Hello, on http://www.israelnationalnews.com/News/News.aspx/221052 I read that hundreds of millions of Android phones containing a Google account are vulnerable to hacks.
Is this a good moment to panic or can someone tell me how to remove the Google account from my FP2?
Thanks, best regards,
Gábor Menkes
Technical translator and conference interpreter
I never used Google, so I’m no expert, but I’d guess you can remove your Google Account in Settings > Accounts.
Whether that is enough to be save I don’t know. Especially if your account was already hacked they could have opened some backdoors in your phone so they don’t need your account anymore to enter.
I can’t tell you if it’s a good time to panic, but if you do then to put your mind at ease you could do a hard reset and/or (re)install FP (Open) OS.
It turns out to be more complicated than I had expected. I have a Google account that I access through various devices, Fairphone FP2, laptop, desktop, etc.
I started removing my Google account and the warnings that were issued, led me to believe that EVERYTHING will be lost - that is not what I had in mind: I want to remove everything connected to Google and Gmail from my FP2, not from other devices. So probably I will have to ask a Google expert how to accomplish that!
Probably nothing to worry about because Fairphone releases monthly updates with security patches.
If you haven’t installed any apk outside Google Play Store, then your FP2 is clean.
Anyway, I don’t know if removing now a Google account from Android with GMS is trivial; I fear it isn’t, but I only had bad experiences in the past (I’m living without Google for two years already). Google account is treated with privileges on the system.
If you can provide an screenshot of the “we’ll wipe everything!” message, we might be able to help you further.
Thanks for the link @Juli_R
It seems to be the one that all the newspapers read and tried more or less to understand 
It says that the vulnerabilities used by Gooligan to infect your device are :
VROOT (CVE-2013-6282) and Towelroot (CVE-2014-3153)
They are quite old vulnerabilities, so I’m pretty confident as FP are deploying security updates quite frequently. Specially for the FP2 which was released after 2014.
Maybe some developper from FP could confirm to us in which OS version of FP1/FP2 those CVEs were fixed ?
The attack vector is installing booby-trapped apps. If you’ve been installing dodgy apps there is always reason to panic, the existence of Gooligan doesn’t change that.
Also note that unpatched phones are also vulnerable even if no Google account is present - the account details are part of the target, not the cause.
This topic was automatically closed 182 days after the last reply. New replies are no longer allowed.