Note10 Hacked

[Kevin Reyes]

I am absolutly sure that my phone is being monitored by a person I know and have not been able to find out how. I recently got a custom OS warning which was odd because I never installed a custom OS. As far as I can tell a normal one was in it from the start and I factory restored it twice since I got it used.

 

[Dannydet]

You more than likely are getting ad pop ups... Which can be quite disturbing in nature. Try installing an ad blocker from the play store, just do a search....

 

[Hadron]

Where exactly did you get this warning? It's a different matter if you see it when entering the bootloader vs it appearing as a pop-up, for example.

I wouldn't take that as evidence of hacking, not least because I can't think of any way that someone could modify the ROM or system firmware of a Note device without physical access to it (even then it's not easy if you have a US model - Samsung lock those down tight). I have however seen other reports of "custom OS" warnings appearing on what the owner believes to be an unmodified device, so I'm not sure that that is the only thing that can trigger such warnings or that the message is always accurate. But as I'm not a Samsung user I'm not the best person for this one.

 

[puppykickr]

You more than likely are getting ad pop ups... Which can be quite disturbing in nature. Try installing an ad blocker from the play store, just do a search....

I thought that ad-blockers were against Google TOS?

 

[Dannydet]

Ah, that's right! Yep, just do a Google search for ad blockers using a browser instead. I use adguard, and never see any pop ups or adverts at any time on my devices

 

[Kevin Reyes]

It definitely is not a popup. I have been unable to find out exactly how this is going on or who to find help in as it has been going on for a while. There is a lot more evidence from hacking based in my personal experiences with them knowing about all sorts of stuff they should not as well as well as other things like chat names changing while my phone was locked. As unlikely as it may be it is for sure happening

 

[ocnbrze]

It definitely is not a popup. I have been unable to find out exactly how this is going on or who to find help in as it has been going on for a while. There is a lot more evidence from hacking based in my personal experiences with them knowing about all sorts of stuff they should not as well as well as other things like chat names changing while my phone was locked. As unlikely as it may be it is for sure happening

can you post a screenshot of this "custom os warning"? if you boot into download mode , you might get this warning.

and like others have said hacking a phone usually requires gaining root access.. and sammy's, at least the US versions, have a locked bootloader and thus are really hard to root. (actually the US note 10+ can't be rooted at this moment). even if it was rootable someone would need access to the phone and a computer.

if you think you are hacked, then i would change all of your passwords and setup two step verification where applicable. i would then do a factory reset on the phone.

 

[Dannydet]

A used device?
There's your problem.

 

[Kevin Reyes]

It is not rooted and I have rested it twice. Once when I got it at first and then again after weird stuff happened. I am telling you I am sure that this is happening and have no idea where to go for help

 

[Hadron]

It would be helpful if you provided some of the information requested, such as where you do see this message. Descriptions of other "weird stuff" might also help.

But frankly my advice would be to reflash the device completely, i.e. find the stock firmware at Sammobile.com and follow the instructions to install that (it probably involves a computer and the Smart Switch app these days, I'm not up to speed with Samsung's tools). You'll need your full model number, not just "Note 10", but the phone's Settings can tell you that. This will completely overwrite your system software with a new set, so if anyone (e.g. a previous owner) has modified the system this will undo it. So once you've done that you know that there are no nasty things added to the phone's system.

A factory reset does not do this: all that does is erase user-installed apps and app data, and does not alter the system software in any way.

Note that this might not remove that message. If the phone has previously been modified the Knox "e-fuse" will have been tripped, and reflashing the phone does not reset that. So some record that the phone was once modified will remain, and not being a Samsung expert, and not knowing for sure what is producing this message (see my first request here), I don't know whether you will still get the message about custom software even though it will no longer be true. But if you reflash the device yourself you will know for sure that there are no mods present, which is why I'm suggesting that.

Also if you think someone might have access to your system you need to secure your accounts (change passwords, enable 2-factor authentication, etc). And don't do that using a device which you think might be compromised, for obvious reasons.

 

[Kevin Reyes]

It appeared for the first time the other morning as I turned on my device. I think it was after I installed some security apps and or a VPN. Never had it appear before and factory reset the device as soon as I got it and a couple times since then as well. So no rooting has ever been done and I never made any modifications to it. Something that has happened for a few months now is the lock screen will not go off. I believe I factory reset it when it first started happening which did not fix the problem. Fairly certain that no button is locked down. That started months ago and not sure if related to message about the custom OS. Also clicking when I started makin phone calls started some months ago too. Oscillating pretty loud clicking sound whenever I am making a phone call. Originating near the selfie camera on the screen. Which from what I read is a sign of some sort of tapping.

 

[ocnbrze]

It appeared for the first time the other morning as I turned on my device. I think it was after I installed some security apps and or a VPN. Never had it appear before and factory reset the device as soon as I got it and a couple times since then as well. So no rooting has ever been done and I never made any modifications to it. Something that has happened for a few months now is the lock screen will not go off. I believe I factory reset it when it first started happening which did not fix the problem. Fairly certain that no button is locked down. That started months ago and not sure if related to message about the custom OS. Also clicking when I started makin phone calls started some months ago too. Oscillating pretty loud clicking sound whenever I am making a phone call. Originating near the selfie camera on the screen. Which from what I read is a sign of some sort of tapping.

do a hard reset or flash a firmware update from sammobile, setup two step verification as i mentioned earlier. hacking a phone is not as easy as it may seem. especially a samsung with a snapdragon processor. these phones have a locked bootloader. and the only way to gain access to a phone remotely or otherwise would be to root the phone. it means that someone would need access to a computer and your phone. there is no other way.

so unless you gave your phone to someone unsupervised for a period of time, i really doubt your phone is hacked.

what do you mean the lockscreen will not go off? like it will not sleep? clicking sounds could be anything, it could just be bad reception. it does not mean you are being wire tapped.

 

[Bodestone]

If you think it appeared after you installed some security apps and a VPN then it is quite possible that one of them was a fake and is presenting false alerts to trick you into visiting a site or downloading a real threat.

Uinstall all of those apps and see if it goes away. If so, research each one again before re-installing and do it one at a time.

Flashing firmware is an absololute last resort.

 

[Kevin Reyes]

do a hard reset or flash a firmware update from sammobile, setup two step verification as i mentioned earlier. hacking a phone is not as easy as it may seem. especially a samsung with a snapdragon processor. these phones have a locked bootloader. and the only way to gain access to a phone remotely or otherwise would be to root the phone. it means that someone would need access to a computer and your phone. there is no other way.

so unless you gave your phone to someone unsupervised for a period of time, i really doubt your phone is hacked.

what do you mean the lockscreen will not go off? like it will not sleep? clicking sounds could be anything, it could just be bad reception. it does not mean you are being wire tapped.

Yeah no idea how exactly it was infected or whatever. It would have to be some sort of zero day. Thing is I am sure that this is going on just cannot explain it as unlikely as I know as that sounds. There has a been a lot of those discovered lately

 

[Bodestone]

Yeah no idea how exactly it was infected or whatever. It would have to be some sort of zero day. Thing is I am sure that this is going on just cannot explain it as unlikely as I know as that sounds. There has a been a lot of those discovered lately

You actually said earlier that you had installed several security apps and a VPN before it happened.
Uninstall them all, wipe the cache partition and see if it stops.
One of them is possibly sending false popups that you have been hacked to trick you.

No need at all for flashing new firmware at this stage. Step back from the dynamite folks, we don't know where the rat is yet.
Also, If you go into Sttings/About/Software Information:
What are the One UI and Android versions listed?

Bode.