There’s no way to bypass it, if there is, that would be a serious security flaw
Those do happen, but it is probably also possible to unlock the boot loader and then replace the boot loader itself with one that merely pretends to be locked. How would you know the difference?
the kind that would get patched very quickly.
Obviously criminals aren’t going to install security patches for vulnerabilities that they are exploiting.
but it is probably also possible to unlock the boot loader and then replace the boot loader itself with one that merely pretends to be locked. How would you know the difference?
Sure, in theory, but doing that would require advanced knowledge, it’s not something a random shady seller on eBay would do. With skills like that, they could easily get a high paying job, or if they really want to be a criminal, a better option would be getting into something like phishing or cryptolocking, which, skills wise, is easier than writing a custom bootloader.
Obviously criminals aren’t going to install security patches for vulnerabilities that they are exploiting.
Which is why the first thing you should do is do a factory reset, update the phone, and do another factory reset. Or an even better option would be to just flash the factory firmware downloaded directly from the vendor.
Sure, in theory, but doing that would require advanced knowledge, it’s not something a random shady seller on eBay would do.
No. Writing the code to do that would require advanced knowledge, but once it’s written, any common criminal can use it.
With skills like that, they could easily get a high paying job, or if they really want to be a criminal, a better option would be getting into something like phishing or cryptolocking, which, skills wise, is easier than writing a custom bootloader.
They could use the compromised phone they sell you to phish or ransom you.
Which is why the first thing you should do is do a factory reset, update the phone, and do another factory reset. Or an even better option would be to just flash the factory firmware downloaded directly from the vendor.
All of those only work if the software already on the phone allows them to work. Factory resets, updates, and USB flashing are all implemented by software.
but once it’s written, any common criminal can use it.
It’s not that simple on ARM world, every device uses a different bootloader and has a different partition layout, different boot image resolutions and different type of warnings. So you’d have to a custom bootloader written for each model you sell, or just pick one model.
They could use the compromised phone they sell you to phish or ransom you.
It’s far more safer to just compromise a website or phish via emails/websites/fake apps, instead of selling malware on eBay and risk getting caught.
All of those only work if the software already on the phone allows them to work. Factory resets, updates, and USB flashing are all implemented by software.
Now you’re entering the realm of really hypothetical scenarios here. Sure, what you’re describing is theoretically possible, but faking the fastboot firmware is even more advanced than simply removing the bootloader unlocked logo. If something like this was happening widely, we’d have hewed about it by now. After all, Android phones have been around for 15 years. Now there have been a couple of instances of dodgy brand manufacturers/sellers shipping malware, but even these were just simple userland malware, nothing at the firmware level.
If you are that paranoid, then I guess you don’t buy any piece of electronics from any vendor, and buy everything directly from the manufacturer always? I suppose you also walk directly to the factory, inspect the entire manufacturing and software development of the phone you intend to buy - because you don’t trust the supply chain right? Sure, you may trust the manufacturer, but do you trust the parcel package, the driver, the delivery person? Where do you draw the line exactly? Because in your hypothetical world, anyone can be a hacker right?
Those do happen, but it is probably also possible to unlock the boot loader and then replace the boot loader itself with one that merely pretends to be locked. How would you know the difference?
Obviously criminals aren’t going to install security patches for vulnerabilities that they are exploiting.
Sure, in theory, but doing that would require advanced knowledge, it’s not something a random shady seller on eBay would do. With skills like that, they could easily get a high paying job, or if they really want to be a criminal, a better option would be getting into something like phishing or cryptolocking, which, skills wise, is easier than writing a custom bootloader.
Which is why the first thing you should do is do a factory reset, update the phone, and do another factory reset. Or an even better option would be to just flash the factory firmware downloaded directly from the vendor.
No. Writing the code to do that would require advanced knowledge, but once it’s written, any common criminal can use it.
They could use the compromised phone they sell you to phish or ransom you.
All of those only work if the software already on the phone allows them to work. Factory resets, updates, and USB flashing are all implemented by software.
It’s not that simple on ARM world, every device uses a different bootloader and has a different partition layout, different boot image resolutions and different type of warnings. So you’d have to a custom bootloader written for each model you sell, or just pick one model.
It’s far more safer to just compromise a website or phish via emails/websites/fake apps, instead of selling malware on eBay and risk getting caught.
Now you’re entering the realm of really hypothetical scenarios here. Sure, what you’re describing is theoretically possible, but faking the fastboot firmware is even more advanced than simply removing the bootloader unlocked logo. If something like this was happening widely, we’d have hewed about it by now. After all, Android phones have been around for 15 years. Now there have been a couple of instances of dodgy brand manufacturers/sellers shipping malware, but even these were just simple userland malware, nothing at the firmware level.
If you are that paranoid, then I guess you don’t buy any piece of electronics from any vendor, and buy everything directly from the manufacturer always? I suppose you also walk directly to the factory, inspect the entire manufacturing and software development of the phone you intend to buy - because you don’t trust the supply chain right? Sure, you may trust the manufacturer, but do you trust the parcel package, the driver, the delivery person? Where do you draw the line exactly? Because in your hypothetical world, anyone can be a hacker right?