Bought a new phone, appears to be rooted

[sushantkr]

I just bought a new (not refurbished), unlocked Samsung Galaxy S5 from a vendor in Hong Kong through Ebay. The phone seems to be as described and the seal on the box was intact. I discovered within a few hours that the device is rooted. I have verified this in two ways -- (a) by running the Root Checker Basic app, and (b) by typing su in the terminal and getting the # prompt. I tried to find a superuser app in my list of all installed applications, but I couldn't find one (but then, I wouldn't know if the app had an innocuous-sounding name).

Is there a security risk involved in using the phone? Is there a way to find the superuser app, and un-root the phone? I don't mind having a rooted phone per se, but I would have preferred to root it myself rather than have it done beforehand.

 

[Aquila]

I just bought a new (not refurbished), unlocked Samsung Galaxy S5 from a vendor in Hong Kong through Ebay. The phone seems to be as described and the seal on the box was intact. I discovered within a few hours that the device is rooted. I have verified this in two ways -- (a) by running the Root Checker Basic app, and (b) by typing su in the terminal and getting the # prompt. I tried to find a superuser app in my list of all installed applications, but I couldn't find one (but then, I wouldn't know if the app had an innocuous-sounding name).

Is there a security risk involved in using the phone? Is there a way to find the superuser app, and un-root the phone? I don't mind having a rooted phone per se, but I would have preferred to root it myself rather than have it done beforehand.

Yes, there is a risk to this. You have no idea what they did to it prior to shipping it. I'd return it immediately.

 

[ironass]

Which of the 42 models of Samsung Galaxy S5 do you have, as per #1.2 of 42 Galaxy S5 models - Dummies Guide.

Also, you can download and install, free from the Play Store, Phone INFO ★Samsung★, to see if your Knox Warrenty flag has been tripped by the rooting as this would prevent you using it as a secure device or using Android Pay. An untripped flag = 0x0 and a tripped flag = 0x1.

 

[sushantkr]

It's an SM-G900F.

I ran Phone INFO *Samsung*, and the Knox Waranty Void flag is 0x1. Does this mean the warranty is void?

 

[ironass]

It's an SM-G900F.

I ran Phone INFO *Samsung*, and the Knox Waranty Void flag is 0x1. Does this mean the warranty is void?

Correct.

As Aquila suggested... Send it back!

 

[sushantkr]

Damn. Will unrooting and factory-resetting get rid of any potential issues?

 

[ironass]

No. Once tripped, the Knox security flag cannot be reset.

 

[sushantkr]

I just got the following reply from the vendor:

Dear customer,

No worries, our phone warranty cover by Hong Kong Samsung for 1 year, no reason will affect the warranty.

As described in our item specific, our S5 is USA model & software unlocked(Phone was Rooted, software unlocked an Android phone also meant rooted the phone). Our supplier must unlocked the USA region lock of our phone & installed English language packs into the phone. Dear customer, please check on Samsung forum or Google this, then you'll find out all USA model Samsung phones must rooted for software unlocked, it's very common to see.

By the way, you still can use Internet Banking/financial works online through Internet Explorer installed on your phone. It's more better, more safe and easy to go.

USA model Samsung phones are more cheaper than UK model Samsung phones because Samsung USA sell phones at the cheapest prices in USA, so Samsung must set a region lock for all USA phones and made them only use in USA region. Please be assured that hardware of USA model S5 are as same as UK model S5 but USA model must software unlocked(Rooted) in order to make the phones can be used in UK.

If you still have any questions, please feel free to contact us by reply to this message, we will try the best to assist you, thanks!

Looks like I'm stuck with this piece!
Will unrooting and factory-resetting at least get rid of any possible security issues like data leakage? Are there any risks involved in unrooting?

 

[Aquila]

Screw that response, return it. File a claim with eBay if there is ANY push back from the seller. New means new in unopened box, which means no software can be touched because the vendor, in this case the seller, should never have even powered it on.

 

[ironass]

That reply from the vendor is the biggest load of BS that I have come across in a long time!

It is totally inaccurate and I would go as far as calling it a downright lie. Get rid of the phone now. It has no warranty, cannot use Android Pay and cannot receive any firmware or security updates, ever!

 

[can3gxw]

LOL! How come nobody's made note of the line

By the way, you still can use Internet Banking/financial works online through Internet Explorer installed on your phone. It's more better, more safe and easy to go.

Internet Explorer. On Android. Forget the fact that "it's more better more safe"

DON'T ASK them to take it back. TELL THEM you want a full refund. Unlocking a phone does NOT require it to be rooted. File a grievance with eBay immediately. You have rights. Chances are you will get your money back pretty easily and they won't ask for the phone back. Then just use it for a local media player. Don't EVER log into it. You have NO CLUE what kind of spyware or malware they've installed.