Security when buying a second hand PinePhone

[zetabeta]

Hi, everyone!

I want to buy this phone https://pine64.com/product/pinephone-bet...e-package/ from another person. They say it's like new and has only been tested.

Where could they hide malware in the phone?

Of course I'll reinstall the operating system and wipe the internal memory, but what types of firmware are there where someone could hide malware?

Is it possible to flash official firmware images from the Pine64 website or at least inspect the current firmware installed and compare a hash with other users? I'll inspect the phone for physical tampering, but if some firmware can be flashed with USB or other ways without desoldering or breaking some sort of seal, how would I know about it?

So basically: what types of firmware is there where malware could hide and how to detect whether the firmware(s) has been tampered with?


Thanks!

i have been playing with androids, finally found out that even fastboot is more or less controlled (by them). if i go on paranoid level, android could easily hide some nasty stuff. what i know about pinephone's booting process, it's almost impossible to put something unwanted there.

however, lte modem chip is an issue though, because it has its own firmware. lte modem could theoretically contain malware but modem resources are quite limited, and requires serious coder to put it there. you may or may not want to flash or reflash it. (mandatory disclaimer about possible BIO THERMO NUCLEAR IMPLOSION and bricking modem chip when flashing, it's flasher's fault).

if paranoid:
1: disable modem with dip switch
2: erase internal memory with random bytes e.g. dd if=/dev/urandom of=/dev/{targetdevice} bs=1M status=progress
3: install o.s. according to instructions.
4: enable modem with dip switch
5: reflash or flash modem chip
6: repeat 1-4, if more paranoid

stock firmware for modem chip:
https://github.com/Biktorgj/quectel_eg25_recovery

partially open source firmware for modem chip:
https://github.com/Biktorgj/pinephone_modem_sdk