Database Info

Webkit vulnerability (mirror)

I threw a thread in Android general to bring awareness of an article about a webkit vulnerability that will be/is being demo'd on the Android platform.
Thread:
http://forum.xda-developers.com/showthread.php?p=24154035#post24154035
Article:
http://news.cnet.com/8301-27080_3-57386319-245/researcher-to-demo-smartphone-attack-at-rsa/
Discuss?

Long as people practice the same rules as receiving fake facebook,banking ,etc emails than you should be ok. One advantage to desktops is you easily can hoover over the embedded link to see if its legit,report it as spam if not,& forward it to the actual company if they have department that handles phishing emails/fraud. Also from the article it doesnt say how the message was being faked as a carrier message. I normally save the short codes I use in my address book so I know whats what but I know from working customer service alotta people skip over the users manual that list the short codes & info for online saftey etc.

Yep, absolutely some common sense and safe browsing practices are important in something that is probably linked to your identity, and likely financial information.
What got me was the control over the real-time tracking ability of the device and recordings of audio (and video would not be a stretch I bet)
I haven't had a lot of time to look into it further yet, and it is a highly focused attack that is probably not of concern to the average user just yet - but given the scope of what this attack allows it's definitely something to be aware of.
Anything that lets joe-blow become a junior On-Star type peeping tom with my Android is something to worry about.
I never use the front-facing camera for anything, so it has a little piece of electrical tape cut to fit over it. No matter of software engineering can overcome that physical obstruction, but what of the microphone, gps and so on?
I'm eagerly awaiting the chance to look into this more after work tonight, meantime just wanted to throw it out there and try to get some awareness out and see what other people had to say.
I'm glad to see the first post in response here was a reminder about user-level security and explicitly cautioning people about clicking random links!
Also:
pimppoet said:
... Also from the article it doesnt say how the message was being faked as a carrier message...
Click to expand...
Click to collapse
This is the part where you get to be creative about it - you could make it anything, that was just the method they chose to get to the needed trigger, the user clicking the link.
I'm curious how they faked the carrier message too, but that doesn't mean that's the only method of injecting the desire to click into the users head.
Good points so far!
Edit:
To be honest, if it's not a click that's needed but just a visit to the website, an injection method could be to compromise an ad-serving machine that serves ads in apps and get an 'ad' that would take the user to the website inserted to what's already served to their device.
Heck, if that's viable, then you might even get them to accidentally go there with a stray touch and bam, you win.
Identification explicitly of the problem is step 1 on the path to a solution.

i am kind of in the habit that, whether an sms message is truly from the carrier or not, it's a scam either way **DELETE**
definitely worrisome, but i guess not surprising that stuff like this exists. good tho to bring it to light so that the race for patches can begin.
i'd be more worried if there was something that can attack your device without you clinking on a link or opening a message.... wait a minute, i guess a carrier could do that! tho it seems that their main interest is gathering data as research for how to sell more stuff, or to sell the data to others wanting to sell more stuff.

Blue6IX said:
Yep, absolutely some common sense and safe browsing practices are important in something that is probably linked to your identity, and likely financial information.
What got me was the control over the real-time tracking ability of the device and recordings of audio (and video would not be a stretch I bet)
I haven't had a lot of time to look into it further yet, and it is a highly focused attack that is probably not of concern to the average user just yet - but given the scope of what this attack allows it's definitely something to be aware of.
Anything that lets joe-blow become a junior On-Star type peeping tom with my Android is something to worry about.
I never use the front-facing camera for anything, so it has a little piece of electrical tape cut to fit over it. No matter of software engineering can overcome that physical obstruction, but what of the microphone, gps and so on?
I'm eagerly awaiting the chance to look into this more after work tonight, meantime just wanted to throw it out there and try to get some awareness out and see what other people had to say.
I'm glad to see the first post in response here was a reminder about user-level security and explicitly cautioning people about clicking random links!
Also:
This is the part where you get to be creative about it - you could make it anything, that was just the method they chose to get to the needed trigger, the user clicking the link.
I'm curious how they faked the carrier message too, but that doesn't mean that's the only method of injecting the desire to click into the users head.
Good points so far!
Edit:
To be honest, if it's not a click that's needed but just a visit to the website, an injection method could be to compromise an ad-serving machine that serves ads in apps and get an 'ad' that would take the user to the website inserted to what's already served to their device.
Heck, if that's viable, then you might even get them to accidentally go there with a stray touch and bam, you win.
Identification explicitly of the problem is step 1 on the path to a solution.
Click to expand...
Click to collapse
That too. I think tools like lbe,droidwall,adaway etc should come standard but I doubt it will ever since it would cut into google profits aswell.
One ad blocker I would love to see on smartphones is ad muncher since you can see the scripts,urls,etc being loaded,set your user agent for your browser to whatever you like etc.

Droidwall intercepts packets from kernel to Google, MS, xda

I like Droidwall. Here's my review: Droidwall is a nifty program which can easily be configured to block wifi and/or data communication for each individual application. Perhaps allows small savings in battery, data usage, and slight improvement in security. Particularly when app had no logical purpose to acces internet other than advertisements etc. Also does not cost any significant cpu or memory resources... just modifies a table somewhere.
Now onto my question:
One of the applications that I blocked was labeled “(Kernel) – Linux Kernel”
Blocking the “kernel” has no effect on items like browser, gmail etc.
Based on Droidwall log, over the past several weeks since I installed the program, it has blocked 397 outbound packets from “kernel” which were destined for a variety of IP’s that all seems to be associated with Google, XDA, or Microsoft.
Below is an example of three of the IP’s:
Google
74.125.227.140
https://ipdb.at/ip/74.125.227.140
xda
50.23.216.69
https://ipdb.at/ip/50.23.216.69
Microsoft
65.52.32.12
https://ipdb.at/ip/65.52.32.12
Another thing I noticed, these are the only log entries where the external IP is recorded in the log. In all the other non-kernel blocked-application log entries, the IP recorded is my router IP.
I’m using Entropy’s DD kernal on GB.
It seems to me a little strange that these outbound transmissions are associated with the kernel. And at the same time, they don’t seem to be associated with any obvious legitimate purpose....because my phone works fine on normal internet application even with “kernel” blocked by Droidwall.
Does anyone have any ideas what would be the explanation for these packets sent from kernel to Google, MS, xda ?

Well I don't know much of anything about programming, however some people say that it isn't just apple that collects information about people without them knowing. Could be that or I could be completely wrong.
Just for curiosity, do you allow anonymous data to be collected and sent to Google?
Sent from my SGH-I997 using xda app-developers app

If no answer here, maybe post your question here: http://forum.xda-developers.com/showthread.php?t=1957231

Well I don't know much of anything about programming, however some people say that it isn't just apple that collects information about people without them knowing. Could be that or I could be completely wrong.
Just for curiosity, do you allow anonymous data to be collected and sent to Google?
Click to expand...
Click to collapse
I generally answer no the the “anonymous data collection”.... thinking about battery, data usage, and privacy. I think several apps have that question. I don’t doubt there are a lot of programs trying to communicate for a variety of non-obvious (possibly suspicious) reasons regardless of how you set up the options. ....there were a several installed Apps attempting access that had no obvious reason to do so.
What initially struck me as strange was that this was attributed to the kernel.. that didn’t quite compute. Trying initially to formulate an intelligent thought about what that meant, I utterly failed and came up with the notion that these items must somehow be related to programming by the developer of the kernel. When I actually engaged my brain, I realized that was just plain silly because:
1 – That would be Entropy. Enough said.
2 – The kernel is open source.
3 – There are several different destination ip’s. If one person was trying to collect data, he wouldn’t send it to different places. So it must be several applications interacting with the kernel.... just shows up attributed to the kernel by Droidwall.
If no answer here, maybe post your question here: [afwall link][
Click to expand...
Click to collapse
Thanks Pony Ex. I didn’t know that program afwall existed. Looks like it might have some good improvements to an already-great program (Droidwall). Will definitely give it a try. But I’m not bold enough to post this type of question in the developer’s thread though... several others were scolded for non-appropriate posts in that thread.

To my limited understanding, and I apologize if I am wrong, entropy just modified the kernel that was already there? Hence why the new ICS and jelly bean ROMs are still using a gingerbread kernel.
So who actually wrote the kernel? Samsung? Google? Both?
I agree I don't see entropy gathering personnel data.
However, apple was caught doing it and to the conspiracy minded individual, Google (a company that made it's fortune with information) would be in a similar position to do the same.
Again I have no evidence or knowledge to back up anything I'm saying, however what better way to collect information then distributing a free open source program with 100's of millions of users?
Sent from my SGH-I997 using xda app-developers app

electricpete1 said:
Thanks Pony Ex. I didn’t know that program afwall existed. Looks like it might have some good improvements to an already-great program (Droidwall). Will definitely give it a try. But I’m not bold enough to post this type of question in the developer’s thread though... several others were scolded for non-appropriate posts in that thread.
Click to expand...
Click to collapse
electricpete,
http://forum.xda-developers.com/showpost.php?p=35352916&postcount=256
I'll fade the heat.
Edit: His first reply: http://forum.xda-developers.com/showpost.php?p=35360652&postcount=257

Pete,
Are you using the Droid Wall to stop the outgoing packets to ensure privacy or are you using it to stop the wakelocks that may be contributing to the wifi drain bug on gingerbread?

Here is a reply from someone else... pretty good read:
http://forum.xda-developers.com/showthread.php?p=13148076#post13148076
post # 47

Pony Express said:
Here is a reply from someone else... pretty good read:
http://forum.xda-developers.com/showthread.php?p=13148076#post13148076
post # 47
Click to expand...
Click to collapse
Thanks Pony Express, for posting that question. Good info in the responses and other links.
qkster said:
Pete,
Are you using the Droid Wall to stop the outgoing packets to ensure privacy or are you using it to stop the wakelocks that may be contributing to the wifi drain bug on gingerbread?
Click to expand...
Click to collapse
There is the potential to improve all three (limit data usage, limit battery usage, improve privacy).
I think the improvements in battery life and data usage are probably relatively small (especially because I also manage those by turning my connections off when not in use while away from home wifi)... whereas I think the improvement in privacy may be substantial... so I guess that's my main interest (improving privacy).
But since the $ cost and resource cost is basically zero, it almost seems to me like no-brainer choice to use it regardless of the level of benefit we expect (unless there is some hidden disadvantage...which I haven't seen yet).
I wasn't aware of a particular wakelock problem on Gingerbread. I haven't particularly noticed a change in batteryusage one way or the other (and I really wouldn't expect to notice unless it was a dramatic change), but it stands to reason that reducing traffic from unwanted Ads, pinging, data-gathering etc could help. Here are some links that may support that view:
http://gizmodo.com/5894572/in+app-ads-are-destroying-your-battery-life
http://www.theverge.com/2012/3/19/2884902/android-apps-battery-efficiency-study
There was one poster in the AFwall thread that suggested an App that is denied access will keep trying again and again, and therefore use more juice..... which also sounds plausible, but several others disagreed with that.
* I have installed AFwall now, in place of Droidwall. It is the same program with a few improvements (fixed hole in the security wall during reboot) and a lot of extra features. But still keeps the same basic simple user interface.

Juniper Networks study reveals how dangerous Android is to our privacy

Okay, so, I summed up some 5 articles on this subject - in the hope of starting a discussion about device security. I hope you will find this interesting and meaningful and perhaps you will find out about some of the risks of using Android.
2 months ago Juniper Networks, one of the two biggest network equipment manufactures, published a blog post (1) about an intensive research their mobile threat department had on the Android market place.
In essence they analyzed over 1.7 million apps in Google Play, revealing frightening results and prompting a hard reality check for all of us.
One of the worrying findings is that a significant number of applications contain capabilities that could expose sensitive information to 3rd parties. For example, neither Apple nor Google requires apps to ask permission to access some forms of the device ID, or to send it to outsiders. A Wall Street Journal examination (2) of 101 popular Android (and iPhone) apps found that showed that 56 — that's half — of the apps tested transmitted the phone's unique device ID to other companies without users' awareness or consent. 47 apps — again, almost a half — transmitted the phone's location to other companies.
That means that the apps installed in your phone are 50% likely to clandestinely collect and sell information about you without your knowledge nor your consent. For example when you give permission to an app to see your location, most apps don't disclose if they will pass the location to ad companies.
Moving on to more severe Android vulnerabilities. Many applications perform functions not needed for the apps to work — and they do it under the radar! The lack of transparency about who is collecting information and how it is used is a big problem for us.
Juniper warns, that some apps request permission to clandestinely initiate outgoing calls, send SMS messages and use a device camera. An application that can clandestinely initiate a phone call could be used to silently listen to ambient conversations within hearing distance of a mobile device. I am of course talking about the famous and infamous US Navy PlaceRaider (3).
Thankfully the Navy hasn't released this code but who knows if someone hadn't already jumped on the wagon and started making their own pocket sp?. CIO magazine (4) somewhat reassures us though, that the "highly curated nature of [smartphone] application stores makes it far less likely that such an app would "sneak through" and be available for download."
A summary by The Register (5) of the Juniper Networks audit reads that Juniper discovered that free applications are five times more likely to track user location and a whopping 314 percent more likely to access user address books than paid counterparts. 314%!!!
1 in 40 (2.64%) of free apps request permission to send text messages without notifying users, 5.53 per cent of free apps have permission to access the device camera and 6.4 per cent of free apps have permission to clandestinely initiate background calls. Who knows, someone might just be recording you right now, or submitting your photo to some covert database in Czech Republic — without you even knowing that your personal identity is being compromised.
Google, by the way, is the biggest data recipient — so says The Wall Street Journal. Its AdMob, AdSense, Analytics and DoubleClick units collected data from 40% of the apps they audited. Google's main mobile-ad network is AdMob, which lets advertisers target phone users by location, type of device and "demographic data," including gender or age group.
To quote the The Register on the subjec, the issue of mobile app privacy is not new. However Juniper's research is one of the most comprehensive looks at the state of privacy across the entire Google Android application ecosystem. Don't get me wrong. I love using Google's services and I appreciate the positive effect this company has had over how I live my life. However, with a shady reputation like Google's and with it's troubling attitude towards privacy (Google Maps/Earth, Picasa's nonexistent privacy and the list goes on) I sincerely hope that after reading this you will at least think twice before installing any app.
Links: (please excuse my links I'm a new user and cannot post links)
(1) forums.juniper net/t5/Security-Mobility-Now/Exposing-Your-Personal-Information-There-s-An-App-for-That/ba-p/166058
(2) online.wsj com/article/SB10001424052748704694004576020083703574602.html
(3) technologyreview com/view/509116/best-of-2012-placeraider-the-military-smartphone-malware-designed-to-steal-your-life/
(4) cio com/article/718580/PlaceRaider_Shows_Why_Android_Phones_Are_a_Major_Security_Risk?page=2&taxonomyId=3067
(5) theregister co.uk/2012/11/01/android_app_privacy_audit/
____________________________________________________________________________________________
Now I am proposing a discussion. Starting with - do we have the possibility to monitor device activity on the phone? By monitoring device activity, such as outgoing SMSs and phone calls in the background, the camera functions and so on we can tell if our phone is being abused under the radar and against our consent. What do you think?
.

I am finding it sad and troubling but even more so ironic that nobody here cares about this stuff.

Pdroid allows you to tailor your apps and what permissions your device actually allows on a per app basis. Requires some setup, and the GUI is nothing fancy.. but for those worried about permissions, it is quite ideal.
Edit : http://forum.xda-developers.com/showthread.php?t=1357056
Great project, be sure to thank the dev
Sent from my ADR6425LVW using Tapatalk 2

DontPushButtons said:
Pdroid allows you to tailor your apps and what permissions your device actually allows on a per app basis
Click to expand...
Click to collapse
Sounds good for a start, I'll look it up

pilau said:
Sounds good for a start, I'll look it up
Click to expand...
Click to collapse
Okay, so I looked it up, and Pdroid does look like a fantastic solution to control what apps have access to what information on your droid.
However, it doesn't cover monitoring hardware functions such as texts being sent, calls being placed etc. as described in the OP. Besides, it only works in Gingerbread as far as I could gather.
EDIT: looking at PDroid 2.0, it does exactly what I originally asked

pilau said:
Okay, so I looked it up, and Pdroid does look like a fantastic solution a control what apps have access to what information on you droid.
However, it doesn't cover monitoring hardware functions such as texts being sent, calls being placed etc. as described in the OP. Besides, it only works in Gingerbread as far as I could gather.
Click to expand...
Click to collapse
I actually first found out about it on an ics rom, so it's definitely not just gb. As for monitoring, no clue. Any sort of extra process logging would likely bog down resources or space eventually.
Sent from my ADR6425LVW using Tapatalk 2

DontPushButtons said:
Any sort of extra process logging would likely bog down resources or space eventually.
Click to expand...
Click to collapse
I definitely wouldn't know. This solution looks very complicated in first impression but on the Google play page it says 100% no performance effects.
Anyway, I looked up PDroid 2.0 here on XDA, which is the rightful successor of the original app. It does everything the original app does and also monitors many device activities! Here is the full list of features. I would add a working link but I'm still a n00b and I am restricted from doing so. Sigh....
forum.xda-developers com/showthread.php?t=1923576
PDroid 2.0 allows blocking access for any installed application to the following data separately:
Device ID (IMEI/MEID/ESN)
Subscriber ID (IMSI)
SIM serial (ICCID)
Phone and mailbox number
Incoming call number
Outgoing call number
GPS location
Network location
List of accounts (including your google e-mail address)
Account auth tokens
Contacts
Call logs
Calendar
SMS
MMS
Browser bookmarks and history
System logs
SIM info (operator, country)
Network info (operator, country)
IP Tables(until now only for Java process)
Android ID
Call Phone
Send SMS
Send MMS
Record Audio
Access Camera
Force online state (fake online state to permanent online)
Wifi Info
ICC Access (integrated circuit-card access, for reading/writing sms on ICC)
Switch network state (e.g. mobile network)
Switch Wifi State
Start on Boot (prevents that application gets the INTENT_BOOT_COMPLETE Broadcast)

I've always had the luxury of someone else integrating it into the Rom, then I just had to set it up through the app. It is time-consuming, but not very difficult at all. I say give it a shot and see if that's what you had in mind. Maybe the logging is less detrimental than I had previously thought.
I'm sure you could get your post count up by asking for some tips in that thread. Every forum on xda has at least one person that's EXCESSIVELY helpful, frequently more. So have a ball
Sent from my ADR6425LVW using Tapatalk 2

[Q] List of Android Applications with Issues (power drain, leaks etc etc)

Hi again,
Bit of another weird question but i'm looking up applications that have issues such as memory leaks, Power drain Issues and a like. TBH, any application there is out there from sat nav to gaming, From simple notepads to full office suites. Everything and anything basically. Wanting to make a comprehensive list so that when we get our 'reports' sent to us it will flag up the particular application the customer is using that may be a issue. Even ones that have issues with certain versions of android.
Again, Thanks for any help

Ok then, Let me rephrase the question,
What applicatiuons do people know about that cause issues. From malware like GluMobi to Memory leaks of mGlow or Resource Hogs like hotmail to network hogs like netflix. Security issues like the one in apache cordova 3.5 and below to simple storage eaters like The SIms Freeplay.
ANY issue, not matter how big or small basically that can cause ANY potential problem. Technically, Its going be a HUGE list
Bugs, Battery Drain, Issues with certain versions of Android, battery drain, LITERALLY anything, No matter how big or small.
Thanks again

It's flat-out impossible to maintain an accurate list of what you're asking for. Most issues reported in most cases would be fixed within a few days as the apps get updated. Simply asking people to report these things is also a dangerous precedence and an ineffective way of doing it as there will be prejudice left and right, users reporting subjective information that isn't technically true and/or applicable to their specific phones and/or ROMs only. And how would you make comparison? How slow, leaky, disruptive etc does an app need to be to make it on the list? What if an app gets added that had real issues, gets fixed the day after, and then remains on your list for several more months because no new reports are coming in? It would be rather unfair to the developer(s).
Any truly disruptive apps are eventually removed and banned from ALL app repositories as the app host gets complaints about it (like Google bans apps from Play Store), so there's no reason to make a list of them here.
If i misunderstand your intentions with this list, i'm sorry. But you have more explaining to do before this idea makes any sense.

RobbyRobbb said:
It's flat-out impossible to maintain an accurate list of what you're asking for. Most issues reported in most cases would be fixed within a few days as the apps get updated. Simply asking people to report these things is also a dangerous precedence and an ineffective way of doing it as there will be prejudice left and right, users reporting subjective information that isn't technically true and/or applicable to their specific phones and/or ROMs only. And how would you make comparison? How slow, leaky, disruptive etc does an app need to be to make it on the list? What if an app gets added that had real issues, gets fixed the day after, and then remains on your list for several more months because no new reports are coming in? It would be rather unfair to the developer(s).
Any truly disruptive apps are eventually removed and banned from ALL app repositories as the app host gets complaints about it (like Google bans apps from Play Store), so there's no reason to make a list of them here.
If i misunderstand your intentions with this list, i'm sorry. But you have more explaining to do before this idea makes any sense.
Click to expand...
Click to collapse
Im in total agreement with what you say and this is just an extra feature that we are adding to what we already have. I work for a company in the UK and our intentions with this is we already have a system that checks clients hardware/software for what it has as we do a lot of work for many other big companies in the uk (all of them basically) as we have some very good engineers here. THe idea behind this database is just to flag certain things that may be causing issues and its more for internally than anything external although that as come up in meetings about adding this feature to the program we plan to release in the near future where 'certain' clients will be able to access our databases with our app we provide them. This is all preliminary at the moment and as i say, For our internal use only. This is why im looking for such a vast catalogue of problems, whether rumour or not
is not an issue at present. I'm just building the bare bone of this to test out how it works against our other databases and how easy/effective it will be working with what we already have.
Thanks for your answer and that's the conclusion we were at also. The fact that pre bundled software as total access to all information is kind of worring which we have dug up. This allows other programs that can get access to any of that information if it can pull a request from said bundled software. Example would be a program that requests use from the bundled program to read a PDF file (with the bundled software been a PDF reader). This is given access and then allows all the privileges of the bundled software. This is very very dangerous and a concern as most phone companies chuck plenty of bundled software (often not wanted by the consumer) on to there phones.
I was working on the 2G,3G,4G radios on all major phones the other week so im accustomed to A LOT of data entry
Thanks for your help my friend, Its good to know what we thought would be true but we have dug up a few other issues by doing this, So its not all a loss
EDIT: A piece of software still available and apparently malware/spyware is droiddream (bicchali.harish.droiddream) from what i can find on it. Also, Livelocker (net.livelocker) looks as if its got malware/spyware. As you say, What defines spyware is different in different peoples opinions but me personally am dubious about everything, As i think everyone should be but they are not. People just don't care as long as they have their facebook and crap lol. Point of interest about facebook, Funded to the tune of 12.8 Million by In-Q-Tel to get going, WHich was formed by the CIA. Just a little nugget there

I'm surprised no one as ANYTHING to say on the matter, Even if it's just on a whim that they hate app for x, y,& z. I have plenty personally lol

To any call blocker app develper out here

I have recently been having issues with lots of spam calls from different numbers from a same (or several) call center(s) for a same ad offer.
I have a call blocker installed, where i manually ad the numbers, but I am thinking it is not the most efficient for every user out there to do the same thing over and over again. I'm thinking it'll be wise to have a public registry of spammer numbers reported by users by country. And an app that that let users report numbers, and then push and pull numbers from the server. Perhaps something open source or free software for everyone to take advantage of.
Has something like that been done? or someone interested in?

Do any blockers work right on Nougat?
https://forum.xda-developers.com/moto-z-play/how-to/people-realize-call-blocking-apps-t3666123

cpucpu said:
I have recently been having issues with lots of spam calls from different numbers from a same (or several) call center(s) for a same ad offer.
I have a call blocker installed, where i manually ad the numbers, but I am thinking it is not the most efficient for every user out there to do the same thing over and over again. I'm thinking it'll be wise to have a public registry of spammer numbers reported by users by country. And an app that that let users report numbers, and then push and pull numbers from the server. Perhaps something open source or free software for everyone to take advantage of.
Has something like that been done? or someone interested in?
Click to expand...
Click to collapse
Google Phone app does exactly what you have described, though it takes time for their algorithm to decide that a particular phone number is used for spam calls. If it really bothers you, the best thing you can do is to block calls from unknown phone numbers or you may use Google Voice and require unknown callers introduce themselves.