronization. However, be careful while selecting app. The app can fail to protect your data online or it can itself misuse your data. Otherwise, any app like ES Explorer or Solid Explorer can be used to keep data encrypted.
In case of third party encryption software, you must be extra conscious of your data. Sometimes sensitive data is hidden (apps data or due to .nomedia) like WhatsApp Sent folders. You have to take care of all this manually. It's really a hectic job.
Encrypt Internal Memory (particularly if BL is unlocked).
It's because and attempt to unlock BL erases all personal data on internal memory (not external SD card). However, it may not always be true. So keeping Internal Memory Encrypted always promises more security. An un-encrypted internal memory can be easily accessed from custom recovery.
Performing these steps makes your data quite secure and not vulnerable to easy access.
DATA PROTECTION
Data Recoverable - use local / online backup of your data. Read here how to do that.
Wiping Data
Bootloader Locked - so that there is no chance of flashing custom recovery and then accessing data from there or through ADB. As stated above, unlocking BL will erase data but it's not always true. So, this option alone cannot be relied on.
There are chances of wiping data if you use some anti-theft app. Android Device Manager (ADM) is a built-in app on all Android devices that suffices the basic needs of an anti-theft app. A Google account on device is mandatory and ADM must be enabled from settings i.e. Device Administrator. You can use Google Find My Device anytime to Locate (Location services should be enabled on device), Play Sound, Lock or Erase your device. Obviously, device should be connected to internet for ADM to work.
However, you may use any third party app with rich features (also SMS based).
Rendering Data Useless - as stated above, using Encrypted Internal Memory only for personal data makes it secure and hard to read by others, even useless.
DEVICE SECURITY
Device Recoverable
As stated above, there are chances of device recovery if you use some anti-theft app.
Keep your phone's IMEI number safe. Your Mobile Network Operator along with the help of police can trace your device whenever it's switched on unless its IMEI is tempered.
Rendering Device Useless
Bootloader Locked - so that there is no chance of flashing custom recovery and then flashing new ROM.
OEM Unlocking disabled - so that Bootloader can't be unlocked without proper authorization.
It can be disabled from ROM settings menu on Android 5.0 and higher devices (if found).
Factory Reset Protection (FRP) - so that after resetting device from recovery, device can't be logged in without already linked Google account. This is implemented by a separate partition named FRP or CONFIG or PDB (on Intel devices) or something else which saves information of last logged in Google (or OEM) accounts. This partition is not reset on factory data reset by stock recovery. So, if bootloader is locked and set unlockable in Developer Options, one can't flash custom recovery to erase FRP partition. He will be stuck at login screen permanently.
So a working Google account on device is mandatory. It works on some Android devices with Lollipop 5.1 and higher. However all vendors don't implement this security feature in their devices. Some use their own similar feature e.g. XIAOMI links your device to MI account.
Additionally some OEM's don't allow unlocking of bootloader without permission from OEM to ensure more security i.e. contents of partition[/URL] "devinfo" are signed by the OEM and can't be modified without their approval. After having permission, an official method is provided to unlock BL using PC.