Note 3 Totally Compromised - how to insure "contacts" are not copied to new phone

[wm4]

Please bear with me while I grope around in the dark over an important matter.

My note 3 has been completely compromised by a "spear-phishing" link in an email. The email exactly mirrored mail from a company I do business with, and the link took me to a mirrored website, which appeared to be genuine, except that none of the tabs or buttons actually worked.

Evidence of corruption was not long in coming in the form of fraudulent text messages with bogus links. The onboard security caught and deleted those after sending me a pop-up advisory.

I am reliably advised (by a mobile device forensics guy) that this level of malware is extremely difficult to detect or remove, and that the only certain fix is a byte-by-byte overwrite scrub; that apk files could be infected, and that a factory reset is not guaranteed to completely obliterate it in the phone software, data, and apps.

So I'm going to get a new phone, and set this one afire.

Of course, activation of a new phone results in "contacts" being involuntarily downloaded and installed automatically, or has been so far. Because there is a good chance that the contacts data has been infected, I do not want this to happen in order to avoid infecting any new device with backed-up corrupted contacts files.

I don't use Verizon or Google or any other Cloud services (I think Google keeps contacts on its servers in a cloud-like function, and "contacts" are updated and maintained there). I have posed the question to Verizon, Samsung, and my ISP techs (because they appreciated hearing that their servers were delivering fraudulent email). Didn't talk to Google; Google is closed just now - Google doesn't have enough dough to enable live tech support?

The best advice staff Level 2 Tech and supervisors at Verizon could offer was to manually delete contacts on the present phone one-by-one. That would result in an empty contact list getting backed-up; "clean" contacts would then have to be manually entered onto a new device.

So...is this the only answer to the question of how not to permit transfer of corrupted files? If so, how frequently do backups happen, and therefore when would it be safe to activate a new device?

Thank you for your forbearance in a somewhat wacky matter. It's been a bad week, what with credit cards getting skimmed, cancelled, & reissued (in a separate incident), and the advice that I notify banks and all entities on my phone of a possible breach, that they will monitor all my accounts for suspicious activity.

Hoping that I can, with your help, bring this to an end soon.

 

[Rukbat]

So I'm going to get a new phone, and set this one afire.

First, try reflashing the ROM. That should get rid of everything, since Android isn't running when you do it, so any malware that contaminated your phone can't hide - it won't be running.

Of course, activation of a new phone results in "contacts" being involuntarily downloaded and installed automatically, or has been so far. Because there is a good chance that the contacts data has been infected, I do not want this to happen in order to avoid infecting any new device with backed-up corrupted contacts files.

Skip the initial setup of the phone - don't put in your Google account. (I went through this Friday [yesterday, now] for a different reason, so I know it works.) Set the phone up the way you like, export the contacts at Google Contacts to a file on your computer (More/Export - use the default Google csv file.) A csv file is a text file. You can open it in Notepad or any other text editor and see if there's anything in there other than your contacts information. (It's easier, if there's extraneous data, to open the file in Excel, to find exactly where it is.) Fix any errors, save the file and import it to Google Contacts.

Then put your Google account into the phone and it will sync up with the site.

Google doesn't have enough dough to enable live tech support?

Google can't support all the different manufacturer and model versions of Android out there. Straight Android problems like this one, yes. But probably more than 50% of any requests they'd get for help would depend on the phone, and they'd have to tell people to call the manufacturer or carrier. That would make them look bad for reasons they can't control. So no tech support is probably their best choice.

The best advice staff Level 2 Tech and supervisors at Verizon could offer was to manually delete contacts on the present phone one-by-one. That would result in an empty contact list getting backed-up; "clean" contacts would then have to be manually entered onto a new device.

Level 2 tech support at Verizon is somewhere around entry level tech support trainee at many companies. (I ran tech support operations, and I wouldn't have hired many of their "best" support people as trainees.)

So...is this the only answer to the question of how not to permit transfer of corrupted files? If so, how frequently do backups happen, and therefore when would it be safe to activate a new device?

Backups happen when you change things. But you should maintain your own backups of everything - media files, texts, app apk files, app data - anything you don't want to lose. At least one backup to a local computer and one to a cloud account. (See Backing up an Android Device - I have backups at a US cloud server and a New Zealand cloud server. If they go bad at the same time, files will be the least of my [and everyone else's] problem.)

(BTW, same phone, except the AT&T variant - and I'm not buying another one soon. The Note 3 does everything I need. (I just downgraded to KitKat yesterday - I'd finally had enough with Lollypop.)

 

[wm4]

Thank you, Rukbat, for taking the time to make that exhaustive and detailed reply. It is very much appreciated.

Your observations about tech support staff are well taken. I was fortunate enough to happen across a Verizon tech guy who was quite solid and willing to dig in.

The answer to this mystery of who was backing-up contacts and when has been answered: Verizon, and not to their cloud.

The culprit was a legacy utility - good old Backup Assistant +, which I had thought long disabled, and never really looked at or considered. Backups were being routinely done after midnight each day to a separate, non-cloud Verizon db which is not currently available or even writable by tech staff - my guy could see it with his permissions level, but had to write up a service ticket to have my files on it whacked at a higher level.

Why did no one else I talked with at Verizon over many hours know about this? Because, as Cloud was developed and tech staff began their training in it, it was neglected as the push to market cloud increased. The tech who finally tumbled to it was in training during it's roll-out; the old system was de-emphasized and over time, gradually forgotten by first-line staff: a loss of corporate memory.

But, fundamentally, I blame myself for getting complacent and becoming disinvolved with my smartphone maintenance and awareness; my penance was to re-build a 113-entry contacts list by hand - on a new phone. I freely admit to being indifferent to phone tech, but - like your Toyota, it ain't gonna run for long if you don't change the oil.

Given tales of the possible inefficacy of resets and flashes against the tenacious nature of new generation malware, I had no confidence in data or apk integrity. I had already seen some results of the infection, so the old Note 3 was given up for parts. Long eligible for a swap-out anyway; nice trade-in allowance was applied.

I'm gonna miss it, especially complicit as I was in its demise.:-!
Many, many thanks again - see yaz on the Note 4 forum

 

[recDNA]

First, try reflashing the ROM. That should get rid of everything, since Android isn't running when you do it, so any malware that contaminated your phone can't hide - it won't be running.

Skip the initial setup of the phone - don't put in your Google account. (I went through this Friday [yesterday, now] for a different reason, so I know it works.) Set the phone up the way you like, export the contacts at Google Contacts to a file on your computer (More/Export - use the default Google csv file.) A csv file is a text file. You can open it in Notepad or any other text editor and see if there's anything in there other than your contacts information. (It's easier, if there's extraneous data, to open the file in Excel, to find exactly where it is.) Fix any errors, save the file and import it to Google Contacts.

Then put your Google account into the phone and it will sync up with the site.

Google can't support all the different manufacturer and model versions of Android out there. Straight Android problems like this one, yes. But probably more than 50% of any requests they'd get for help would depend on the phone, and they'd have to tell people to call the manufacturer or carrier. That would make them look bad for reasons they can't control. So no tech support is probably their best choice.

Level 2 tech support at Verizon is somewhere around entry level tech support trainee at many companies. (I ran tech support operations, and I wouldn't have hired many of their "best" support people as trainees.)

Backups happen when you change things. But you should maintain your own backups of everything - media files, texts, app apk files, app data - anything you don't want to lose. At least one backup to a local computer and one to a cloud account. (See Backing up an Android Device - I have backups at a US cloud server and a New Zealand cloud server. If they go bad at the same time, files will be the least of my [and everyone else's] problem.)

(BTW, same phone, except the AT&T variant - and I'm not buying another one soon. The Note 3 does everything I need. (I just downgraded to KitKat yesterday - I'd finally had enough with Lollypop.)

This is great advice and should be stickied to every android forum. What sort of changes would I look for in contacts viewed in excel? I knew they stole your contacts and bombarded them with crap that appears to come from you but I did not know the contacts themselves were modified?