&gt; If the toolchain wasn&#x27;t corrupted, and this was in the original source code (C?) - it&#x27;s not going to be too difficult to find in code review, if you are looking for it<p>I was part of a research project, in which, as part of the evaluation, we were given small Android applications (1-10k lines of code, not obfuscated). We were told that each of the apps contained a single piece of embedded malicious functionality hidden in its otherwise known&#x2F;innocuous behavior. We were given a few weeks to find the malicious functionality. The main goal was to use our prototype software analysis tools. But in those cases in which we had to perform manual source analysis, the implanted functionality often eluded us for 10-25% of the cases.<p>Now, you might be able to find people who are more experienced at software auditing than us (a bunch of Ph.D. students in security and compiler-related areas). But you might also find more experienced implant writers as well. Also, in a case like this, you don&#x27;t know how many implants there are, how much of the internal company network is also compromised, how many (if any) of your remaining employees is an attacker, etc.