My S4 was stolen, I'm disappointed with Android Device Manager and Samsung FMM - Galaxy S 4 General

My S4 was stolen, I'm disappointed with Android Device Manager and Samsung FInd My Mobile.
No way I'm sure why can't find my S4 neither service can contact it, I assume they (the thief) do a hard reset and switched SIM card, no way I can confirm the wipe commands I Sent where achieved.
So I now changed every password

AcostaJA said:
My S4 was stolen, I'm disappointed with Android Device Manager and Samsung FInd My Mobile.
No way I'm sure why can't find my S4 neither service can contact it, I assume they (the thief) do a hard reset and switched SIM card, no way I can confirm the wipe commands I Sent where achieved.
So I now changed every password
Click to expand...
Click to collapse
That is sad to hear.
Thats why no company uses lockdown software. Now you are forced to buy new handset from them. Its only their win.
Only security they work on is to force no software changes by the buyer but not the thief.

Good sales point for iOS if I block an iPhone from iTunes acc, no way it can be reactivated w/o my account consent.

AcostaJA said:
My S4 was stolen, I'm disappointed with Android Device Manager and Samsung FInd My Mobile.
No way I'm sure why can't find my S4 neither service can contact it, I assume they (the thief) do a hard reset and switched SIM card, no way I can confirm the wipe commands I Sent where achieved.
So I now changed every password
Click to expand...
Click to collapse
or maybe u didnt activate it ...

AcostaJA said:
My S4 was stolen, I'm disappointed with Android Device Manager and Samsung FInd My Mobile.
No way I'm sure why can't find my S4 neither service can contact it, I assume they (the thief) do a hard reset and switched SIM card, no way I can confirm the wipe commands I Sent where achieved.
So I now changed every password
Click to expand...
Click to collapse
Rwgister a complaint with the police. IMEI tracking is possible.
My friend was mugged and the crook was caught a couple of months later using IMEI tracking.
Sent from my GT-I9500 using xda app-developers app

This feature relies on WiFi/Mobile data. May be the thief turned off the data.

Not sure about that. You can reset the phone with a sms. So I guess it doesn't rely on mobile data alone.
I don't know which features the op enabled, so everything is unclear. Maybe the thief just turned off the phone and waits until the owner gives up.

Is there any software capable of installing itself into /system and working after system reset in hidden mode?
+ taking photos with front cam (only if "stolen") and uploading them somewhere?
+ store those photos in /system (so no gallery can show those photos)
Or better - be installed right into bootloader/(and|or)kernel?

Yuna said:
Is there any software capable of installing itself into /system and working after system reset in hidden mode?
+ taking photos with front cam (only if "stolen") and uploading them somewhere?
+ store those photos in /system (so no gallery can show those photos)
Or better - be installed right into bootloader/(and|or)kernel?
Click to expand...
Click to collapse
Yes, cerberus.
Sent from my GT-I9500 using xda app-developers app

have you used an app called Android Lost, i like this one

If I take your phone and immediately remove the SIM card and immediately flash / wipe a new rom - no way to track it by the Samsung software... (by the way - even it is very easy to change the IMEI ). So, the only option is to send the SMS wipe command before the phone is reflashed
Sent from my GT-I9505 using XDA Premium 4 mobile app

Easy to change imei? Please, make proof-of-concept.
Can i change my IMEI to 1234567890123 or even 666666777777 in my sgs4 (i9500)

Yuna said:
Easy to change imei? Please, make proof-of-concept.
Can i change my IMEI to 1234567890123 or even 666666777777 in my sgs4 (i9500)
Click to expand...
Click to collapse
With root and Terminal Emulator you can change IMEI but I'm not sure that giving proof is a good thing to do on XDA!
BTW sorry OP... I don't care about Samsung or Google tools because after several tests I also deduced that they are useless.

Primokorn said:
With root and Terminal Emulator you cand change IMEI but I'm not sure that giving proof is a good thing to do on XDA!
BTW sorry OP... I don't care about Samsung or Google tools because after several tests I also deduced that they are useless.
Click to expand...
Click to collapse
Yes, ive seen mods take care of bussiness regarding this topic.
Sent from my GT-I9505 using xda app-developers app

Primokorn said:
With root and Terminal Emulator you can change IMEI but I'm not sure that giving proof is a good thing to do on XDA!
BTW sorry OP... I don't care about Samsung or Google tools because after several tests I also deduced that they are useless.
Click to expand...
Click to collapse
Device manager. Phone lost etc.
These are tools only for nsa tracking not for us to track.

+1 for Cerberus. This is a must have app for all Android owners
p.s. OP sorry to hear about your loss

gdonanthony said:
or maybe u didnt activate it ...
Click to expand...
Click to collapse
Point is if you do a hard reset everything gets wiped and the thief has a brand new phone to use. The user who lost it cant find it by imei via samsung.
I also wonder why we are not able to set a password in recovery mode (like a bios for pc would allow us).

I both registered , activated and tested Google ADM and Samsung FMM , I hoped both being similar to Apple's Activation Lock, but isn't its very easy for thieves to overcome just doing a hard reset thru boot loader.
Also the Imei at police I was informed that mafias have IMEI repair tools that in fact are service tools for repair centers but capables to change the Imei number, so is very possible my S4 now lies on a new box with new accessories and new imei and is being sell as an new s4 w/o complaints neither evidence was stolen.
Big issue here

Samsung's introducing consumer-centric features for Knox with the N3. It includes the abilitiy to prevent wiping the device. You can also hide your porn in a seperate secure container that only the phone owner has access to. The SGS4 h/w as it relates to Knox should be the same so hopefully the 4.3 update will push the functionality to the SGS4.
From the N3 press release...
The new GALAXY Note 3 comes with enhanced privacy and security protection provided by Samsung KNOX. Users can activate Samsung KNOX with ease which allows them to run and store security- sensitive applications and data inside a protected execution environment called “container.” The security inside the container is strengthened by system-level protection of Samsung KNOX against malware and phishing attacks as well as hacking attempts on physical devices when devices are stolen or lost. For instance, important personal pictures or video can be stored in the container with no worries for data leakage due to hacking. In addition, users may choose to store enterprise applications and data such as corporate email, contacts and calendar and allow the IT department to manage the container through EAS (Exchange ActiveSync Server). These features make the GALAXY Note 3 an ideal device for BYOD (Bring-Your-Own-Device to work)
Furthermore, the GALAXY Note 3 is equipped with an improved Find My Mobile feature that allows users to disable the phone when it is stolen or lost. With the enhanced user authentication, the technology prevents stolen mobile phones from being reset to factory settings, and allows users to remotely track or erase the data from their lost or stolen mobile phones.​

Any news on this regarding the S4? Does the new 4.3 firmware prevent hard-reseting the phone?

Related

[HELP] My mobile is hacked, Someone is remotely accessing my mobile.

Dear All,
I use Samsung Galaxy A8 SM-A800F with marshmallow 6.0.1 (Official).
My mobile is hacked. Someone is remotely accessing my mobile and making changes as per his will, hacker is able to access my device without mobile data/internet enabled.
I have observed following things -
- Hacker can track my keystrocks/screen touch
- He can access my whatsapp messages
- He is able to reply to my whatapp messages
- He is able to make folders in my mobile
- He is able to restart mobile
- He is able to enable/diable mobile data
- He can access my sms and can send me customized sms.
- He is able to do all above things without mobile data enabled
I am not sure whats going on with my mobile, is this some king of virus/malware which is allowing hacker to control my device ?
I have tried installing various antivirus.
I have tried factory reset / installing official firmware using odin but still hacker is able to control my device remotely.
Kindly advice me on how to fix this problem.
Best Regards,
Romob
Please advise
romob said:
Dear All,
I use Samsung Galaxy A8 SM-A800F with marshmallow 6.0.1 (Official).
My mobile is hacked. Someone is remotely accessing my mobile and making changes as per his will, hacker is able to access my device without mobile data/internet enabled.
I have observed following things -
- Hacker can track my keystrocks/screen touch
- He can access my whatsapp messages
- He is able to reply to my whatapp messages
- He is able to make folders in my mobile
- He is able to restart mobile
- He is able to enable/diable mobile data
- He can access my sms and can send me customized sms.
- He is able to do all above things without mobile data enabled
I am not sure whats going on with my mobile, is this some king of virus/malware which is allowing hacker to control my device ?
I have tried installing various antivirus.
I have tried factory reset / installing official firmware using odin but still hacker is able to control my device remotely.
Kindly advice me on how to fix this problem.
Best Regards,
Romob
Click to expand...
Click to collapse
are you sure its a hacker? as mobile apps can do all that if you give them permission. why are you sure its a hacker? why would someone hack you?
simms22 said:
are you sure its a hacker? as mobile apps can do all that if you give them permission. why are you sure its a hacker? why would someone hack you?
Click to expand...
Click to collapse
I am sure someone is doing mischief,
I have tried resetting my device, uninstalling apps etc. but issue still exist.
Any help would be greatly appreciated
Any help would be greatly appreciated
Please help
romob said:
Please help
Click to expand...
Click to collapse
have you tried a full wipe and installing a.cistom rom?
"err on the side of kindness"
it's too dangerous. List some apps and source you got apps from ( if you remember all of them)
Have you let somebody tease your phone?
This is not funny but funny as I'm dealing with the same thing, I believe it comes down to WiFi hack, or through tags or nfc or whatever I've done the same thing resetting, rooting, removing some files ex, I've revoked, froze ect.... not sure what do to my self. It have noticed when I hard reset and it unmounts a file. Still learning code so not tip top on what it says. If I can get maybe a list of exploits it would at least give me a place to start. I'm on an s7 Sept patch bone stock apps I have Google chrome,messages, phone,contacts.
You could write a book on what you possible need to do, depending on how your system was compromised.
As you can see them replying to your messages I'd bet it's one of your mates that has done something! Having access to your phone would make hacking it easier eg start with a remote control apps and then gain more access later.
I'm no expert but I think you did the right thing reinstalling your rom, but if it's coming back then they must be able to reinstall malware as they have your wifi password, network password, or it's on your sd card or a bad app that you have reinstalled and can gain root or something.
You need to change ALL your passwords that may enable access to your network or phone, incl work etc. ALSO update/reinstall or factory reset any modem/router/network firmware/pc you can as they may have opened some backdoor. But only have one thing on at a time as you fix it, else one might just compromise your network again. Make sure things like tv, printers etc have secure wifi settings (change ALL default passwords to your own strong ones)
Once all have been restored/factory reset with new passwords then you can turn them on again. (I would leave sd cards out and don't install all your apps yet, add them one at a time and only from Play store) also change passwords for all apps as they may still be able to gain access to them & check things like two factor authentication is set to use phone numbers you have set, not theirs.
I have to go now, though there are more possibilities, I've probably missed some things too, but hope I have given you some ideas. Good luck

Security Issues. a must see and read

Okay so ive been battling this for sometime. I'm starting to get a little more knowledgeable but still don't know what to do with all this.I experienced this first back in 2015 then I completely made a switch. Well now I'm back to same issues.
The problems I'm experiencing is it's happening on all the devices I have. The phone I'm on now bought brand new from metropcs. and not even a day 30minutes later I get an update for the phone. I new not to install or download. But it inventively did. Now it's sitting on my storage wanting me to move files to root.
LET ME MAKE THIS CLEAR. NON OF MY DEVICES ARE ROOTED.
to make this short. My devices seem to have a Bluetooth admin. And connects to any Bluetooth device without me knowing.
So far from what I see chromium and stage fright is a big part of what I'm seeing.
I'm attaching some pictures to give more detail look. And it's not just my Android devices it's my Xbox one S as well.
looking to completely remove. I'm not trying to waste money on switching networks or completly going Mia.
Fast responses please.
Sincerly,
-Desperate androidian
BLEEDCOLORYOU said:
Okay so ive been battling this for sometime. I'm starting to get a little more knowledgeable but still don't know what to do with all this.I experienced this first back in 2015 then I completely made a switch. Well now I'm back to same issues.
The problems I'm experiencing is it's happening on all the devices I have. The phone I'm on now bought brand new from metropcs. and not even a day 30minutes later I get an update for the phone. I new not to install or download. But it inventively did. Now it's sitting on my storage wanting me to move files to root.
LET ME MAKE THIS CLEAR. NON OF MY DEVICES ARE ROOTED.
to make this short. My devices seem to have a Bluetooth admin. And connects to any Bluetooth device without me knowing.
So far from what I see chromium and stage fright is a big part of what I'm seeing.
I'm attaching some pictures to give more detail look. And it's not just my Android devices it's my Xbox one S as well.
looking to completely remove. I'm not trying to waste money on switching networks or completly going Mia.
Fast responses please.
Sincerly,
-Desperate androidian
Click to expand...
Click to collapse
The Android community isn't what it used to be that's for sure. No help, no suggestions. Just nothing.
BLEEDCOLORYOU said:
Okay so ive been battling this for sometime. I'm starting to get a little more knowledgeable but still don't know what to do with all this.I experienced this first back in 2015 then I completely made a switch. Well now I'm back to same issues.
The problems I'm experiencing is it's happening on all the devices I have. The phone I'm on now bought brand new from metropcs. and not even a day 30minutes later I get an update for the phone. I new not to install or download. But it inventively did. Now it's sitting on my storage wanting me to move files to root.
LET ME MAKE THIS CLEAR. NON OF MY DEVICES ARE ROOTED.
to make this short. My devices seem to have a Bluetooth admin. And connects to any Bluetooth device without me knowing.
So far from what I see chromium and stage fright is a big part of what I'm seeing.
I'm attaching some pictures to give more detail look. And it's not just my Android devices it's my Xbox one S as well.
looking to completely remove. I'm not trying to waste money on switching networks or completly going Mia.
Fast responses please.
Sincerly,
-Desperate androidian
Click to expand...
Click to collapse
I'm no expert but I'm struggling to see your exact issue you seem to think you have, is it just t your Bluetooth is switching on. All those licences, security certs, file locations etc look normal to me (without checking numbers or being able to compare to same phone os etc) though I have disabled many of those certs eg the Turkish ones etc & my Bluetooth files are different but I can find ref hill those locations online eg Xieomi phones
You appear to have a ZTE, please give model number and current OS & rev (must be stock I suppose). ZTE was found with a backdoor in older phones, sending data to China, so it's possible, & some Chinese phones also update their apps without notification. But as you say your whole network appears compromised so the source may be something else, like your router/modem, or Bluetooth as you think (though some apps require Bluetooth admin permission legitimately, you can disable it as an Admin). Tell us what behaviors you are seeing that you believe are malicious. New phone update soon after you turn on is quite common, as I'm sure you know.
When I had a quick look at your log it did have a lot of activity going to the US DOD, would you expect this, as well as the usual google & Facebook connections. Though (perhaps) strangely also to a server from a small marketing company here in Australia, but I'm no expert even if I looked at your log line by line I wouldn't understand it all.
Ref his other post
https://forum.xda-developers.com/general/security/security-global-family-credientals-t3665851
Things to try. Run a reputable antivirus. Boot into safe mode, so only system apps run, is it still happening? Can you turn off anything that is listed as a device admin? Try run a root checker app. Even if it all comes back negative you may still have a problem as a port may already have been opened and malicious app self deleted or something. Use an app like Fing to see if any device you don't recognise are connected to your network.
You may be able to block some activity if it's not going through root with a firewall eg NetGuard no root firewall, start with everything blocked.
Above are just some general hints, without knowing specifics I can only suggest you backup any stuff you want to keep then factory reset everything & change ALL passwords to strong ones (no good just adding a number on the end of your old ones!), better still reflash all firmware (updates if available) to overwrite everything. This incl your internet access points eg router, and only reconnect to the net/networks after you have done them all (one at a time preferably then you may be able to identify source of problems)
That turned out a lot longer than I intended!
IronRoo said:
I'm no expert but I'm struggling to see your exact issue you seem to think you have, is it just t your Bluetooth is switching on. All those licences, security certs, file locations etc look normal to me (without checking numbers or being able to compare to same phone os etc) though I have disabled many of those certs eg the Turkish ones etc & my Bluetooth files are different but I can find ref hill those locations online eg Xieomi phones
You appear to have a ZTE, please give model number and current OS & rev (must be stock I suppose). ZTE was found with a backdoor in older phones, sending data to China, so it's possible, & some Chinese phones also update their apps without notification. But as you say your whole network appears compromised so the source may be something else, like your router/modem, or Bluetooth as you think (though some apps require Bluetooth admin permission legitimately, you can disable it as an Admin). Tell us what behaviors you are seeing that you believe are malicious. New phone update soon after you turn on is quite common, as I'm sure you know.
When I had a quick look at your log it did have a lot of activity going to the US DOD, would you expect this, as well as the usual google & Facebook connections. Though (perhaps) strangely also to a server from a small marketing company here in Australia, but I'm no expert even if I looked at your log line by line I wouldn't understand it all.
Things to try. Run a reputable antivirus. Boot into safe mode, so only system apps run, is it still happening? Can you turn off anything that is listed as a device admin? Try run a root checker app. Even if it all comes back negative you may still have a problem as a port may already have been opened and malicious app self deleted or something. Use an app like Fing to see if any device you don't recognise are connected to your network.
You may be able to block some activity if it's not going through root with a firewall eg NetGuard no root firewall, start with everything blocked.
Above are just some general hints, without knowing specifics I can only suggest you backup any stuff you want to keep then factory reset everything & change ALL passwords to strong ones (no good just adding a number on the end of your old ones!), better still reflash all firmware (updates if available) to overwrite everything. This incl your internet access points eg router, and only reconnect to the net/networks after you have done them all (one at a time preferably then you may be able to identify source of problems)
That turned out a lot longer than I intended!
Click to expand...
Click to collapse
Thank-you. Now for a better visual. There's to many apps.
And if u can give me links to apps that will help.
And on my oneplus one the Bluetooth thing says :1002 sharing or midi or something.
BLEEDCOLORYOU said:
Thank-you. Now for a better visual. There's to many apps.
And if u can give me links to apps that will help.
And on my oneplus one the Bluetooth thing says :1002 sharing or midi or something.
Click to expand...
Click to collapse
And code.auroa? What is this
BLEEDCOLORYOU said:
Thank-you. Now for a better visual. There's to many apps.
And if u can give me links to apps that will help.
And on my oneplus one the Bluetooth thing says :1002 sharing or midi or something.
Click to expand...
Click to collapse
I don't have that phone so can't really tell what is a suspect app or not, especially just from screen shots.
Here use this app to run on demand scans against the virustotal database (this is not an "antivirus app" like Avast so offers no protection, it only scans apps on demand, so you should run a good antivirus also)
https://play.google.com/store/apps/details?id=com.funnycat.virustotal
it should flag any suspect apps and you can submit any unknown ones you are worried about.
---------- Post added at 05:12 AM ---------- Previous post was at 05:02 AM ----------
BLEEDCOLORYOU said:
And code.auroa? What is this
Click to expand...
Click to collapse
edit: not Firefox then.
org.codeaurora.bluetooth is a legit part of Bluetooth .... Well unless it's flagged by virustotal then it probably is a malicious app just given a common name to try and hide
IronRoo said:
I don't have that phone so can't really tell what is a suspect app or not, especially just from screen shots.
Here use this app to run on demand scans against the virustotal database (this is not an "antivirus app" like Avast so offers no protection)
https://play.google.com/store/apps/details?id=com.funnycat.virustotal
it should flag any suspect apps and you can submit any unknown ones you are worried about.
Click to expand...
Click to collapse
Okay but what is provisioning? Code auroa smartcard services googleplay for instance apps and
And IV never encrypted this phone.
BLEEDCOLORYOU said:
Okay but what is provisioning? Code auroa smartcard services googleplay for instance apps and
And IV never encrypted this phone.
Click to expand...
Click to collapse
And alot of the overlay apps n simtoolkit are all questionmarked
BLEEDCOLORYOU said:
And alot of the overlay apps n simtoolkit are all questionmarked
Click to expand...
Click to collapse
ser my edit above re aurora
sometimes virustotal will have 2 or 3 antiivirus companies flag a file, these are probably false positives so probably nothing to worry about (though could just be a new submission, other companies should soon update if real malicious code, check back in a day or two). If lots of companies flag an apk then you haven a problem.
It looks like you have a problem whit overlays (unless it's an app your phone company installs for that function, not sure what you mean). You should install a proper antivirus app like Avast, malwarebytes etc as a first step, hopefully it can remove malicious apk
---------- Post added at 05:51 AM ---------- Previous post was at 05:37 AM ----------
BLEEDCOLORYOU said:
And IV never encrypted this phone.
Click to expand...
Click to collapse
Doesn't matter, encrypting phone only protects unauthorised access to your data. Once it is unlocked anyone can view your stuff. And once a malicious app is on your system it can shall read all your data even if you had encrypted it as it's unencrypted when you use it
IronRoo said:
ser my edit above re aurora
sometimes virustotal will have 2 or 3 antiivirus companies flag a file, these are probably false positives so probably nothing to worry about (though could just be a new submission, other companies should soon update if real malicious code, check back in a day or two). If lots of companies flag an apk then you haven a problem.
It looks like you have a problem whit overlays (unless it's an app your phone company installs for that function). You should install a proper antivirus app like Avast, malwarebytes etc as a first step, hopefully it can remove malicious apk
---------- Post added at 05:51 AM ---------- Previous post was at 05:37 AM ----------
Doesn't matter, encrypting phone only protects unauthorised access to your data. Once it is unlocked anyone can view your stuff. And once a malicious app is on your system it can shall read all your data even if you had encrypted it as it's unencrypted when you use it
Click to expand...
Click to collapse
Okay so now I'm trying to post screenshots of when I'm connected to wifi and it's not letting me
Pairwise cyphers and
Group cyphers
Sim_num
?
BLEEDCOLORYOU said:
And alot of the overlay apps n simtoolkit are all questionmarked
Click to expand...
Click to collapse
Tap those with question marks to submit to virustotal for analysis
IronRoo said:
Tap those with question marks to submit to virustotal for analysis
Click to expand...
Click to collapse
/sys/fs/selinux/class/appletalk_socket/perms
Not suspious?
BLEEDCOLORYOU said:
/sys/fs/selinux/class/appletalk_socket/perms
Not suspious?
Click to expand...
Click to collapse
Now I'm not stupid, this is facts. I just need defined and solution!!!
No these are normal library files. Stagefright "the malicious exploits" were called this as it was the stagefright framework it exploited. Everyone has these files, here are mine below.
You need to use tools like antivirus to identify bad files but even that is no guarantee as there is the possibility the original malicious file could have self deleted and, for example, just left open ports which would not be found as a "virus" but still allow remote access to your device.
If you cannot identify the actual exploit on your phone then the best solution is probably to just reflash the stock rom as this will wipe & overwrite everything. But if a malicious file is left on your SD card or another networked device you could soon be infected/compromised again. That is why I said before if you can't identify the source of your infection you really need to factory reset or reinstall all OS on all devices affected including your home router etc (or maybe it's your work or public network) and change all passwords.
IronRoo said:
No these are normal library files. Stagefright "the malicious exploits" were called this as it was the stagefright framework it exploited. Everyone has these files, here are mine below.
You need to use tools like antivirus to identify bad files but even that is no guarantee as there is the possibility the original malicious file could have self deleted and, for example, just left open ports which would not be found as a "virus" but still allow remote access to your device.
If you cannot identify the actual exploit on your phone then the best solution is probably to just reflash the stock rom as this will wipe & overwrite everything. But if a malicious file is left on your SD card or another networked device you could soon be infected/compromised again. That is why I said before if you can't identify the source of your infection you really need to factory reset or reinstall all OS on all devices affected including your home router etc (or maybe it's your work or public network) and change all passwords.
Click to expand...
Click to collapse
I'm on a video bridge network I got the direct TV setup with 2 wireless setups. Both secure from what I know.
BLEEDCOLORYOU said:
Pairwise cyphers and
Group cyphers
Sim_num
?
Click to expand...
Click to collapse
These are for encryption of your connection, not your phone
BLEEDCOLORYOU said:
I'm on a video bridge network I got the direct TV setup with 2 wireless setups. Both secure from what I know.
Click to expand...
Click to collapse
I'm no coding/security guru, but I have worked on telecoms, military electronics, etc but my coding & network security knowledge is limited.
I would run this app Fing to check your local network, are there any unknown devices connected?
https://play.google.com/store/apps/details?id=com.overlook.android.fing
note: this only finds currently connected devices, so you'd want to do this several times & especially when you see suspect behavior.
Also check for open ports, easiest way is probably this site, it will scan the first 1000 ports or so (select all)
https://www.grc.com/
go to shields up
but you really need to scan ALL possible ports with a tool like Zenmap (for PC) if you think you are compromised
https://nmap.org/zenmap/
However it's not clear to me if you ever installed a proper antivirus and whether it found and deleted anything? Virustotal seemed to find some suspect apks, I had a quick look at Trendmicro database but it didn't list details of the one it found in your screenshot, but the fact some of those antivirus companies called the suspect apk names with "joke" in it may suggest it's just a joke app your mate has installed, though probably not a joke app if your other devices are really also compromised, from memory there is also real malware with that name which may be able to infect other devices. Running a proper antivirus should easily find and clean any "joke" app on your phone & hopefully any real malware. If you've done this and still seeing indications you are compromised then do what I suggested above. (Also repeat malware checks on other devices and removable storage media)
You should also log into your router as admin and check settings, are you using a secure router password? Is firmware up to date. Is firewall set up correctly? Also close any open ports that you don't use. Turn off remote admin, if router has it. Etc etc what do your router logs show (turn on more detailed logging if necessary) Factory reset or reinstall firmware if you think changes have been made to your router by someone else.
Hi I am having same issues. Exact same behaviors regardless of new phones new carrier and all accounts being unconnected in name. Google etc. This is extreme. Its via bluetooth I agree something with esims or virtual sims for use of wifi access and or signal piracy for media. The DOD files are also something I am familier with seeing. Code Aurora was also a govt project way back. Its Interesting thst I have Verizon files loading on at & t phones and sprint loading on Verizon. Whatever this is has managed to infiltrate my computers as well. Its relentless. Its impressive and sophisticated. Please please help.
Spidder77 said:
Hi I am having same issues. Exact same behaviors regardless of new phones new carrier and all accounts being unconnected in name. Google etc. This is extreme. Its via bluetooth I agree something with esims or virtual sims for use of wifi access and or signal piracy for media. The DOD files are also something I am familier with seeing. Code Aurora was also a govt project way back. Its Interesting thst I have Verizon files loading on at & t phones and sprint loading on Verizon. Whatever this is has managed to infiltrate my computers as well. Its relentless. Its impressive and sophisticated. Please please help.
Click to expand...
Click to collapse
I'm having the same issmy ues. Did anyone ever resolve or figure out what is happening? I think I'm under investigation by the DOD and they own my devices. My uploads/downloads are blocked, internet searches filtered, pics/screenshots of evidence deleted off my phone, etc.

Knox customization Configurator Galaxy S7 How delete?

Good day.
Sorry for my english.
I bought Galaxy S7 in Moscow, Russia. When i enable and configure the device appears samsung Knox Customization, then changing the system language and inaccessible to some important for me features like developer mode (I go there from app), USB Debuging. In apps i have KCC Agent and Knox Enrolment Service.
I don't know what it is and how to deactivate this? Please help
Customer Support Samsung is silent for a week.
PS I dont want to ROOT my phone.
Use a Package Disabler
*Detection* said:
Use a Package Disabler
Click to expand...
Click to collapse
I turn off this apps in package disabler, but they are still working.
Max_Deor said:
I turn off this apps in package disabler, but they are still working.
Click to expand...
Click to collapse
Rebooted after disabling them?
*Detection* said:
Rebooted after disabling them?
Click to expand...
Click to collapse
Yes.
Dealing with this problem for more than a week and can't win. On the Internet I learned that my phone is most likely tied in Knox B2B service by IMEI or serial number and as soon as a device enters the network it arrives the Knox customization Configurator. Times the Samsung tech support is silent, it would be a simple solution to change IMEI and check, but as far as I know it's impossible. To Root not want. Is it possible after a reset and the device settings, before you get the Knox customization Configurator, to manage to disable Internet and block the address from which the flies setting. But how to learn and how to block these addresses?
SAMSUNG OFFICIAL INFO:
QUOTE:
Knox Customization Configurator
How can end users remove a Custom Configurator profile from their devices?
End users should contact the IT admin listed on the Support section of their device profile. The IT admin can delete the device and the associated Device ID from the Custom Configurator server. Finally, the end user must factory reset the device to remove the Custom Configurator profile. All other device data will also be deleted.
END OF QUOTE.
So, until they delete it from the server, or you root the device, there is no way to disable that.
officialdjalin said:
SAMSUNG OFFICIAL INFO:
QUOTE:
Knox Customization Configurator
How can end users remove a Custom Configurator profile from their devices?
End users should contact the IT admin listed on the Support section of their device profile. The IT admin can delete the device and the associated Device ID from the Custom Configurator server. Finally, the end user must factory reset the device to remove the Custom Configurator profile. All other device data will also be deleted.
END OF QUOTE.
So, until they delete it from the server, or you root the device, there is no way to disable that.
Click to expand...
Click to collapse
Thanks.
Try to speak samsung knox support
You're welcome.
Let us know if they resolved your issue.
officialdjalin said:
You're welcome.
Let us know if they resolved your issue.
Click to expand...
Click to collapse
Good afternoon. I led communication with SEAP Samsung. First, they advised me to contact the Samsung branch in my country, then said that if on my phone there are such things, then they can remove the system administrator. I said I bought the phone and don't know the administrator and asked to tell me the contacts of the administrator. They asked me my IMEI to check in the database and a week do not answer.
I live and bought the device in Russia (I have documents), but the phone is not for Russia - it is a normal practice with us.
Technical support in Russia said that the IMEI of the phone is for sale in the Netherlands.
In Russia it is cheaper to buy a phone for sales in other countries (winning about 30% of the cost)
Next time severely thinking about buying a Samsung phone as having official documents for the purchase of phone (albeit made for another country) you will not get any support.
For information - when I had an LG phone, bought in Europe. Technical support in Russia assisted me and repaired free of charge phone service under warranty.

Please help! Willing to pay. Coworker installed spy software on my phone.

Hello
I'm running a Pixel 2 XL on Android Oreo. One of my co-workers installed some kind of spy software and I already wiped my phone. Is there any way I can get some kind of proof of this back?! File recovery??
The software allowed them to see what websites were being accessed.
Any help would be appreciated. I am willing to offer money
Thanks
after a factory reset, the app should have been removed already. i had installed spy app ikeymonitor on my kids' phone before. just wipe the phone and it will be deleted.
Pcwpg said:
Hello
I'm running a Pixel 2 XL on Android Oreo. One of my co-workers installed some kind of spy software and I already wiped my phone. Is there any way I can get some kind of proof of this back?! File recovery??
The software allowed them to see what websites were being accessed.
Any help would be appreciated. I am willing to offer money
Thanks
Click to expand...
Click to collapse
No, you won't be able to get anything left except any remnants that may be in a cloud backup (web history?).
It's hard enough to recover any information from a non-encrypted phone after reset. Virtually impossible with a modern encrypted phone as far as the Userdata partition is concerned. .
Pcwpg said:
Hello
I'm running a Pixel 2 XL on Android Oreo. One of my co-workers installed some kind of spy software and I already wiped my phone. Is there any way I can get some kind of proof of this back?! File recovery??
The software allowed them to see what websites were being accessed.
Any help would be appreciated. I am willing to offer money
Thanks
Click to expand...
Click to collapse
Are you sure they installed an app? If they just saw your viewing history websites you have visited they may just have looked at company web logs or even just your browsing history on your device. Is there any indication they could read your messages etc? Does this person have any authority to do this? In most countries I think it's legal for companies to access your browsing history on company devices or if using company access points or even in some countries if it's during working hours on a personal device.
Probably not by data recovery etc... but if he is bragging about it,
how about trying to record your conversation... ??
You probably had your Google account open somewhere and they got in.
Go to your google settings and pause web history, search history and others.
I'm sure there is a way you can sign out of all devices remotely

Kid's first phone to turn off internet connectivity (mobile & Wi-Fi) : Mod old Verizon Galaxy S5 or Gabb Wireless?

Experienced heartbreak in purchasing slider & flip phones off of eBay, which worked for seller only days before, but then learning that Verizon will not activate any new lines for 3G, slider, flip, CDMA devices. This has always been a great way to give kids a first phone, a phone that will only do call & text. So, turned to old family inventory or new companies that specialize in a modern phone with internet or social media interaction. Enter Gabb Wireless or Pinwheel. Landed on Gabb Wireless, but my bride wants me to try to mod an old Verizon bone stock Galaxy S5. Of course...& I'm sure many of you have been there...some guy we know was able to do it with his kid's phone...so now I should be able to do it. Never mind this guy is a software dev and most likely using an iOS phone. So, gauntlet thrown down, challenge issued. I've been doing a lot of digging & don't know if this can be done with this build. Here's what we have:
G900V, bone stock Verizon
Build number = MMB29M.G900VVRU2DQL1
Security patch level = 8/1/17
Let me know if any other specs would be helpful.
Thank you kindly.
EternalWorth said:
Experienced heartbreak in purchasing slider & flip phones off of eBay, which worked for seller only days before, but then learning that Verizon will not activate any new lines for 3G, slider, flip, CDMA devices. This has always been a great way to give kids a first phone, a phone that will only do call & text. So, turned to old family inventory or new companies that specialize in a modern phone with internet or social media interaction. Enter Gabb Wireless or Pinwheel. Landed on Gabb Wireless, but my bride wants me to try to mod an old Verizon bone stock Galaxy S5. Of course...& I'm sure many of you have been there...some guy we know was able to do it with his kid's phone...so now I should be able to do it. Never mind this guy is a software dev and most likely using an iOS phone. So, gauntlet thrown down, challenge issued. I've been doing a lot of digging & don't know if this can be done with this build. Here's what we have:
G900V, bone stock Verizon
Build number = MMB29M.G900VVRU2DQL1
Security patch level = 8/1/17
Let me know if any other specs would be helpful.
Thank you kindly.
Click to expand...
Click to collapse
Not sure why you don't just go buy a burner flip phone from Walmart? I thought those could still be activated.
If not, you'd have to disable the portion of the kernel that handles data. Let's be honest, this is a ~10 year old device so you won't find much assistance unfortunately.
Oh yeah, forgot, this is Android 6.0.1.
As for the query, you're right...I could do the burner/fip/slider thing, perhaps...but, truly, it appears all carriers across the board are throwing off 3G devices as fast as they can. I did see some of the rough service basic phones have 4G capability, but can't justify price on those things. Tough balance to strike as we're doing some traveling where VZW is the only network that's really reliable...& trying to get a child the best camera possible on the devices we have, so they can take pics of stuff they may never see again. Old basic phones are pretty challenging to text on, too. Anyway, we have an old iPod Touch someone threw away, plus the S5. S5 has the better cameras. But it's one of the last builds they sold for Verizon...and I don't ever remember there being a way to unlock the bootloader on that build...the G900V. But, regardless, I still can't find a way to shut down mobile & Wi-Fi on it. I think they have a Verizon family app that will let you shut down the web, but it is extra per month, of course. Appreciate the feedback, for sure. This is just the DIY kinda life, I reckon: constantly trying to refurb, reuse the old stuff, fix stuff yourself, do without...all to live w/in your means & save dinero.
EternalWorth said:
Oh yeah, forgot, this is Android 6.0.1.
As for the query, you're right...I could do the burner/fip/slider thing, perhaps...but, truly, it appears all carriers across the board are throwing off 3G devices as fast as they can. I did see some of the rough service basic phones have 4G capability, but can't justify price on those things. Tough balance to strike as we're doing some traveling where VZW is the only network that's really reliable...& trying to get a child the best camera possible on the devices we have, so they can take pics of stuff they may never see again. Old basic phones are pretty challenging to text on, too. Anyway, we have an old iPod Touch someone threw away, plus the S5. S5 has the better cameras. But it's one of the last builds they sold for Verizon...and I don't ever remember there being a way to unlock the bootloader on that build...the G900V. But, regardless, I still can't find a way to shut down mobile & Wi-Fi on it. I think they have a Verizon family app that will let you shut down the web, but it is extra per month, of course. Appreciate the feedback, for sure. This is just the DIY kinda life, I reckon: constantly trying to refurb, reuse the old stuff, fix stuff yourself, do without...all to live w/in your means & save dinero.
Click to expand...
Click to collapse
I mean there is a way to unlock the bootloader if you look on XDA. https://forum.xda-developers.com/t/...ootloader-using-dev-bootloader-kk-mm.3337909/ The Verizon S5 was the worst model out of all of the US carrier variants.
EternalWorth said:
This has always been a great way to give kids a first phone, a phone that will only do call & text. So, turned to old family inventory or new companies that specialize in a modern phone with internet or social media interaction. Enter Gabb Wireless or Pinwheel. Landed on Gabb Wireless, but my bride wants me to try to mod an old Verizon bone stock Galaxy S5.
Click to expand...
Click to collapse
I know this thread is almost a year old, and I'm sorry I'm late to the party, but I had the same idea!
My kids had been using Gabb Wireless for a while, and we were mostly happy with the service, but I wanted the option to install other useful apps on their phones without giving them access to the web. So, I bought a couple of old Galaxy S5 SM-G900V (Verizon version) phones, and I think I've succeeded in modifying them in a way that will prevent the kids from surfing the internet or installing their own apps. I thought I'd post my method here, in case anyone is still interested. Here's what I did:
Install Safestrap Recovery. (Follow this guide, up to and including the step where you install Safestrap. Skip the remaining steps in the guide.)
Boot into Safestrap Recovery and flash jrkruse's “slightly de-bloated” stock Marshmallow rom from here.
Use either ADB or Safestrap to remove any system apps that would allow kids to browse the web or download their own apps. (To delete unwanted system apps using Safestrap recovery, click Mount and make sure the system partition is mounted. Also make sure the “Mount system partition read-only” box is unchecked. Then go back and click Advanced > File Manager, and edit or remove system files as desired.) The web browser is already removed from jrkruse's rom, but I also removed the following apps:
from /system/app:
Gmail2
SamsungSetupWizard
SecEmail_K
InteractiveTutorial [This is the Samsung Help app.]
SamsungAppsWidget_Phone_Carrier_VZW
from /system/priv-app:
Velvet [this is the Google search app]
SamsungUpdates [this includes the Samsung Apps store and “Galaxy essentials,” which would allow kids to download and install their own apps]
GoogleOneTimeInitializer
SetupWizard
from /data/app:
com.android.vending-1 [this is the Google Play Store]
Edit the settings APK file to disable the option to remove the option to install apps from “uknown sources” (Settings > Security > Uknown Sources) so that users can’t enable that option. This will prevent kids from installing apps by sideloading (e.g. copying apps from a friend's phone via SD card.) Apps can still be installed via recovery or ADB, but most kids won't know how to do that.
To edit the settings APK properly, you could follow this guide, but I used a much hackier method and basically just sabotaged the security_settings_misc.xml file inside SecSettings.apk, so that the settings app crashes if the user tries to open and modify those settings.
I've attached my modified settings file. You can put it on the phone's SD card, then use Safestrap to copy it to system/priv-app/SecSettings. Save the original settings file first (or just rename it and change the filename extension) so that you can restore it later if needed.

Categories

Resources