S20 Compromised Hidden Bootloader, Cloned apps.

[PenetratedS20]

So to start,

I'm not the typical "my girlfriends watching me" security hackz0r post.
I'm no expert or even close but I do have a general idea of what and how an Android should run.

I detected the device was playing up, slowing down, screen looking blurry. Odd icons in notification tray. But before I go into the things that I don't have data for.

What I do have data for and would appreciate input on is the following.

S20 Ultra Exy
Less than two weeks old
Cloned apps
Adjust system settings
Apps being given permissions and even admin rights.

I have tried to make sense of logs but it appears that the attacker is using a mixture of Dex, Java, Bluetooth and Odin in some remote access capability.

I have tried factory resets and the cloned apps which have been given there own emulated storage that I can't touch on the device.

An unlocked Odin Bootloader! (see pic) that's when I knew I needed more advice. From what I know once the Bootloader has tripped Knox and secure folder won't work.. SECURE folder appears to work..

Ive had apps go into desktop mode randomly..

Look I don't want to sound like that crazy tin foil hat guy, but It is becoming a trend in my trade. I've just listed some of the easily proved things.

I've uploaded logs and screens to the cloud and able to share with anyone who knows this stuff well.

Basically I've got an $1400 phone security marvel that appears to have been Bootloaded and maybe rooted remotely.

I have my suspicions at the office and I would like to try and trace the attackers location.

To be clear this device is no way associated with the infected.

That Bootloader was accessed just by going into the preload process I was planning on trying to wipe the cache and then saw it the Bootloading option and realised this is pretty serious...

 

[mustang7757]

Hi, you orginal owner of this device?

 

[PenetratedS20]

Yes. Bought brand new picked up in store.

Chance of physical intrusion,or more likely judging by what I can loosely understand remote access using Dex and Bluetooth modules somehow. I am no expert but I know this is a hard core invasion. I have literally watched apps be given admin rights and be unable to uninstall them.

For instance a Sophos security plugin, got turned into a system file and I cannot deactivate admin rights.

The menus in the phone are different and look older it's as if they have built a virtual OS that tricks me into thinking its on OS10. I have never experienced things happening without my doing, apps would randomly expand into Desktop.

Developer Options would reset on restart.

Feel free to PM me mu$tang .

 

[mustang7757]

Yes. Bought brand new picked up in store.

Chance of physical intrusion,or more likely judging by what I can loosely understand remote access using Dex and Bluetooth modules somehow. I am no expert but I know this is a hard core invasion. I have literally watched apps be given admin rights and be unable to uninstall them.

For instance a Sophos security plugin, got turned into a system file and I cannot deactivate admin rights.

The menus in the phone are different and look older it's as if they have built a virtual OS that tricks me into thinking its on OS10. I have never experienced things happening without my doing, apps would randomly expand into Desktop.

Developer Options would reset on restart.

Feel free to PM me mu$tang .

Hi,

I would flash the stock firmware again through Odin and change any account password.

 

[PenetratedS20]

I've accepted the fact I've been digitally attacked.

If this was done remotely that won't change a thing if the attack has access to my Network. Rather than run from the Attack I plan to locate and remove the risk.

I will go Corporate Solutions if I can't find a suitable technician. Compensation will be attractive.

 

[mustang7757]

I've accepted the fact I've been digitally attacked.

If this was done remotely that won't change a thing if the attack has access to my Network. Rather than run from the Attack I plan to locate and remove the risk.

I will go Corporate Solutions if I can't find a suitable technician. Compensation will be attractive.

Like I mentioned
Starting point , talk to your network provider and explain your situation.

Flash the stock firmware again
Change all accounts password

This the best I can help you