K9mail / Kaiten security issue - tracking - Security Discussion

In actual German magazine c't 22/2013 an interesting article was published about tracking and security issues of mail apps:
http://www.heise.de/ct/13/22/links/130.shtml
A link to a test tool was published:
https://emailprivacytester.com/
This tool shows an issue in K9 / Kaiten, tracking by Audio tag was possible over all versions:
Code:
Test - Audio tag
In the <body> of the HTML part, place a tag as follows:
<audio src="http://TRACKING_URL/" preload="metadata" autoplay="autoplay"></audio>
Is it known?
Is there a way to avoid this behaviour?
Thx...

Well, 3-4 days ago I emailed K-9, Kaiten, and [email protected] Mail about this. Only [email protected] Mail has responded so far with:
I'm aware of these issues (there's more than just the audio tag problem).
I do have plans to offer some privacy/security settings that would allow to block certain tags in a html mail. Unfortunately my to do list grows by the day and I can't give you a release date.
Click to expand...
Click to collapse
The other two are silent currently.

Related

Gmail app - hack to get notifications for 'skip inbox / filter mail'?

Hello.
I have filters for my mail, to skip the inbox and go into a filtered folder. The problem with this is that you do not get notified for any email filtered to skip the inbox and go into another folder.
I've talked with the author of the Gmail Notifier app, and he's identified that the issue is that the Gmail app does NOT give any notifications whatsoever for mail that is set to skip the Inbox.
If anyone has any solutions to this issue, it would be greatly appreciated! I'm sending the link to Jonas, the author of the Gmail Notifier app, in hopes that he can collaborate with people willing to look at this issue.
Here is an excerpt of the conversation:
Here is the reason to this limitation expressed in Android lingo if you are interested
The gmail sync service just sends broadcasts for mail in the inbox as can be seen in its manifest [AndroidManifest.xml file in Gmail.apk]. Here is that pesky ^i label.
Click to expand...
Click to collapse
Code:
<action
android:name="android.intent.action.PROVIDER_CHANGED"
android:priority="-10"
>
</action>
<data
android:mimeType="*/*"
android:scheme="content"
android:host="gmail-ls"
android:path="/unread/^i"
>
</data>
I guess that it could be hacked/replaced. Then one could resign and push the Gmail.apk back to the phone (root would be required since it's a system app). This attribute only controls which broadcasted messages that will be received. It the syncing service doesn't send broadcasts for other labels it won't suffice to listen for them.
The easiest way to test this would be to write a modified broadcast receiver in an own app and see if it's triggered. If not there is no point in hacking the Gmail app.
Click to expand...
Click to collapse
did you ever find a solution for this?
XlAfbk said:
did you ever find a solution for this?
Click to expand...
Click to collapse
No, I just stopped using the automatic archive option. It tags incoming mail as their label plus the Inbox. So I still get notifications and then after viewing an email, I hit the archive button manually.

[APP][2.1+][v.1.5.3]Corporate Contacts

Glad to present my latest app: Corporate Contacts
I was surprised to find out that Android actually internally supports much more options, that the Contact app works with. Groups are one example - that is usually the
"Category" when syncing with MS Outlook. So, I made an app that exploits the underlying system a bit more. Check out the app, and the video below, for an introduction. Updates are to come...
NOTIFICATION: I am giving away some registration keys for the app, which unlock the full functionality, and remove the ads. Write me a message if you're interested!
Latest version: 1.5.3
https://market.android.com/details?id=eir.corporate.free
Contacts management application, providing the essential address-book management that Android lacks.
Group SMS and e-mail sending, group editing of contacts.
See the introductory video for a demonstration of app's highlights: www.youtube.com/watch?v=yFWiCEsmAy4
The free version is ad-supported and has several limitations. For the full version, without ads and limitation check: https://market.android.com/details?id=eir.corporate
Key features:
* Organize contacts in groups.
* Browse the address book by groups, organizations, positions and locations.
* Context filters by an additional criteria.
* Contextual search.
* Group SMS and E-mail sending, using templates to add a personal touch to the messages.
* Fine-grain selection of addresses and phone numbers when sending group SMS and E-mail.
* Twelve nice skins.
Translation takes place at: http://www.getlocalization.com/corporate_contacts/
Support forum: http://eir3.com/forum/viewforum.php?f=6
Just to let you know, if anyone was following, that the bug on ICS is fixed.
This place comes handy to present some new features. Introducing the patriotic themes for both Corporate Contacts and Fast Dialer.

[Source code] WhatsAPI: WhatsApp for other platforms.

https://github.com/venomous0x/WhatsAPI
What is WhatsApp?
According to the company:
“WhatsApp Messenger is a cross-platform mobile messenger that replaces SMS and works through the existing internet data plan of your device. WhatsApp is available for iPhone, BlackBerry, Android, Windows Phone, Nokia Symbian60 & S40 phones. Because WhatsApp Messenger uses the same internet data plan that you use for email and web browsing, there is no cost to message and stay in touch with your friends.”
Click to expand...
Click to collapse
Late 2011 numbers: 1 billion messages per day, ~20 million users.
Modified XMPP
WhatsApp uses some sort of customized XMPP server, named internally as FunXMPP, which is basically some extended proprietary version.
Login procedure
Much like XMPP, WhatsApp uses JID (jabber id) and password to successfully login to the service. The password is hashed and happened to be an MD5’d, reversed-version of the mobile’s IMEI (International Mobile Equipment Identity) or equivalent unique ID, stored in servers upon account creation and used transparently everytime the client connects the server.
The JID is a concatenation between your country’s code and mobile number.
Initial login uses Digest Access Authentication.
Message sending
Messages are basically sent as TCP packets, following WhatsApp’s own format (unlike what’s defined in XMPP RFCs).
Despite the usage of SSL-like communication, messages are being sent in plain-text format.
Multimedia Message sending
Photos, Videos and Audio files shared with WhatsApp contacts are HTTP-uploaded to a server before being sent to the recipient(s) along with Base64 thumbnail of media file (if applicable) along with the generated HTTP link as the message body.
FAQ
What’s with the hex chars floating all over the code?
Mostly WhatsApp’s proprietary control chars/commands, or formatted data according to their server’s specifications, stored in predefined dictionaries within the clients.
What’s your future development plans?
We don’t have any.
Would it run over the web?
We’ve tested a slightly-modified version on top of Tornado Web Server and worked like a charm, however, building a chat client is a bit tricky, do your research.
Can I receive chats?
Indeed, using the same socket-receiving mechanism. But you have to parse the incoming data. Parsing functions aren’t included in this release, maybe in the next one?
I think the code is messy.
It’s working.
How can I obtain my password?
It depends on your platform, with Android for example, you can use TelephonyManager
Code:
TelephonyManager tm = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
tm.getDeviceId();
With the sufficent permissions of course
Code:
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>
NOTES
This proof of concept is extensible to contain every feature that make a fully-fledged client, similar to the official ones, actually could be even better.
During the two weeks of analysis of service mechanisms, we stumbled upon serious design and security flaws (they fixed some of them since 2011). For a company with such massive user base, we expected better practises and engineering.
Perfectly working as PHP and JAVA ports.
License
MIT - refer to the source code for the extra line.
Venomous
Team of Bahraini Developers.
Ahmed Moh'd and Ali Hubail (@hubail) contributed to this release.
I really would like to know whats your debugging strategy in this case? I'm still not able to capture the traffic from my Android 4 VirtualMachine in order to decypher the ssl traffic.
I documented my setup on my blog, just search for "WhatsApp für Android 4.0.X-X86 ICS auf VirtualBox" on Google.
Could you please provide some infos on your setup?
Except for some requests ( Syncing and Status update) , all requests go on plain text ( although they use SSL port , they still send in plain text )
onnsoft said:
I really would like to know whats your debugging strategy in this case? I'm still not able to capture the traffic from my Android 4 VirtualMachine in order to decypher the ssl traffic.
I documented my setup on my blog, just search for "WhatsApp für Android 4.0.X-X86 ICS auf VirtualBox" on Google.
Could you please provide some infos on your setup?
Click to expand...
Click to collapse
WebOS port!!!
Sent from my R800x using XDA
Looks like Whatsapp is quite secure...
Swypesation
Isn't there anyway to hack it???
Sent from my MT11i using xda premium
google it

[Q] Looking for Android email client with rules and notifications

I am receiving dozens emails daily from different automated processes. I hate having to check my mail every X minutes and scroll through the list of all messages (I currently use K9 mail).
What I am looking for is email application (paid is fine) that can do this:
1) If email has high priority play sound I select (possibly until I manually acknowledge alarm)
2) If subject or body contain specific sub-string play sound I select (possibly until I manually acknowledge alarm)
Does anyone know of Android email client compatible with CM 7.1 that can do that?
JoeSchmoe007 said:
I am receiving dozens emails daily from different automated processes. I hate having to check my mail every X minutes and scroll through the list of all messages (I currently use K9 mail).
What I am looking for is email application (paid is fine) that can do this:
1) If email has high priority play sound I select (possibly until I manually acknowledge alarm)
2) If subject or body contain specific sub-string play sound I select (possibly until I manually acknowledge alarm)
Does anyone know of Android email client compatible with CM 7.1 that can do that?
Click to expand...
Click to collapse
Check out maildroid
https://play.google.com/store/apps/details?id=com.maildroid&hl=en
has all the features you want..
pratik_193 said:
Check out maildroid
https://play.google.com/store/apps/details?id=com.maildroid&hl=en
has all the features you want..
Click to expand...
Click to collapse
Thanks, I've been using it since July 2013. Exactly what I was looking for. Worth every $.

[APP][SMS][4.0+]SMS Parser - prepare any SMS message!

[APP][SMS][5.1+] Clever SMS - your clever SMS client (ex SMS Parser)
General info:
Clever SMS is your clever assistant app to work on SMS and USSD requests
Current version: 1.3.0
Features:
Send SMS, get them and pull the most important information out of them. Work with bank and client accounts of mobile operators, customize your requests and put your own melody on them - all this and other additional features of the Clever SMS app will help you to optimize your time and quickly get the necessary data from SMS. Using Clever SMS extensions, you can track your SMS and USSD requests, receive information about bank balances, money spent, the balance of your mobile or Internet account.
Clever SMS Parser Extension - performs the parser function:
• Analyzes and extracts useful information from your bank’s SMS: check the balance, keep track of expenses or receipts of money, set up a convenient reporting schedule.
• Work with USSD: with Clever SMS Parser Extension you will always know how many minutes, money or gigabytes are left in your tariff package.
• Monitors notifications from smart devices around you, from car alarms to smart home alerts: all your gadgets that can send alerts will be under your control.
You can also customize the application to your preferences and sense of humor: set funny tunes to change bank balance and change the text of notifications for funny phrases, make bright widgets or connect extensions and coordinate Clever SMS with your Zooper, Kustom, DashClock.
Do you like to control income and expenses? Clever SMS Parser Extension will provide you with a full account of how much you have spent or received and the analysis of this data. And at the same time everything is strictly confidential: the application does not use Internet access, and your information will be known only to two people - you and your SMS client.
Site with help and instructions: clever-sms.com.ua
USSD support: clever-sms.com.ua/support/ussd
Clever SMS v 1.3.0: View attachment CleverSMS-1.3.0.apk or Google Play
Clever SMS Parser Extension Lite v 1.0.1 (USSD Android 8+): View attachment Parser-lite-1.0.1.apk or Google Play
Clever SMS Parser Extension Pro v 1.0.1 (USSD Android 5.1+): View attachment Parser-pro-1.0.1.apk
Clever SMS DashClock Extension v 1.0.1: View attachment DashClock-1.0.1.apk or Google Play
Clever SMS Kustom Extension v 1.0.1: View attachment Kustom-1.0.1.apk or Google Play
Clever SMS Tasker Extension v 11.0.1: View attachment Tasker-1.0.1.apk or Google Play
Clever SMS Zooper Extension v 1.0.1: View attachment Zooper-1.0.1.apk or Google Play
Clever SMS Catalog Extension v 1.0.1: View attachment Catalog-1.0.1.apk or Google Play
Clever SMS Donation v 1.0.0: Google Play
Common guys, say something.
Version 2.0.1:
1. New setting "Alternative widget" to solve problem with widget background transparency.
2. Small UI fixex fon Android 2.x
This is awesome, tried to make my own parser with tasker ( for my remaining sms, minutes and MB ), did something and was good enough but not so advanced. Would be nice if you can include a tasker plugin and pass resulted vars there, so we can integrate this with Zooper ( create our own widgets? ). Thank you and keep up the good work.
EDIT: Here is a quick work for my credit balance
AlkaDragos said:
This is awesome, tried to make my own parser with tasker ( for my remaining sms, minutes and MB ), did something and was good enough but not so advanced. Would be nice if you can include a tasker plugin and pass resulted vars there, so we can integrate this with Zooper ( create our own widgets? ). Thank you and keep up the good work.
Click to expand...
Click to collapse
Thank you for the first answer in this thread
Yes? I have plans about Tasker and Zooper, but I have so little time to do this. But I hope I can do it in this year
Hagakurje said:
Thank you for the first answer in this thread
Yes? I have plans about Tasker and Zooper, but I have so little time to do this. But I hope I can do it in this year
Click to expand...
Click to collapse
This year? oh well, i hope you can do it asap, but it's up to your free time ofc. Posted a pic above too
AlkaDragos said:
This year? oh well, i hope you can do it asap, but it's up to your free time ofc. Posted a pic above too
Click to expand...
Click to collapse
I read some info about zooper, and I can add zooper support in the next version. But it will be in paid version only. So not year, maybe 1 month
AlkaDragos said:
Would be nice if you can include a tasker plugin and pass resulted vars there, so we can integrate this with Zooper
Click to expand...
Click to collapse
+1
Hagakurje said:
But it will be in paid version only.
Click to expand...
Click to collapse
Ready to pay for such a feature but not until I'm sure it works flawless
Zooper will be in the next version, Tasker don't know when. Can you say, what exactly you want to do whith Tasker and SMS Parser?
Hagakurje said:
Zooper will be in the next version, Tasker don't know when. Can you say, what exactly you want to do whith Tasker and SMS Parser?
Click to expand...
Click to collapse
I suggested Tasker integration so i can use it with Zooper, but if you integrate Zooper support directly it's perfect.
AlkaDragos said:
I suggested Tasker integration so i can use it with Zooper, but if you integrate Zooper support directly it's perfect.
Click to expand...
Click to collapse
Yes, I will integrate Zooper support directly. Just wait 2-3 weeks and enjoy
New version 2.1.0 beta1:
Variables - is a number which is calculated by formula. You can use variables for some statistics.
Tasks - is a task which is triggered in selected time and date. Available actions for task: send query and clear variable..
Parser history - variables history added.
Parser history - export history to Excel ($).
Parser history - copy to clipboard from history ($).
Zooper - variables for Zooper Widget ($).
Color popup updated.
($) - in paid version only.
How to test beta version:
Install version 2.0.2 from market
Join Google + Community
Open link for paid version or for free version
New beta version 2.1.0 beta2.
What's new - in variable formula you can use any other variables.
Problem: Calculate the difference "previous balance" - "balance."
Solution:
Creating group "Balance."
Create variable "Difference", formula "[Previous balance] - {Balance}"
Create variable "Previous Balance", formula "{Balance}"
What happens:
1. sms arrives, calculate the group "Balance".
2. calculated variable "Difference", while the variable "Previous Balance" has not recalculated, ie in her previous value balance.
3. recalculated variable "Previous Balance".
New beta version 2.1.0 beta3.
What's new:
1. Update UI.
2. Now you can rename Zooper variables.
Final version 2.1.0 released
Vesion 2.1.1:
Small fixes.
Vesion 2.1.2:
Small fixes.
liked your new UI
Version 2.1.3:
Small UI fixes.

Categories

Resources