[ZTE Axon 7 Guides, News, & Discussion] QuantumFluxx:
What ZTE has done with the Axon 7 is nothing short of incredible. An SD820 processor, 4 GB of RAM, Front-Facing Stereo Speakers, a 5.5" QHD AMOLED panel, MicroSD/Dual-SIM support, and a fingerprint sensor. You will not find this combination on any other phone with an unlockable bootloader or CDMA support. After getting to know the device’s security, I was less than enthused. Some things, which I would consider basic features, are missing. Other [system level] security features have been altered to the point where they are useless - or at the very least handicapped. I sought to fix those problems. In sharing what I have found, I seek to help you secure your device.

A few things, going forward…

This article is written with B29 in mind. The Nougat update has just been released and I hope that it has addressed many of my concerns. With that having been said, whip out the tin foil and fashion yourself a hat.

As I write this, the fact that I am about to list security problems with this device gives me pause. I was able to find reference or information about most, but I have found problems that I have not read about anywhere else. In effect, an unscrupulous individual could use information in this guide to compromise an unsecured device. Also, while proofreading this, I was compelled to add that I am not your lawyer. I am not here to help you cover illegal activity or shield you from legal action. At the end of the day, I cannot be responsible for the actions of another. I provide this information, in good faith, to help – not to hurt.

A word on mobile security in 2017 - especially in our current political climate.

There is no going back. We use our devices for everything from paying our bills to submitting job applications. Information that your grandparents would have kept locked in a safety deposit box is now routinely transmitted at the speed of light from your device to a remote server. Given the nature of electronics and storage, if you lose possession of the device, there is no guarantee that a skilled individual could not forcibly extract and reconstruct it. Under our current leadership, surveillance laws

will

be expanded in the name of security. The requirement for a warrant to forcibly extract data from a device will become more lax than it already is. The operative thought process from those in power is that, ‘if you have nothing to hide…’

Second, law enforcement:

I do not want to get into this too much. I see no way to effectively describe the problem with less than a few paragraphs; So, here we go:

With regard to your tech, the Fourth Amendment is dead. Your best defense is a secure device. Reports of police officers cloning the internal storage of Android devices on the side of the road with nothing more than a black box and a data cable are rampant. In reality, the Police have been collecting ‘analytical’ data from devices for years. All of the information is input into databases, where it can be cross-referenced and used for other investigations. Google ‘Cellebrite’ for more information about this. They are one of the leading forensic software companies. Reading about what can they do is truly disturbing. Be advised that the information on their website about compatibility and capability is not up-to-date [or complete] - for obvious reasons. For this reason, I would recommend keeping USB Debugging disabled on your device when you’re not using it.

Last year, I read a police report/legal ruling where a judge granted a police agency complete power to collect enhanced biometric data on everyone in a residence while executing a search warrant for drugs. I cannot delve too deep, but essentially, there was a device and the prosecutor had some doubts that the owner of the device used their own fingerprint. Enhanced biometric information collection was authorized [and executed] for all individuals in the household. This is a more extensive data set than what is stored by the fingerprint enrollment on Android/iOS. Tech. exists to pass this collected information to the pad sensor on your device. This was a clear violation of the Fifth Amendment if they used the information to crack open the device after the owner refused to type in their password. Because of the adversarial nature of our legal system, no one will complain until someone does something about it. The case received no attention from the press. I was never privy to the outcome, but it was clear to me that they really wanted to unlock that device.

We all have stuff to hide. Whether it is personal, criminal, whatever… The reality of our legal system in this country, combined with its age, has resulted in such an extensive set of laws that you are almost certainly violating one as we speak. Did you know that it is illegal for a man with a moustache to kiss a woman in Eureka, Nevada? See what I mean? This is [obviously] not enforced, but piss the wrong person off and watch how quickly a dumb law can serve as a pretext for investigation and discovery. See Twitter: CrimeADay for a bizarre list of

Federal

crimes which remain enforceable to this day. Even the most well-intentioned person could inadvertently incriminate himself or herself when surrendering their device. This is all very fascinating, and probably will never happen to you, but no one wants their device to be subject to random searches. Legal information, trade secrets, etc. can be just as damaging as incriminating information can be. Additionally, all of the data they collect leaves your protection and is subject to their storage, security flaws, breaches, and decisions to sell it in the future. If you choose to surrender your data, that is your call, but I seek to make sure that it is never by force.

Now that I've given you a headache, let's move onto the biggest security flaws that I’ve found:

ZTE has removed the ability to encrypt the internal storage on B29. I do not know if this was fixed with the B15 update, but this alone made the phone unusable for me. Several apps that I use will not even start if there is no boot time encryption password set. While I’m inclined to blame the apps, I completely understand why they won’t work. Some information is too sensitive to be stored on unencrypted media.

ZTE has altered the default security behavior of Android to allow the fingerprint sensor to unlock the device, even if it has just been rebooted or locked by a Device Admin. Again, I do not know the latest update addressed this. This feature is a last resort stopgap against your data being stolen under duress. You can refuse to type in a password, but your fingerprint can be forcibly/unknowingly used to unlock your device. I’m sure that more than a few of you have seen the Vines where the suspicious female attempts to use her man’s finger to unlock his device while he’s sleeping. I was unable to fix this, and it ultimately led me to abandon ZTE’s iteration of Android.

The bootloader can be rolled back and unlocked by anyone, allowing low-level access. From here, it is not difficult to reconstruct data that is left over by the insecure factory reset process after unlocking. However, this would probably be more useful to a thief than to someone who was after information. While this is cool for us from a development standpoint, it is also a security and anti-theft nightmare.

The power menu is accessible from the lock screen. While I’ve never seen a stock version of Android lock this down, the airplane mode function is available from the power menu on ZTE’s flavor of Marshmallow. This has the unfortunate effect of bypassing any anti-theft protection on the device that requires connectivity. We will address this and as many of the aforementioned items as we can.

Custom ROMS, Bootloader Unlocking

After careful consideration, I concluded that the only way the completely guarantee the security of my device was to use CyanogenMod/LineageOS. CM has some undesirable attributes, but [in my opinion] the positives outweigh the negatives. Let's just say that I eagerly await a fully functional AOSP build. However, CM allows encryption and requires the device’s password to be entered after rebooting or locking with a Device Admin. In order to do this, the device’s bootloader must obviously be unlocked.

Post-Unlock Security, Root, and What about my warranty?

Most security conscious individuals will probably tell you that unlocking your bootloader or rooting your device is the worst thing you can do for your device’s security. I submit to you that your device’s security is already broken. With the help of this site and a few easily accessible resources, the security that your locked bootloader affords you is useless. By encrypting your /data partition, you will be increasing the security of your data by an infinitesimal factor -- assuming you use a strong password. With regard to root, the human element remains the weakest link in the chain. Having your bootloader unlocked and your device rooted might make it easier for a knowledgeable person to reset and use the device after relieving you of it, but if your device is set up properly, your data is just as safe – if not safer than it was before.

The biggest consideration is warranty. In my opinion, any manufacturer that denies a legitimate hardware-related claim on the grounds of your bootloader being unlocked is not a company that should be supported. However, it ‘is what it is’ and time will tell how ZTE will treat its customers. The choice remains yours.

Password Strength

Using a separate encryption password is a wise thing to do. Pay attention to what keyboard you're using when you type your password in...

Do me a favor. Go to this site and check your password strength. http://calc.opensecurityresearch.com/

Under keys per second, select 'Custom' and paste

1999999999999999999999

That is very close to where we are, without going over.

The Fixes:

Please forgive the breakdown of writing style from this point forward.

/data Encryption:

The only remedy for this is to encrypt the internal storage on CM and then to reinstall B29. Unlock your bootloader, install TWRP, flash CM13, boot the device and encrypt it. From here, [if warranted] you can reset the encryption password to whatever you want it to be by running

vdc cryptfs changepw password 'old_password_here' 'new_password_here'

Reboot to TWRP, wipe everything, but do not ‘Format Data’ or Factory Reset. Perform an ‘Advanced Wipe’ and wipe everything. Reinstall B29, and you’ll be prompted for your encryption password whenever you boot your device! This alone will protect your data from forcible extraction and reconstruction after the device is factory reset.

Fingerprint Sensor Unlock Policy:

Use a different version of Android. I tried everything. Locking the device with a Device Admin, killing the services using ADB while on the lock screen, unloading drivers, etc… For some reason, the damned sensor just works all of the time. Any insight on this is greatly appreciated….

Bootloader Rollback:

The B15 update contains a newer version of fastboot that, as I understand it, is fake and does not accept fastboot commands. I will be investigating the implementation of this. This would still be subject to replacement by the working version… So, it may only slow a determined intruder down.

Lock Screen Power Menu/Airplane Mode:

There is probably a way to kill the power menu when on the lock screen by editing some resource or another. My solution utilized Tasker. Disable Tasker’s battery optimization in the Android system settings. A more comprehensive write up might be forthcoming upon request, but essentially, you would do:

2 (3rd/4th optional/troubleshooting) profiles/tasks to maintain a variable as to whether or not the device had been unlocked.

Event (Display Unlocked) -> Clear Variable %Locked
Event (Display Off) -> Set Variable %Locked To 1
State (Display Off) + State (Variable Value %Locked Doesn’t Match 1) -> Set Variable %Locked To 1
Event (Device Shutdown) -> Set Variable %Locked To 1

1 Profile/Task to disable Airplane Mode

Event (Variable Set, Airplane Mode Status, value=’on’) + State (Variable Set, %Locked, value=’1’)

From here, you can either tell a task to wait a specified amount of time to turn off Airplane Mode, have Tasker immediately turn it off, or flag a variable that will be looked for the next time the display is turned off. I would suggest having the last profile set a variable, such as %DisableAeroplaneMode=1. Then do,

Event (Display Off) + Variable Value (%DisableAeroplaneMode, value=’1’)
|-> Wait 5 Seconds, Turn Off Airplane Mode, Clear Variable %DisableAeroplaneMode

And/Or

State (Display Off) + State (Variable Value, Airplane Mode Status = ‘on’ & %DisableAeroplaneMode = ‘1’)
|-> Wait 5 Seconds, Turn Off Airplane Mode, Clear Variable %DisableAeroplaneMode

By doing it the way I have laid out, where the device waits until the screen is off, the would-be thief is tricked into thinking that he has disabled the device’s connectivity. The task will repeat as many times as the attacker toggles Airplane Mode. This will not stop the attacker from powering down the device, but may give you the extra minute you need to send the self-destruct command or locate the device. The optional tasks assure that your wishes are respected even if the Display Off events are missed -- which happens.

In conclusion, ZTE should really take a hint. Don’t cheap out on security. If something is working, and has worked for a long time, there is no reason to change it. Alternatively, to employ the age-old aphorism, if it ain’t broke, don’t fix it. I hope to have given everyone something with this write-up. A true 'pick and choose' philosophy way be the best way to proceed from here. There is no such thing as a truly secure piece of tech, and there is no such thing as a secure device that is also convenient to use on a daily basis. Take care, all.

This is my first thread in my 5 years of of XDA membership. Feedback is much appreciated.