Security Audit - how can I tell my Android Distribution is safe I've just bought a Jiayu G4 and it came with android installed (rooted).

My question is - how can I tell that nothing nasty has been installed on the phone?  Or best practices to ensure that it's safe to use.  I've had a look but I haven't seen any accounts of malware distributed Android OS's, but I'm sure it can happen.

Obviously there's an (un)healthy amount of paranoia here, but it'd be nice to know that data isn't being siphoned off somewhere it shouldn't be.
The bad news: You very probably can't.

If the manufacturer decides to backdoor your phone's firmware, it's hardly detectable by individuals.

Phones consist of many components of which only a tiny fraction is really authored by the manufacturer.

Think of drivers and firmwares for various chips like the baseband, wifi, sensors, the various open source parts like the linux kernel, the Android system itself, the closed source Google apps and additional 3rd party packages from other other companies, that are preloaded.

To be sure, you would need all of the firmwares' source code and a way to compile it in a way such that the official builds and your build match bit by bit to prove that the source code matches the firmware (and nothing was secretely altered). Now one still needed to audit all the source and scan it for backdoors/vulnerabilities.

To get an idea: TrueCrypt is a popular disk encryption software for many operating systems. In the wake of the NSA scandal its sources have recently been binary matched with the official windows releases which was a very tedious process (report here). A source code audit hasn't been conducted yet, but there's a (now) still running indiegogo project for funding that audit with currently ~35k US$ pledged for doing it.