[Security Discussion] Dark3n:
Trust is not a security app!

If an attacker has root, you can just alter the database of apps like Trust, which would be the easiest way.

There are probably also ways to alter the system so it does not broadcast certain events(which is how Trust monitors most things).

It is just not build to withstand such attacks.

Maybe? But there are much easier ways if it is not desired to target specific persons.

I'll brain storm a bit for you:

I would divide the attack vectors into those that work with root and those that don't.

Without root apps can still do plenty of malicious actions, including tracking your position or uploading all files on your sdcard (INTERNET;SDCARD;LOCATION permissions) etc.

If an attacker gains root permission he could install rootkits, modify existing apps, inject malicious code into dex files of installed apps etc.

Basicly do what the hell he wants.

While not using a rooted device would certainly make it more difficult to do malicious things, it's doesn't prevent it.

A normal app you install could still root your phone through vulnerabilities. It works the same way apps such as TowelRoot or ZergRush root your phone.

Downloading new apps that request root is also very dangerous ofc, once you pressed "grant", it's too late, anything could have been done. So be wary when trying out new root apps of devs you don't know/trust?

Abusing trust in existing apps is probably the biggest danger.

The most obvious danger here is downloading apps you usually trust but from unknown sources.

Sure there could be signature issues when updating over your current app, but what if you don't have it installed? I could also think about a few ways to inject malicious code without altering the signature (did not try, just a thought, might be impossible).

The issue is that you probably wouldn't even notice, as the compromised app retains it's original functionality.

Want a botnet?

Inject malicious code into a popular root up that is paid, crack it and upload it somewhere.

While this more dangerous (or worth for an attacker) with root apps, it's still viable for non root apps, just pick one that already aquires many permissions.

It's way too easy, people constantly underestimate the danger of this. It's not all about piracy it's bad, it's a barn door sized security hole.

A bit more difficult variant would be abusing known security holes in existing apps that can be root or nonroot apps, such as modifying files the other apps uses, such that it executes your malicious code for you, so some type of code injection. First thought would be looking for root apps that use scripts or binary files and then check the permissions on those files to see whether they are writeable.

Now those are all ways to target a broad mass of users.

If a single user is the target, it would be more difficult, but there are still plenty of options:

- MITM attacks at public hotspots,

- Pressuring developers of apps you use. What dev wouldn't implement a security hole into an app of his, if a guy in a black suit comes up and points a gun to his head? Well that escalated quickly... But with "secret courts" and all the **** that happens secretly sanctioned or is just done by some agencies because they are above the law, is it really such an impossible scenario? The ends justify the means? Do they?

- My favorite plan yet, making a popular app themselves that they know you will try ;)

It is usually never impossible, just a matter of resources and whether its unfeasible to spend so many resources on that goal.

edit: So the best course of action? Don't install anything you don't trust. Don't trust the manufactor either? Install a custom ROM, but as those often use binary blobs for certain parts of the software, it's not really a 100% solution... There could also be compromising hardware built in, but now I'm really climing up the tinfoil tree, but as recents new story suggest that the NSA is intercepting hardware packets from manufactors such as cisco to modify them, what's really impossible?

TL;DR Best course of action that is feasible to adhere to is probably to just not install stuff one doesn't know or trust.

edit2: More specific answers to your questions.

You might be able to monitor files changes on an a system level, but if your attacker gains highlevel priviledges, what keeps him from changing the monitoring system?

How does TiBu help prevent such injection? Flashing a new ROM would probably undo such changes, but what prevents "them" from just doing it again.

This is the thing, with enough resources, there is always a way.

Exactly disguising as something legit is the cheapest way, "trojan horse".

I don't know any surefire way to detect this. The issue is that with enough priviledges (which can be gained without authorization, zero day exploits are worth a lot money to "agencies" as well as criminal organisations, though I'm no longer sure where the difference is), you can just clean up your track of malicious behavior.