Related
I'm looking for beta testers for a new App2SD implementation that does not require your MicroSD card to be partitioned which is potentially unsafe and can result in a loss of your data. If you'd like to test this new implementation before it's release here on XDA shoot me an email at [email protected] with what firmware and version you're using.
More information will be released after I get a few positive beta tests out of the way.
loopback device, eh?
I tried that a while back but never could get the loopback driver to load early enough in the boot process reliably.
Hope you have better luck than I did.
As [email protected] pointed out to me a while ago, this is not a good idea for security reasons. If your loopback file sits on the FAT partition, it is accessible by all of the apps, it can be read, overwritten and deleted by a rogue app bypassing the entire android security model. If this is what you intend to do, it's probably not "safer".
Hey, shot you an email. Ready to try it out. But only for beta.
Hit me up, I have no apps to lose.
But security? Idk just let me know whats up.
what happens when you mount the SD card to your computer?
I'd like to try it, but i don't yet have a class6 sd card. Is that necessary?
i'd be willing to give this a shot. I have no data to lose as well.
southsko said:
what happens when you mount the SD card to your computer?
Click to expand...
Click to collapse
That's true. Won't all your apps disappear when you mount the SD?
This smells fishy not many app developers with 1 post can this be someone testing their new exploit/virus?No offense to original poster im just sayin....???
Edit:Sorry to OP clearly not a virus,and good luck on getting it stable I will gladly donate to your cause partitioning is a pain!
don't be a jackass, many people have had great ideas and decided to come to XDA to share them. just because you are a complete idiot who can't program does not mean that the OP is too.
@@OP
you are playing with fire my dear friend. i don't think that mounting your apps on the FAT32 partition is a good idea at all. not only because it would allow any program to access and write without asking android permission first, but because it would allow people to mount the SDcard and steal paid apps even easier. i beg of you please rethink your idea
I imagine the phone would be crashing when the phone is mounted to the computer. lol. just kidding. =]
tubaking182 said:
don't be a jackass, many people have had great ideas and decided to come to XDA to share them. just because you are a complete idiot who can't program does not mean that the OP is too.
Click to expand...
Click to collapse
WTF?Just came back to edit my post and put that its for real cause like I should have done first I found this http://noderat.com/loop2sd/.But as for your insults who the hell are you?How the f**k do you know what I can or can not do?I was posting in the first place to start trying be more active in the forums no reason for you to be a **** anyways,I was tryin to help people not get what I thought may have been a virus was that really that bad?
i'm not sure that is 100% true. when i mount my phone(apps2sd) my phone decides to mount the ext2 partion and the FAT32 partition, i am using ubuntu so my computer is able to read the partition, but my phone doesn't crash(i've yet to try running an app while mounted though)
Android can acces the sdcard while mounted.
Try terminal emulator.
crotalusfreak said:
This smells fishy not many app developers with 1 post can this be someone testing their new exploit/virus?No offense to original poster im just sayin....???
Click to expand...
Click to collapse
Well, take it from someone who has many posts and 15 years of unix experience, it is a bad idea.
Most of the devs here had this same idea, but as I mention in my previous post, this is opening yourself up to many bad security issues. To all those who answer, "I have no data to lose", that's fine as a beta tester. But what's the point in beta testing something that cannot be safely used by anyone who does have data (or apps) to lose?
I should point out to those who perhaps do not realize some the consequences of my original post, that it is not just a potential data loss problem, but a potential arbitrary code execution vulnerability. If an application manages to replace the loopback file with a new loopback file, it could inject altered common applications. If this succeeds, it means that previously trusted applications which have been granted privileges (or root using the various su apps) at install time, could be replaced with trojan versions which can have complete control over your system... steal your passwords... reflash your bootloader and literally install a permanent trojan... brick your phone... <insert other scary things besides data loss here>.
It's your phone, do what you want. I just figured that I would re-post that this not a new idea, but one that has been rejected by those of us with unix experience who realize the consequences. If you are just messing around, go ahead, it's not likely to hurt your phone. But, as a general method to build upon and be depended on, this should not have a future. If this becomes common practice, it is highly likely that exploits will be written to take advantage of this vulnerability.
So, if you are asking yourself if something is fishy, yes something is: it's a logical idea which seems great on the surface, but it has an unfortunate flaw.
Note: I am not suggesting malicious intent on the OP's part, just that they may not have thought of the consequences of suggesting this as a common method to do apps2sd. And if the OP (or someone else) is able to point out a method to avoid the things I warn against I will happily retract my statements (if I agree that this method would indeed work) since this method has some obvious benefits. However sadly, I think that is highly unlikely.
maxisma said:
Android can acces the sdcard while mounted.
Try terminal emulator.
Click to expand...
Click to collapse
No it can't. It can only access the empty mountpoint.
If you want to do this, there IS a way to make it work SAFELY....
Find the functions that control sdcard mounting and unmounting and FIX it so that it will mount an ext2 first partition. Then forget about the whole loopback thing as thats not going to do anyone any good... If you do it like this, then unionfs it, then unmounting the sdcard should safely vanish the apps that are stored on the card (leaving the internally stored apps), might crash the launcher, but that'll restart immediately and won't even error out.
A second step in the right direction would be to find the place where programs are detected from, which currently looks in /data/app, /data/app-private, /system/app, so it can clearly handle loading software from multiple locations -- add in a new path. Or maybe link app-private to /sdcard... A little more challenging would be to allow it look in multiple locations for thing that are ALL currently in /data/data and /data/dalvik-cache.
And then when its done, submit a patch for the source.
Wow what a response. Here's a few key bulletpoints:
I'm not a forum poster, not the kinda person for it but I have been on XDA Dream since I got my pre-launch G1 as a CSR.
There are potential security flaws with the current ext2 method of a2sd, and bypassing root to mount the ext2 partition is possible.
a2sd is not stable in any format, so it's a use at your own risk until android improves kinda deal.
I'm not cool enough to write a virus, but thank you for the ego boost
Anybody using a third-party firmware is not safe nor secure. If you're reading this forum you're not safe nor secure. The idea of homebrew roms is to add extra features that are not in Android to begin with and with that comes security risks. No ROM is ever perfect but I'd trust a Google or T-Mobile rom with my security before any homebrew-anything.So yes it's use at your own risk
This has the same results for mounting on a PC as MarcusMaximus's a2sd.sh
This doesn't really make it any easier to steal paid apps, it's always been easy and always will be but this doesn't change it.
If you guys have other questions shoot me an email, like I said I don't really do much forum-posting (never had much of anything to say, maybe this'll change all that)
[email protected]
JakeEv said:
I'd like to try it, but i don't yet have a class6 sd card. Is that necessary?
Click to expand...
Click to collapse
The faster the better but I've done it with the stock card that came in the G1 as well as a Class 6.
id try it since i can not get apps2sd to work.
[email protected]
using JF 1.51
So I am stealing this from another forum, hopefully it will cut down on some of the repeated threads. Copy and pasted to reduce the strain on my brain and typing.
Stolen from the Sprint Hero board on AndroidForums.com - Props to PDragon for typing it all. I have slightly modififed.
ROM - Read Only Memory
While the term has changed a bit from it's original meaning, it's essentially computer memory that does not require power to store it's data (non-volitile). In the sense of a smartphone like the Hero, it's the Internal Memory where the OS is stored. From what I've gathered, the Internal Memory is just Flash Memory (a special type of ROM) partitioned into two parts, one for the OS and the rest for apps to use. So, the OS partition essentially is true ROM, unless you root the phone. The software that groups like xda-developers make available are called ROMs because they're a ROM Image.
For the Hero this size is 512MB.
SDcard is a larger capacity external Flash Memory card.
Recovery Rom - I would assume enough said, but. This is the recovery partition of the phone for when things go bad, typically how you will load your ROM packages, some times refered to as "Update.zip" files.
Vanilla Rom
All the fancy bells and whistles have been pulled out so that its as minimalist as possible, users can then build on this for their own custom setup.
RAM - Random Access Memory
This is where current processes that are running are stored and keep the data they need immediately available to them. This is the memory you see when you run any of the Task Managers showing you currently running apps and the available memory. It's a completely different part of the phone from the Internal Memory discussed above. Data stored in RAM requires constant power and does not survive a power cycle of the phone (volitile).
For the Hero this is 288MB.
Root
This is the term being thrown around for modifying a smartphone to put custom software on it that normally wouldn't be allowed through means included with the phone (Android Market or an .apk file for a non-Market app). "Root" is the common term chosen because, in a Unix environment, the "root" user has complete and total control of the entire operating system of the computer. So, "rooting" the phone means taking complete control over its operating system. This is usually done by means of finding a flaw somewhere in the phone's firmware to allow access to the restricted Internal Memory where the OS resides. You then install a custom ROM (see above) to let you use your phone from then on.
Android is a bit more unique than any of the previous smartphones in that you don't really need "approval" from a higher power (ex, the Apple store) to install an app that hasn't made it onto the Market. Just uncheck the box Settings -> Application settings -> Unknown sources and you're free to install any .apk file you wish. So Android phones are more like a regular computer in that you're free to install whatever software you want from whichever source you want. Just be careful of where you get apps from outside of official Market sources. Also like a regular computer, you could open yourself up to having your personal data stolen.
Rooting still gives some advantages for power users, but for normal or even intermediate users, you probably don't need to root the phone to enjoy it as much as you'd have needed to for previous smartphones.
For further discussion, please see our Developer Forums.
Tethering
This is the term used for using your phone as an Internet access point to allow an attached computer to access the Internet. It turns your phone into a mobile modem. Please don't discuss Tethering here. See the thread Does Tethering work? to discuss this further.
*Let me know if we should add other terms. Maybe a MOD can stickie this.*
but where are the guides
jtadeo said:
but where are the guides
Click to expand...
Click to collapse
I think all of the guides have been Stickied on the first page of the board. Do you need one in particular??
At the bottom of the main forum is a dictionary for anyone to use. I don't see the point in this unless it is made for lazy people that just want what they want now and can't take time to research.
tdavis42 said:
At the bottom of the main forum is a dictionary for anyone to use. I don't see the point in this unless it is made for lazy people that just want what they want now and can't take time to research.
Click to expand...
Click to collapse
Do you think we would have as many of the new user questions repeated over and over if they did take time and do the research? Think not... You must have some real faith in humanity if you think people won't take the easy way out if it is offered. Hence my copy and paste from another forum.
What was a SDcard? and I'm not understanding the concept or RAM....
hahaha, just joking..
Nice work, I'm sure this will come in handy for some folks!
for all other definitions check out : http://wiki.xda-developers.com/index.php?pagename=Glossary
N0J said:
What was a SDcard? and I'm not understanding the concept or RAM....
hahaha, just joking..
Nice work, I'm sure this will come in handy for some folks!
Click to expand...
Click to collapse
I am not making fun of anyone, I have been there my self. But I have seen the above questions on other forums! lol.
I must say XDA members tend to be a little ahead of the learning curve.
Search Button!
jtadeo said:
but where are the guides
Click to expand...
Click to collapse
Search button is your FRIEND!!!
Kcarpenter said:
I am not making fun of anyone, I have been there my self. But I have seen the above questions on other forums! lol.
I must say XDA members tend to be a little ahead of the learning curve.
Click to expand...
Click to collapse
lol, yeah
xda is good
jjjjayd13 said:
Search button is your FRIEND!!!
Click to expand...
Click to collapse
but the search button is terrible, lol
I've even seen a disclaimer on a mod's signature saying that it sucks and to use google, haha!
Hi, there!
Like many others, I have only recently switched from WM6.5 to Android (with my new HTC Desire).
WM 6 introduced the possibility to encrypt the SD Card, making it only readable in the PPC it was originally encrypted in. I found this a very helpful tool and had bought a respective app from Spritesoft. Unfortunately, their Android software is still in the beginning status, and therefore, I bought yesterday the app from WaveSecure.
I was surprised, however, that they do not offer an encryption for the SD card as I know it from my old TyTN II.
Is anybody here who can advice - tweak, app, or whatever?
I mean, it's nice to secure the phone - but the sensible data are being stored in files on the SD card in the end. And if you lose your device, it may well be broke, but the SD card lives and cannot be wyped in a broken device either.
I couldn't agree more. There are a few applications that either offer individual file passwords, which is not very secure, or just offer encryption of its own text files, like OI Safe. I used to use a commercial application on Windows Mobile, Sentry 2020, which allowed you to create a an encrypted volume within your storage, internal or external. This was ideal, as it allowed you to store any kind of files in this. After a timeout period, the volume was automatically closed and your files were secure. It is a shame that the last activity in Sentry's website is in 2007.
I should be receiving a desire very shortly and am very concerned by the current lack of device level encryption.
Does anyone know if there are any products in development that will soon allow device encryption?
Is the hardware and OS itself capable of supporting full device encryption?
hi, i want to reopen this issue because today i asked myself the same question.
i have tested several apps but most of them are not useable for a large number of files or folders.... what we really need is a secret partition and something like truecrypt.... i didn´t find anything in the net... so if somebody has an idea or solution for that, i would be happy...
thank you!
htclerman said:
hi, i want to reopen this issue because today i asked myself the same question.
i have tested several apps but most of them are not useable for a large number of files or folders.... what we really need is a secret partition and something like truecrypt.... i didn´t find anything in the net... so if somebody has an idea or solution for that, i would be happy...
thank you!
Click to expand...
Click to collapse
did you encounter anything using AES/Rijndael or at least Blowfish or Twofish algorithm? I need something to encrypt single files/folders only. TIA!
wizja said:
did you encounter anything using AES/Rijndael or at least Blowfish or Twofish algorithm? I npartitioneed something to encrypt single files/folders only. TIA!
Click to expand...
Click to collapse
Do you speak about apps?
If yes, there is nothing out there
I know that is working fast with a big number of files. There must be an option to encrypt a whole partition,
That's the only thing that would make sense.
Sent from my HTC Desire using XDA App
http://tasker.dinglisch.net/tour.html
Claims to support encryption, kind of complicated through.
htclerman said:
Do you speak about apps?
If yes, there is nothing out there
I know that is working fast with a big number of files. There must be an option to encrypt a whole partition,
That's the only thing that would make sense.
Sent from my HTC Desire using XDA App
Click to expand...
Click to collapse
With the ability to put apps on the SDCard this is going to be an unlikely feature to work well....
Your best bet is looking for something with a good remote wipe/lock feature.
If you have a partition formatted with ext2/3/4, it's only a matter of copying over static binaries of lvm, device-mapper and cryptsetup, and creating a script called via initrc or controlled via /etc/init.d
I've posted about a similar solution for /data. Search for it.
Push for implementating it in Android:
Using dm-crypt to Encrypt the SD Card...? - xda-developers
Using dm-crypt to Encrypt the SD Card...? - CyanogenMod Forum
Issue 11211 - android - Android too insecure - Encryption of the SDcard is crucial - Project Hosting on Google Code
Issue 3748 - android - Add support for partition/block device encryption - Project Hosting on Google Code
Is there any app that would do this? Ive been flashing my HTC 7 Pro few times now and the most annoying this is linking the accounts that are not autolinked because they are not spelled excactly the same.
If there is no solution someone with skill should have a look at this. It would be so great to back up the linked accounts just before flashing and then restore. Would save a huge ammount of time.
It's stored in the various PIM databases on the phone. We know where these DBs are, and we have the APIs to read them (though it requires elevated access, so a custom ROM, HtcRoot, or WP7 Root Tools 0.9). So far, though, nobody has written an app to back up the contents of the database from one phone image and restore them to another. That'll be a non-trivial task, since of course none of this stuff is documented. It should be possible with some work, though.
GoodDayToDie said:
It's stored in the various PIM databases on the phone. We know where these DBs are, and we have the APIs to read them (though it requires elevated access, so a custom ROM, HtcRoot, or WP7 Root Tools 0.9). So far, though, nobody has written an app to back up the contents of the database from one phone image and restore them to another. That'll be a non-trivial task, since of course none of this stuff is documented. It should be possible with some work, though.
Click to expand...
Click to collapse
Wasn't it rumoured that Microsoft's 'full back up' will include this feature somewhere around Apollo?
Would be great to have this so I really hope it comes...
This is something I have been wondering for a while and after searching the forums and Google I have not been able to find a clear answer. As a long time Linux user the idea of running your system as root all the time is appalling. It is a huge security risk. But for some reason that is really the only way to gain root access on an Android device (as far as i am aware). Apps like SuperSU allow you to pick the apps that are allowed to run as root, but there is no password or verification that the entity approving the access actually has the authority to do so. I hear all the time that rooting your phone is a trade-off between customizability and security, but every Linux system has a root user and it is incredibly secure when properly administered. What is the reason for the difference?
From what I have read, it sounds like part of the issue has to do with Android handling users differently. I would love to be able to maintain a more limited root function on my devices. Thanks.
funkbuqet said:
This is something I have been wondering for a while and after searching the forums and Google I have not been able to find a clear answer. As a long time Linux user the idea of running your system as root all the time is appalling. It is a huge security risk. But for some reason that is really the only way to gain root access on an Android device (as far as i am aware). Apps like SuperSU allow you to pick the apps that are allowed to run as root, but there is no password or verification that the entity approving the access actually has the authority to do so. I hear all the time that rooting your phone is a trade-off between customizability and security, but every Linux system has a root user and it is incredibly secure when properly administered. What is the reason for the difference?
From what I have read, it sounds like part of the issue has to do with Android handling users differently. I would love to be able to maintain a more limited root function on my devices. Thanks.
Click to expand...
Click to collapse
You can set a passcode with SuperSU....
Thanks for the reply. That is good to know. Does that really fill the security gap though? I guess if I set My non-background root permissions to expire every 15 minutes that does help for apps that do not need to run as root in the background.
I am more referring to the distinction between regular user land and the root user. Titanium Backup for example; If I want it to be able to run a full backup (including system apps and settings) of my phone every night I have to give it permanent root permissions. That root permission applies to both the automatic process and anything that I as a user (or any entity that can get control of TB) to act as root as well. Ideally there would be 2 separate instances of the program; the back-up process (a daemon perhaps) initiated by the root user and a second available in regular user space. This sort of thing is common on Linux systems.
My knowledge of Android is not particularly deep. I cannot tell if there is actually a separate root user or how user/group permissions work. It seems that the Android framework is designed around the user not having root access. Which is a bit confusing for an OS that prides itself on customization and "Be together not the same". I can't imagine buying a desktop PC that didn't allow me to have system level (root) access. Why should it be any different on a mobile device?