i think my phone is hacked

[Android Central Question]

i'm worried about my phone's security as i noticed weird stuff going on

now i'll try to describe some of what happened :

last year , i did use my phone number for 2AF on my facebook , and did enable the login alerts notifications , i don't know exactly when this started but i basically started to get text messages about my fb from random numbers .

at first i really didn't really give it much attention i thought it was a spam + i didn't notice any unusual activity in my account .

months later i noticed it actually has a pattern : everytime i log to my facebook i get instantly a notification saying we noticed unusual login but with my ip adress and my device so i know that it's just me who just logged .

few minutes later i get a text message from a random number that say : unusual login to facebook with https ://fb .me link ( i checked some of the links on virus total and they turned out all clean i know that dosen't say much anyway) ,i opened one of them old links and it redirects me to facebook page like one where you enter your login informations wich i didn't do .

so the text messages i don't receive them from facebook but from random numbers and never from the same number and it's related to the timing of the login alert i receive on facebook .

btw for the auth codes i receive them from facebook and not from random numbers .

this thing happened even when i changed my device .

with that being said i didn't notice any other unusual calls or texts on my phone other than that , i did take the phone number from facebook and the text messages stopped and did perform a factory reset ,i want to know is that a kind of bug ? cause it dosen't seem like a normal phishing attack .

second thing that happened during the same period is , one day i came home slept because i was tired , when i woke up found a missing call from a friend so i called him back , he say that we talked i was puzzled and didn't believe him.

he sent me a recording of our call that did last like a 30 seconds and it wasn't talking, it was like a weird voice and he also sent me a screenshot from his phone that we did talk but in my phone there's only missing call .

if i assume that i did answer the phone whilst asleep wich is something i never did , but let's assume ,wouldn't it register that we talked on my phone and not as a missing call ?

till now i didn't notice other weird signs and it did happen only once .

i tried taking off my sim card and calling from another phone and it says that it's closed .so my calls aren't redirected to someone else .

i mean all people that call me can reach me with no problem . till now i didn't think of the possibility of something malicious like cloning .

few months pass by and i change my phone but i still keep the same sim card , and i notice that my ex know some informations about me like people i follow on instagram even though it was a new account he dosen't know about and it was a private one, with 2AF enabled by the same phone number as i mentioned i didn't change my sim card .and my account wasn't hacked either .again i didn't give it much importance

untill ,two months later , i logged out of my facebook at night but was doing other stuff on my phone ,i wake up the next morning found that there's a login to my facebook and massenger at 3 am ( i was still connecting on my phone that time ) and it left a seen on a message a friend left me .

i check the login details and it has my own device and my ip adress so it wasn't a hack or something .it's coming from my phone but i'm 100 percent i didn't log to my account .

last thing that happened few days ago is that i left my phone on my bed, went like for 5 minutes, i go back and found that an app icon changed it's place and left a blank space ,and that didn't happen before and my phone was closed .

now i started to have doubts that someone is remotly accessing my phone and playing with me even though it seems crazy but maybe my ex have a reason to do so .

before you say anything i want you guys to know that i did check my emails .all my accounts and there's no indication for another devices or password reset .

no one ever had physicall access to my phone and it has a password and fingerprint .

my phone is an android xiaomi redmi note 8 , and my previous one is samsung galaxy s6

i did check everything on my phone from apps to files and nothing seems suspicious.

i use my home wifi and i live with my family , my ex live in another town it's like 700 km away so i don't think he could've hacked my wifi .

i don't have a history with a mentall ilness ,and i don't take any pills . for those who would think i'm paranoid .

i need explanations for what's happening , is it posssible that someone could remotly access my phone ? i'm worried that all that time there was someone spying on my phone and actually have all my photos and data even though it seems crazy . is it phone cloning or a spyware or what exactly ?

because why would someone do that ? but i have a crazy ex makes me think he's capable of doing it

if so how could he possibly do it ? i don't feel safe and i know my country won't protect me against it , if anyone here experienced the stuff i did mention can give me a logical explanation , i know what i say seems very weird and it's for me but it's real

lastly i'm sorry for my english as it's not my language any help would be appreciated thank's .

 

[Kizzy Catwoman]

Hi there. I don't understand what is happening with your phone. My recommendation is to notify the authorities and see if they can trace what is happening to you. Only the police would have the resources to trace any usage on your phone. I would also speak to your carrier and perhaps ask for a new telephone number that your ex doesn't know.

 

[VidJunky]

You say at the end that your English isn't that good, while it sounded fine to me this leads me to ask where in the world you're from? I ask because some of the apps I might recommend may not be available in your area of the world.

Meanwhile, as far as the FB stuff goes. Facebook and Google seem to send messages from multiple sources. I'm not sure how the work gets divided but I've gotten messages from several different numbers related to both so that's not really unusual. If you've turned on 2 factor sign-in ID your account should be relatively safe. The app I would recommend for 2 factor ID is Authenticator from the Google Play Store. It will do FB, Google, Instagram and others. It's an app that runs on your phone and unless someone has your phone it makes accessing the account almost impossible.

I don't quite understand the call from your friend because if they played you a recording of the call it should have been obvious if it was you they talked to or not. Honestly that sounds like a misunderstanding. Like they called you and you didn't answer and the recording was from another time and conversation or something.

The app moving could have easily been from holding the phone with a finger or thumb on the screen and realized until looking later. In that story it almost sounds like you think someone came into your home and messed with your device while you were in the shower.

Remotely accessing a device is virtually impossible so I don't believe that anyone has access to your device. Cloning a device down to the ESN is at the very least expensive. Cloning a device down to the ESN and a SIM to be able to intercept calls and messages is not something anyone would invest in for some random individual. Are you wealthy, politically powerful, well connected??? Plus in the middle of all of this you're changing devices and factory resetting devices I can't imagine.

To reply to this thread please create an account. This link will help you do that... https://forums.androidcentral.com/ask-question/409154-join-android-central-community-new-post.html

 

[mouni99]

hello i'm the one who wrote the message , i'm north african and the police here can't do anything about it , they don't care at all
what can i do to make sure that my phone isn't hacked ,i'm not wealthy or anything , i'm a normal person it's just that my phone is acting weird like the time i found a login to my facebook from my own device when i was doing other stufff on my phone

about the call it was with the time and date so it wasn't just a misunderstanding , now i don't really believe in the theory of sim card cloning i know it's very hard and no one really had access to my sim card
but i did hear about RAT's remote access trojan smthng like that , they can remotly control your phone
i'm not expert so i don't know how hard it's for someone to remotly control my phone
can you please give me a way to make sure that i'm not hacked
if you're an expert is it likely that someone would put a spyware or rat through just a link i mean without having physical access

 

[mouni99]

in my country they can't do anything about it , otherwise i wouldn't be asking here
i just want to make sure , and i can't afford to buy a new phone
so i'm asking for the help of people who are expert

 

[VidJunky]

Since I've never heard of Remote Access Trojan/Tool I went and looked it up. Most of the places I found talking about it were places that wanted to secure you against it or talked about it conjunction with Employer IT. It first requires an entrance, typically in the form of a Phishing email or SMS which then requires an additional download.

You haven't really described any of the signs I've found to be typical of an infestation. Those ones I've found read like this;
Signs You Have an Android Phone Infected with RAT Malware
•Android Operating System Errors – Updates won’t install or an operation did not complete
•Android Apps Keep Crashing
•You are Seeing Pop Ups
•Android Phone Responds Slowly
•You Notice Data Usage Spikes on Android Phone

It also doesn't sound like they would be interested in your social media, unless to gain access to your contacts/friends list. I'm not saying that you are or are not having issues with such a program but I will say that to date I have not encountered one legitimate claim of someone on Android having a virus. I feel this is due to the design of Android which compartmentalizes processes and apps from one another. This is usually referred to as Sandboxing and should prevent crossover between processes.

I found this article that talks about RAT and other threats and gives some good avoidance tips and most impressive of all in my scan of the article I did not notice them attempting to sell anything. Anytime a device starts to act up or ads begin to appear my first instinct is to look for the sell, what do they want you to buy and how scared they can make you to get you to buy. Maybe in one of the links there's something like that but just in the article itself I didn't notice anything.

That article is located here... https://www.askcybersecurity.com/remove-rat-malware-android-phone/

As always, best wishes.

 

[mouni99]

thank's appreciate your response , the thing is my phone is changing on it's own like logins , changing the place of an app and it's weird it dosen't seem logical to me and idk what to do about it
i mean here in my country there's no place to check your phone , and i'm afraid that my phone is been compromised
i noticed that the battery drains a little bit but it's not fast drain
and idk if it's related to the issue or not
what could i possibly look for because it's really getting weird , and i really have no person to help me at this nor do i afford to buy a new phone
i already did a factory reset , how can i possibly get evidence as the police won't help

 

[VidJunky]

Getting authorities involved is a bit like taking medicine after your sick, they usually won't do anything until you've already proven your case. Here in the US some will take a report so that "if" something happens later they have a reported on date but...

The article I attached said it contained not only items to detect the presence of but also help in removing. There are several things you can do to better protect yourself however.

2 factor log-in and changing passwords is priority one. You mentioned FB, and I believe Instagram and Twitter both have 2 factor log-in. Google also has this. If you can get it there's an app called Authenticator at the Play Store. It works with those apps to prevent unauthorized log-ins. So you would go to each app set-up 2 factor then register them in your Authenticator app and it will be your key to get into them.

If you're concerned your phone may be spying on you use app permissions to take away access from all of your apps to use your camera, look at your call logs, read your SMS, use your microphone, view your calendar and access your storage. You will probably find this under Permission Manager. Now none of these changes are permanent and apps as they need these permissions will ask again, like you had installed the app for the first time, and then you can decide if that gallery app really needs to see your contacts and stuff like that. Don't allow questionable activity.

Factory reset is a great tool but when you do a factory reset because your device is acting funny the worst thing you can do is automatically restore apps. If you're having issues, especially on Android, 999 times out of 1000 it's a bad app. When you factory reset and automatically restore all apps you just reinstall the problem and wonder why didn't this work. Plus let's say you are being spied on through an app, you just reinstalled that app that was spying on you. If you do another Factory Reset remember this, never automatically restore apps if the factory reset is due to problems on a device.

Being proactive about safety isn't fast or easy but simple steps now can save you problems later.

 

[mouni99]

the thing is when i do perform a factory reset i never use a backup i don't even put the photos back again let alone apps , i install them manually , see that's what makes me think that's something infected system files i don't know really .

so basically if my device is compremised i can't really tell , this is what frustrate me .
anyway thank's for your help

 

[Mike Dee]

the thing is when i do perform a factory reset i never use a backup i don't even put the photos back again let alone apps , i install them manually , see that's what makes me think that's something infected system files i don't know really .

so basically if my device is compremised i can't really tell , this is what frustrate me .
anyway thank's for your help

The way a factory reset works thats not possible

 

[mouni99]

so what explanation for my phone changing settings , login on it's own to fb and massenger
moving a specific app

 

[VidJunky]

so what explanation for my phone changing settings , login on it's own to fb and massenger
moving a specific app

Honestly all of those things sound like accidental touch. Here's a few things for that...

If it is at all hot where you live and you carry your device in your pocket that is a breeding ground for accidental touch. It takes very little perspiration for your screen to recognize a touch through clothing, especially thin material like a pocket lining. What I've taken to doing is carrying my device face out in my pocket. Some feel this is dangerous due to the open exposure of the device face to anything you might bump into. You have to know your setting when you do this is the best warning I can give. If it is possible that you will bump into things or use your hip to close a door for example this may not the be solution for you.

Knowing the difference between screen timeout and screen lock times. If you set your screen to lock after 30 seconds or 1 minute you need to know that just because the screen is off doesn't mean it's locked and again anything can wake it up. This is the example I tend to use, if your screen timeout is 2 minutes and the screen lock is 2 minutes it takes 4 minutes for your phone to lock because it doesn't lock until the screen has been off for 2 minutes. This also means that if you put the screen to sleep that the phone isn't locked for another 2 minutes and if you stick it in a pocket or a bag and something taps the screen it will wake up unlocked and detect everything as a touch command. This can open apps, change settings, rearrange icons and call people to name a few. The best way to fight accidental touch is to set your screen lock to immediate when the screen goes to sleep. Screen timeout is usually listed in display options while screen lock is usually listed with security options. It's the one in security options that is most important in this case.

Some devices will have a setting for accidental touch. This setting usually senses when the device is in darkness, like in a pocket or a bag, and will ignore most touch inputs. This setting isn't a 100% failsafe but more of a 60-40 crutch that helps to avoid these things.

Obviously for best results do all three but you'll need to find the combination that works best for you.