Researchers warn over OTA Exploits of Baseband Processors (radio firmware)

Researchers warn over OTA Exploits of Baseband Processors (radio firmware) - Security Discussion

Thom Holwerda at Real-Time Embedded OS specialized website OSnews reports about vulnerabilities that lurk in closed-sourced radio chips.
The second operating system hiding in every mobile phone
The insecurity of baseband software is not by error; it's by design. The standards that govern how these baseband processors and radios work were designed in the '80s, ending up with a complicated codebase written in the '90s - complete with a '90s attitude towards security. For instance, there is barely any exploit mitigation, so exploits are free to run amok. What makes it even worse, is that every baseband processor inherently trusts whatever data it receives from a base station (e.g. in a cell tower). Nothing is checked, everything is automatically trusted. Lastly, the baseband processor is usually the master processor, whereas the application processor (which runs the mobile operating system) is the slave.
(...)
With this in mind, security researcher Ralf-Philipp Weinmann of the University of Luxembourg set out to reverse engineer the baseband processor software of both Qualcomm and Infineon, and he easily spotted loads and loads of bugs, scattered all over the place, each and every one of which could lead to exploits - crashing the device, and even allowing the attacker to remotely execute code. Remember: all over the air. One of the exploits he found required nothing more but a 73 byte message to get remote code execution. Over the air.
Click to expand...
Click to collapse
Source, via HN
Comments at HN are also worth reading, I think.
Do note, that the study run on some old generation of MSM chips.
Here is a counter argument for instance:
Comment by OsQar
by OsQar on Wed 13th Nov 2013 09:51 UTC
I'm not a security expert at all, but I've been working on mobile radio access technologies for several years, so I feel quite confident to say that some or your claims are wrong. E.g:
"The standards that govern how these baseband processors and radios work were designed in the '80s, ending up with a complicated codebase written in the '90s - complete with a '90s attitude towards security."
Well, GSM's baseband was developed from late 80's to early 90's, UMTS' from late 90's to early 00's, and LTE's can be now be considered almost finished. I know that GSM is not secure at all now (it was when it was released, but now it has been cracked), but I'm not so sure about UMTS (CDMA is very hard to demodulate, so cracking is even worse) and LTE (OFDMA is quite a headache).
"What makes it even worse, is that every baseband processor inherently trusts whatever data it receives from a base station (e.g. in a cell tower). Nothing is checked, everything is automatically trusted."
This is NOT TRUE. At all. Even from GSM times. Handheld devices run a bunchload of ID checks to know what basestation is sending data; and basestations also carefully allocate and check mobile ID's. This is especially true in UMTS (where you have to discriminate interferring users by using pseudorandom codes) and LTE (where you even need angle-of-arrival information to reach more users).
So, I'm not claiming that mobile basebands are inherently secure, but they're definitively not based on 80's security technology.
On the other hand, I agree with your viewpoint that the closed implementations and the huge standards are not the best way to allow the community to check for security bugs. But manufacturers are the main supporters of actual standardization bodies, so it's quite complicated to fight against it.
Click to expand...
Click to collapse

Related

Testing software (voice encription) in Europe

My company developed a product that uses GSM/CSD mode to send voice encrypded using 256 bits Rijndael. I don't know if in Europe my product works. I have a XDA working fine here in Brazil. I will apreciate if my software could be tested using the XDA and XDA-II (we don't tested-it with the XDA-II), because we don't have how to test-it in Europe.
My site is http://www.raseac.com.br , and in the site we have a working demo with 128 bits security and one minute of conversation per call. We have also a manual in PDF format (in english).
I will apreciate some help from Europe.
My personal e-mail is MOD EDIT: REMOVED EMAIL
Please erase the [REMOVE] in the e-mail.
Thank You.
Cesar Bremer Pinheiro

cesarbremer said:
My company developed a product that uses GSM/CSD mode to send voice encrypded using 256 bits Rijndael. I don't know if in Europe my product works. I have a XDA working fine here in Brazil. I will apreciate if my software could be tested using the XDA and XDA-II (we don't tested-it with the XDA-II), because we don't have how to test-it in Europe.
My site is http://www.raseac.com.br , and in the site we have a working demo with 128 bits security and one minute of conversation per call. We have also a manual in PDF format (in english).
I will apreciate some help from Europe.
My personal e-mail is MOD EDIT: REMOVED EMAIL
Please erase the [REMOVE] in the e-mail.
Thank You.
Cesar Bremer Pinheiro
Click to expand...
Click to collapse
I think you might consider looking also for European based solution, similar but using specifically MDA / XDA for encrypted comm
http://www.cryptophone.de/html/products_en.html
BTW when you consider introducing fully fledged and operational version for wm2003 ??
regards, monika

Thank you for your interest in our product.
We will test our product with the wm2003 in the next month, but we can't have a date limit to finish the compatibility test yet. There are a lot of hardware available to run our product. I will remember you that we are selling software (not hardware like cryptophone), and to sell our product we need to make compatibility tests in a lot of hardware . Our idea in this case is, if you have a hardware available (like the XDA), you only need to buy a software (and not the hardware that you already have). You investment in this case will be US$149,99 for the 128 bits version (US$ 249,99 for the 256 bits) in order to have a solid voice encryption product. Our product uses a TAPI modem linked with a PocketPc 2002 handheld by cable, bluetooth or a compactflash connection, and uses fixed, cellular and satelite lines. We tested the Raseac Secure Phone it in a lot of hardware (we have our product in our lab running in a XDA). We don't know about the CSD (Circuit Switched Data) quality in GSM networks outside Brazil (we are asking the readers to test-it and send us their comments). The bonus in this case is the use of a solid 128 bits voice encryption software free for one minute of conversation per call, with no limits in the number of calls (our freeware version).
Thank you.
Cesar Bremer Pinheiro

Sorry for the mistake in the price: The correct values are US$149.99 for the 128 bits version and US$249.99 for the 256 bits version.
Thank You.
Cesar.

How do we know if the software is actually carrying out the encryption, and that the voice is actually being encrypted is there something obvious that will let me know this.

The encryption is the easier part to be done in this system, if you see the user's manual, the most part of the system is the user interface and its architecture (our strongest point is our system design).
If you made a system that sends and receives voice without encryption, in our case you have 90% of the work done (error correction, codec optimization, software optimization). Think about reading the voice signal, compressing this signal using a voice codec, building the telephony interface, optimizing the code (our system is full-duplex), working a lot to optimize the code and let it running with quality), and until now i am not talking about encryption.
You can see in the google a lot of stuff about encryption (random number generators, hash functions, encryption functions), the encryption library available is huge.
After that work done to send and receive voice in a 4800 bauds line, you will see that 95% of the job is done. But i will remember that: To this system be a security system, all this design must be done before build the system. It is very dificult to transform a voice transmition system in a good security system(almost impossible) if you don't thing in security before building the system.
Now a little bit about encryption.
Our design is completely different from vast majority of the voice systems designs, we use block mode encryption and CBC mode encryption. The vast majority of the systems designs uses streaming mode. We generate an external random file in order to use the random numbers by the system. You can analyse this random file, it passes in the Diehard test (you can download the Diehard test and submit our generated file).
Each contact used by the system have its own master key, and you can edit this contact master key.
If you change one bit of this contact master key in your handheld, you will not be able to do the voice connection with the other handheld.
After reading our user manual, available in our site, you will see that this system was carefully built having security in mind, because you will see that you will have a 50 pages manual with a lot of information about security, and I invite you to read this manual (again, you will see a lot about our system design in this manual).
The Raseac Secure Phone security system spec will be published in february, and after that we will ask for an independent organization to analize our source code and publish the results (We think that the common user doesn't have the competence to analyse the source code). Our source code will not be available to the public only because commercial reasons, we sell software for commercial hardware available in the market (unlike our competition that sells proprietary hardware and have the copy protection inside their proprietary hardware), we have our system copy protection inside our code and we want to protect our intelectual property.
A little bit more about proprietary hardware systems: If you sell a hardware system and publish only part of the system (you can't garantee that the operational system was not changed in a dangerous way to compromise the security), the source published doesn't garantee the security at all.
Thank you.
Cesar Bremer Pinheiro.
MOD EDIT: REMOVED EMAIL
Please erase the [REMOVE] in the e-mail.

is it available in Asia?

Interface for controlling WiFi transmission power

On Linux one can run $sudo iwconfig to get details about the WiFi hardware. CM used to ship with iwconfig, but this has gone. I've built iwconfig from source in https://github.com/servalproject/batphone yet when I ran it on a couple of CM ROMs it doesn't give any info about the interface. The reason why I'm bothered about this is that in the past, I've seen Android phones showing 32dBm when queried via iwconfig txpower which is incredible: that's over 1W. Not only is it illegal but, possibly damaging for health, wasteful of battery and leaking my whereabouts further than is necessary. Pengus77 implemented a sys interface for the Kowalski kernel: https://github.com/pengus77/kowalski and I'd like to see this accessible via the WiFi advanced options.

dabl8 said:
On Linux one can run $sudo iwconfig to get details about the WiFi hardware. CM used to ship with iwconfig, but this has gone. I've built iwconfig from source in https://github.com/servalproject/batphone yet when I ran it on a couple of CM ROMs it doesn't give any info about the interface. The reason why I'm bothered about this is that in the past, I've seen Android phones showing 32dBm when queried via iwconfig txpower which is incredible: that's over 1W. Not only is it illegal but, possibly damaging for health, wasteful of battery and leaking my whereabouts further than is necessary. Pengus77 implemented a sys interface for the Kowalski kernel: https://github.com/pengus77/kowalski and I'd like to see this accessible via the WiFi advanced options.
Click to expand...
Click to collapse
Two possibilities:
1) Illegal, damaging for health/hardware, etc.
2) Since Android doesn't use that interface, the OEM who wrote the wifi driver didn't test the txpower interface and it returns bogus data and does nothing.
I'm leaning towards 2)

Entropy512 said:
Two possibilities:
1) Illegal, damaging for health/hardware, etc.
2) Since Android doesn't use that interface, the OEM who wrote the wifi driver didn't test the txpower interface and it returns bogus data and does nothing.
I'm leaning towards 2)
Click to expand...
Click to collapse
I agree with 2. I haven't looked into this, but since there's legal issues here, that argues that there's some sort of inspection (like the FCC) that has to happen before consumer release. It obviously passed that to be allowed in the market, so it's probably just feeding bad/generic data, especially since it doesn't come with that app by default.

You're probably right about the data being wrong. However the law is different in different countries. Last time I checked, in France the law is 10mW outdoors and there are restrictions in military zones; it's even less in New Zealand. So if I buy a phone in the U.S. and bring it to France I could be breaking the law. Therefore it surprises me that the OEM wouldn't test this. In Symbian it was possible to switch between 4mW/10mW/100mW in the settings but I've never seen this on Android.

dabl8 said:
You're probably right about the data being wrong. However the law is different in different countries. Last time I checked, in France the law is 10mW outdoors and there are restrictions in military zones; it's even less in New Zealand. So if I buy a phone in the U.S. and bring it to France I could be breaking the law. Therefore it surprises me that the OEM wouldn't test this. In Symbian it was possible to switch between 4mW/10mW/100mW in the settings but I've never seen this on Android.
Click to expand...
Click to collapse
Android does it by sending a wifi region code to the kernel driver (which passes it on to the firmware in most cases). This enforces frequency band limits, and (I am assuming) power limits.
For example, if a device defaults to EU region, you can't see a bunch of 5 GHz USA channels until you change region code. (There's a reason why I'm the one that wrote the region code settings patches. )

MediaTek FOTA reverse engineering

So, I decided to have a look at how my Cat B15Q actually recieves OTA updates. Turns out the lifting is done by two apk's in /system, FWUpgrade.apk and FWUpgradeProvider.apk.
Notes taken during reverse engineering:
the entire upgrade mechanism runs over plain HTTP, so you can use tools like fiddler or wireshark to listen and manipulate the entire mechanism (just imagine deploying a malicious proxy with ettercap on a conference wifi and pwning all mediatek devices)
mediatek seems to supply handset manufacturers with a set of PHP scripts for providing OTA upgrades.
the whole code is littered with typos ("onHandsakeAuthentication", "downlaod" and more), commented-out code and other stuff which makes me wonder just how it works, but well I always have that feeling when I have to read Mediatek source code
an old version of the client-side source, written for another mediatek device, is at https://github.com/kupyxa4444/baoxu...a/src/com/mediatek/GoogleOta/HttpManager.java
something in the core methods apparently messes up both JD-GUI and Procyon decompilers
the core mechanism for obtaining a download/checkversion token is just a md5sum (fixed "tag string" 15811375356 + server-sent "rand"); funny enough that this "tag string" is sent as "serial number" during login and is apparently totally hardcoded.
at least in this 2012 ROM dump, the endpoint addresses are stored in res/values/address.xml, however this is not present in "my" apk, nor in /data/data/com.fw.upgrade. Looks like the new version uses SharedPreferences, but there is no backing store in /data/data/com.fw.upgrade either.
Because I don't really like unknown parties being able to link together my SIM and IMEI (especially any random wifi snoop, this thing is a background service), I have killed off the OTA service and wrote me a little script to check and fetch updates: https://gist.github.com/msmuenchen/c3fb276f264058b8d51e
By the way, I don't know what the ... the guys at mediatek are smoking, but that code... it is sufficient to say that it would be trivial to thoroughly **** up any OTA distribution, up to the point of distributing malware and rootkits. To top it off, some guy even dumped a boatload of internal mediatek stuff to github, and the horrors I have seen there are beyond imaginable.

Security threat, "man in the middle attack, UMTS"

Mass surveillance are documented whit our cell phones.
Thousands of volunteers have with their mobile phone uploaded their results to different cell tower (base station) databases.
The hack that is picked up whit our mobilphones is,
"man in the middel attack, umts"
The explanation is that GSM base stations is pretending to be an official GSM station and emits a Cell ID.
In the EU it is a human right to have telecommunications secrecy, it means that your phone calls must be encrypted.
(it is very likely also human rights in many other countries)
You will need to compar whit official database for your area.
voluntarily collect databases.:
Opencellid.org
cellmapper.net
wigle.net (blue dots)
opensignal.com
http://www.cellumap.com/
Mozilla location services.
there are many other databases.
Official cell tower database.:
Denmark.: Mastedatabasen.dk
Norway.: finnsenderen.no
Schweiz.: Funksender.ch
Great Britain.: http://www.sitefinder.ofcom.org.uk/search
France.: http://www.cartoradio.fr/cartoradio/web/
Belgium.: http://zendmasten.be/
Brussel.: http://geoportal.ibgebim.be/webgis/antenne_emettrice_gsm.phtml?langtype=2060
Austria.: http://www.senderkataster.at/
Germany http://emf3.bundesnetzagentur.de/karte/Default.aspx
Netherlands.: http://www.antenneregister.nl/Html5Viewer_Antenneregister/Index.html?viewer=antenneregister
USA.: http://www.antennasearch.com/
Pleas.
Provide permalinks is there are things you don't understand, and the official database for your area and I will have a look.
Or ask a questions.
eksampel when comparing databases.:
how to compare, openopencellid.org and the official database for thr area you want to check, you will see it straight away, there is a huge difference.
or for the USA opencellid.org, wiggle.net, opensignal.com, etc.. in conjunction whit http://www.antennasearch.com/
A few newspaper articles on the subject.:
http://www.ibtimes.co.uk/fake-sting...-discovered-spying-millions-londoners-1505368
http://www.theguardian.com/uk/2011/oct/30/metropolitan-police-mobile-phone-surveillance
http://www.thelocal.no/20150309/norway-police-broke-law-with-fake-mobile-receivers
http://www.aftenposten.no/nyheter/iriks/Secret-surveillance-of-Norways-leaders-detected-7825278.html
http://www.networkworld.com/article...e-gsm-base-station-trick-targets-iphones.html
A bit info about the hack.:
https://en.wikipedia.org/wiki/IMSI-catcher
https://www.sba-research.org/wp-con...rowskiEtAl-IMSI-Catcher-Catcher-ACSAC2014.pdf
https://cosec.bit.uni-bonn.de/fileadmin/user_upload/teaching/10ws/10ws-sem-mobsec/talks/dammann.pdf
https://media.blackhat.com/bh-dc-11/Perez-Pico/BlackHat_DC_2011_Perez-Pico_Mobile_Attacks-wp.pdf
https://www.twelvesec.com/using-gsm-tester-intercept-calls-sms-pt1/
http://www.wired.com/2010/07/intercepting-cell-phone-calls/ (stupid tracking algorithms makes that point less.)
http://www.theregister.co.uk/2014/03/26/spam_text_china_clampdown_police/
http://mobilesociety.typepad.com/mo...ng-2g-for-data-i-need-a-3g4g-only-switch.html (stupid you can't protect your phone against mitm, umts)
http://www.theregister.co.uk/2010/08/02/gsm_cracking/
http://www.fiercewireless.com/tech/...se-stations-tracking-eavesdropping/2014-03-16
Radiation.:
http://www.psrast.org/mobileng/hylandbasestation.pdf
http://www.tetrawatch.net/papers/hyland_2005.pdf
http://www.iss.it/binary/elet/cont/3.1203942327.pdf
more to come.
it is a cut from an article I'm writing.
Thanks
swampii

I'm anxious to see your complete write-up. I hope you will post a link when it's finished.

Serious Malware on Multiple Devices (OnePlus 8T & Samsung Galaxy Tab S7+)

Hello,
Thanks for taking some time to read this. Let me start off by mentioning that this all originated on my PC I believe and an unauthorized user obtained access to my network and therefore all my devices.
My OnePlus 7 Pro was what seriously concerned me as not only was it infected, the attacker actually pushed a firmware update to my phone and it randomly reset as I was using it into a completely different/custom rom that he of course had complete control over.
I upgraded to a OnePlus 8T and after walking out of the T-Mobile store I found out my new phone was already infected.... How? Well, the escalated priviliges this attacker had allowed him to auto connect to my OnePlus device using the OnePlus SmartSwitch app. Yeah, I thought it was crazy too.
So I've tried to hard reset my devices, which actually turned out to be a bad idea as this infection actually hijacked the the process by (I'm not super familiar with reading all the log data) but it was clear that multiple main processes were killed and it took control and a warning popped up saying (WARNING! This is a Debug Kernel and is not fit for a standard ROM. If you did not authorize this then your privacy may be at risk as this could potentially allow an unauthorized user complete control of your device" it was something along these lines, may not be the exsct wording but you get my point. (This was on my Samsung Galaxy Tab S7+)
More or less the same thing with my OnePlus 8T and it has complete control over all of my apps. The permissions my apps have are literally insane. I've attached screenshiots.
How can I mitigate this? What should I do? It has infected my 2017 MacBook Air, PC, OnePlus 8T, Samsung Galaxy Tab S7+, Asus ROG Rapture GT-AX11000 Router, Netgear Nighthawk Router and possibly more. This thing is crazy advanced to the point I didn't even know malware like this existed.
ALSO: I found out that Busy Box is installed on my devices without my authorization BUT my device isn't rooted.
[Samsung Galaxy Tab S7+]
|One UI Version|
2.5
|Android Version|
10
|Baseband Version|
T978USQS1ATJ5
|Kernel Version|
4.19.81-19543082
#2 Sun Oct 11 17:18:26 KST 2020
|Build Number|
QP1A.190711.020.T978USQS1ATJ5
|SE for Android Status|
Enforcing
SEPF_SM-T978U_10_0020
Sun Oct 11 16:58:25 2020
|Knox Version|
Knox 3.6
Knox API level 32
TIMA 4.1.0
DualDAR 1.2.0
HDM 2.0 - F
|Service Provider SW ver.|
SAOMC_SM-T978U_OYN_TMB_QQ_0026
R52N810TWJM
TMB/TMB/TMB
|Carrier Configuration Version|
2.340001
|Security Software Version|
MDF v3.1 Release 5
WLAN v1.0 Release 2
VPN PP-MOD v2.1 Release 3.0.1
ASKS v3.1 Release 20200806
ADP v3.0 Release 20191001
FIPS BoringSSL v1.4
FIPS SKC v2.1
FIPS SCrypto v2.5
SMR Oct-2020 Release 1
|Android Security Patch Level|
October 1, 2020
[T-Mobile | OnePlus 8T]
|Model|
KB2007
|Android Version|
11
|Carrier Configuartion Version|
2.360001
|Baseband Version|
MPSS.HI.2.0.c4-00028-SDX55_RMTEFS_PACK-1.327103.53
|Kernel Version|
4.19.110-perf+
#1 Wed Dec 16 22:01:42 CST 2020
|Software Version|
11.0.6.8.KB09CB
|Android Security Update|
November 1, 2020
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

I have the same malware on my device! It's a spyware-type malware, and I'm not sure how my device contracted it, to be honest. I'll type my software information below so that others can find this post, too, and not feel left out.
Model:
Samsung S9+
Model number:
SM-G956U
One UI version:
2.5
Android version:
10
Baseband version:
G965USQU9FVB2
Kernel version:
4.9.186-22990479
#1 Thu Feb 24 18:22:06 KST 2022
Build number:
QP1A.190711.020.G965USQU9FVB2
SE for Android status:
Enforcing
SEPF_SM-G965U_10_0030
Thu Feb 24 18:33:14 2022
Knox version:
Knox 3.4.1
Knox API level 30
TIMA 4.0.0
Service provider SW ver.:
SAOMC_SM-G965U_OYN_TMB_QQ_0026
32564c5336363098
TMB/XAA/VZW
Carrier configuration version:
2.450001
[Update]
(P.S. After factory resetting my device, it changed to "0.0.0")
Security software version:
MDF v3.1 Release 5
WLAN v1.0 Release 2
VPN PP-MOD v2.1 Release 3.0.1
ASKS v3.1 Release 20200806
ADP v3.0 Release 20191001
FIPS BoringSSL v1.4
FIPS SKC v1.9
FIPS SCrypto v2.2
SMR Mar-2022 Release 1
Android security patch level:
March 1, 2022
When I tried to mess around with my Developer's options, it showed that I am not the administrator. It doesn't allow me to turn on "Restrict my SMS and call log access" under Apps, and a bug report I opened and had looked at gave me these additional specifications I had never seen before:
Build fingerprint:
'samsung/star2qltesq...'
Bootloader:
G965USQU9FVB2
Radio:
G965USQU9FVB2
Network:
(unknown)
Module Metadata version:
330477090
Kernel:
Linux version 4.9.186-22990479...
Besides this, all of my applications have been compromised; they all have odd versions, permissions I cannot control (such the system app, Tips, being able download files without notifying me), can change system settings, install unknown apps, have "Open source licenses," and so on. Some of the capabilities that my app, Messages, has is the ability to modify my call logs, send out messages without my knowledge (then delete them), use my microphone to record at any given time, and connect or disconnect from Wi-Fi. It's quite difficult for me to find authentic information online, because my Google Chrome app constantly gives me false redirections to fake/modified links that appear legitimate.
Everything on my phone will tell me that the apps, the websites, and the operating system are safe and authentic, but they're all infected. I have been under the false impression that nothing was wrong with my device for months now, because judging from my Wi-Fi usage history, it had spiked up between June-July.
I'll also go ahead and attach a sh*tload of screenshots on what the malicious, system applications look like.

Rotting Brain said:
I have the same malware on my device! It's a spyware-type malware, and I'm not sure how my device contracted it, to be honest. I'll type my software information below so that others can find this post, too, and not feel left out.
Model:
Samsung S9+
Model number:
SM-G956U
One UI version:
2.5
Android version:
10
Baseband version:
G965USQU9FVB2
Kernel version:
4.9.186-22990479
#1 Thu Feb 24 18:22:06 KST 2022
Build number:
QP1A.190711.020.G965USQU9FVB2
SE for Android status:
Enforcing
SEPF_SM-G965U_10_0030
Thu Feb 24 18:33:14 2022
Knox version:
Knox 3.4.1
Knox API level 30
TIMA 4.0.0
Service provider SW ver.:
SAOMC_SM-G965U_OYN_TMB_QQ_0026
32564c5336363098
TMB/XAA/VZW
Carrier configuration version:
2.450001
[Update]
(P.S. After factory resetting my device, it changed to "0.0.0")
Security software version:
MDF v3.1 Release 5
WLAN v1.0 Release 2
VPN PP-MOD v2.1 Release 3.0.1
ASKS v3.1 Release 20200806
ADP v3.0 Release 20191001
FIPS BoringSSL v1.4
FIPS SKC v1.9
FIPS SCrypto v2.2
SMR Mar-2022 Release 1
Android security patch level:
March 1, 2022
When I tried to mess around with my Developer's options, it showed that I am not the administrator. It doesn't allow me to turn on "Restrict my SMS and call log access" under Apps, and a bug report I opened and had looked at gave me these additional specifications I had never seen before:
Build fingerprint:
'samsung/star2qltesq...'
Bootloader:
G965USQU9FVB2
Radio:
G965USQU9FVB2
Network:
(unknown)
Module Metadata version:
330477090
Kernel:
Linux version 4.9.186-22990479...
Besides this, all of my applications have been compromised; they all have odd versions, permissions I cannot control (such the system app, Tips, being able download files without notifying me), can change system settings, install unknown apps, have "Open source licenses," and so on. Some of the capabilities that my app, Messages, has is the ability to modify my call logs, send out messages without my knowledge (then delete them), use my microphone to record at any given time, and connect or disconnect from Wi-Fi. It's quite difficult for me to find authentic information online, because my Google Chrome app constantly gives me false redirections to fake/modified links that appear legitimate.
Everything on my phone will tell me that the apps, the websites, and the operating system are safe and authentic, but they're all infected. I have been under the false impression that nothing was wrong with my device for months now, because judging from my Wi-Fi usage history, it had spiked up between June-July.
I'll also go ahead and attach a sh*tload of screenshots on what the malicious, system applications look like.
Click to expand...
Click to collapse
to fix this you need to reinstall te full firmare in odin, and format the sd card o the device ( a back up is not recommended due the malware can be copy too

tutibreaker said:
to fix this you need to reinstall te full firmare in odin, and format the sd card o the device ( a back up is not recommended due the malware can be copy too
Click to expand...
Click to collapse
Thank you, I was planning on doing so, anyway. I'm just learning as much as I can before I reinstall the stock firmware, such as if there's a method I could use that wouldn't trip Knox because I like using some of the Samsung applications.
I have 2 other phones that have been compromised, as well, and the hacker knows, essentially, all my passwords now to all of my accounts, and has access to my SIM card/number. It's frustrating that when an application requests a verification code, I get messages like these:
<#> Account: [redacted] is your Samsung account verification code.
bP2ROrn3fZQ
Click to expand...
Click to collapse
<#> Your WhatsApp code: [redacted]
You can also tap on this link to verify your phone: v.whatsapp.com/[redacted]
Don't share this code with others
4sgLq1p5sV6
Click to expand...
Click to collapse
And it also gets onto my WhatsApp account. I really have to flash my mobile devices, I'm just afraid I'll f*ck up really badly.

Rotting Brain said:
Thank you, I was planning on doing so, anyway. I'm just learning as much as I can before I reinstall the stock firmware, such as if there's a method I could use that wouldn't trip Knox because I like using some of the Samsung applications.
I have 2 other phones that have been compromised, as well, and the hacker knows, essentially, all my passwords now to all of my accounts, and has access to my SIM card/number. It's frustrating that when an application requests a verification code, I get messages like these:
And it also gets onto my WhatsApp account. I really have to flash my mobile devices, I'm just afraid I'll f*ck up really badly.
Click to expand...
Click to collapse
usind odin wont trip knox

tutibreaker said:
usind odin wont trip knox
Click to expand...
Click to collapse
That's relieving to know, thank you!

I have the same issue now going on for 2 years.
I have changed everything from emails devices wifi and cel companies. I've been super careful to not access any infected data from previous devices. On my new note 20 5g ultra out of box disabled blue tooth and dis not connect to any wifi so far. I di not transfer data from any device..
I've lost so much time and money trying to get rid of this. I've lost all 99 of all my Pic videos for over the past decade emails and social media accounts.
Knox has been activated I tried to access the account but I've been unsuccessful.
Has flashing it work for anyone else. I have on previous devices galaxy 8plus just to reverse back to the compromised state.

Glow1717 said:
I have the same issue now going on for 2 years.
I have changed everything from emails devices wifi and cel companies. I've been super careful to not access any infected data from previous devices. On my new note 20 5g ultra out of box disabled blue tooth and dis not connect to any wifi so far. I di not transfer data from any device..
I've lost so much time and money trying to get rid of this. I've lost all 99 of all my Pic videos for over the past decade emails and social media accounts.
Knox has been activated I tried to access the account but I've been unsuccessful.
Has flashing it work for anyone else. I have on previous devices galaxy 8plus just to reverse back to the compromised state.
Click to expand...
Click to collapse
To be honest, I eventually gave up on it because whoever it is that wants access to my devices clearly has the resources to do so.
On top of that, no one would believe me when I tried to explain to them how serious it is and all the information I've gathered to prove my point.
Unfortunately, I'm not fluent enough in coding or low level system management to professionally explain my concern for anyone to listen to.
I came to the realization that in the bigger picture, I'm a nobody in the cybersecurity field and what that means is no one will take me, and most likely you, seriously nor do others want to spend their time assisting us for anything short of a fortune.
If you are experiencing something similar to what I've posted here then chances are high you are being targeted specifically and without the relevant cybersecurity knowledge to protect yourself, you will never get away from it.
Hate to be negative here but I can assure you that I spent countless days, weeks, months trying to figure it out by researching, contacting cybersecurity specialists, forums etc. all to no avail.
I genuinely wish you luck and if you happen to find some information you could share with me, I'd appreciate it.
Outside spending a small fortune to hire an expert to come to my house and dig deep into my network, I don't see a way to resolve it, personally.
Good luck
Sentimental Sugarcube said:
I have the same malware on my device! It's a spyware-type malware, and I'm not sure how my device contracted it, to be honest. I'll type my software information below so that others can find this post, too, and not feel left out.
Model:
Samsung S9+
Model number:
SM-G956U
One UI version:
2.5
Android version:
10
Baseband version:
G965USQU9FVB2
Kernel version:
4.9.186-22990479
#1 Thu Feb 24 18:22:06 KST 2022
Build number:
QP1A.190711.020.G965USQU9FVB2
SE for Android status:
Enforcing
SEPF_SM-G965U_10_0030
Thu Feb 24 18:33:14 2022
Knox version:
Knox 3.4.1
Knox API level 30
TIMA 4.0.0
Service provider SW ver.:
SAOMC_SM-G965U_OYN_TMB_QQ_0026
32564c5336363098
TMB/XAA/VZW
Carrier configuration version:
2.450001
[Update]
(P.S. After factory resetting my device, it changed to "0.0.0")
Security software version:
MDF v3.1 Release 5
WLAN v1.0 Release 2
VPN PP-MOD v2.1 Release 3.0.1
ASKS v3.1 Release 20200806
ADP v3.0 Release 20191001
FIPS BoringSSL v1.4
FIPS SKC v1.9
FIPS SCrypto v2.2
SMR Mar-2022 Release 1
Android security patch level:
March 1, 2022
When I tried to mess around with my Developer's options, it showed that I am not the administrator. It doesn't allow me to turn on "Restrict my SMS and call log access" under Apps, and a bug report I opened and had looked at gave me these additional specifications I had never seen before:
Build fingerprint:
'samsung/star2qltesq...'
Bootloader:
G965USQU9FVB2
Radio:
G965USQU9FVB2
Network:
(unknown)
Module Metadata version:
330477090
Kernel:
Linux version 4.9.186-22990479...
Besides this, all of my applications have been compromised; they all have odd versions, permissions I cannot control (such the system app, Tips, being able download files without notifying me), can change system settings, install unknown apps, have "Open source licenses," and so on. Some of the capabilities that my app, Messages, has is the ability to modify my call logs, send out messages without my knowledge (then delete them), use my microphone to record at any given time, and connect or disconnect from Wi-Fi. It's quite difficult for me to find authentic information online, because my Google Chrome app constantly gives me false redirections to fake/modified links that appear legitimate.
Everything on my phone will tell me that the apps, the websites, and the operating system are safe and authentic, but they're all infected. I have been under the false impression that nothing was wrong with my device for months now, because judging from my Wi-Fi usage history, it had spiked up between June-July.
I'll also go ahead and attach a sh*tload of screenshots on what the malicious, system applications look like.
Click to expand...
Click to collapse
I'm glad that at least someone believes me.
My God, seriously.
I really hope you were able to get this fixed. I haven't been able to since my entire network has been infected. It's a really long story but the bottom line is that I've never seen malware with these capabilities. They are incredible and not one you would ever want to be infected with.

Glow1717 said:
I have the same issue now going on for 2 years.
I have changed everything from emails devices wifi and cel companies. I've been super careful to not access any infected data from previous devices. On my new note 20 5g ultra out of box disabled blue tooth and dis not connect to any wifi so far. I di not transfer data from any device..
I've lost so much time and money trying to get rid of this. I've lost all 99 of all my Pic videos for over the past decade emails and social media accounts.
Knox has been activated I tried to access the account but I've been unsuccessful.
Has flashing it work for anyone else. I have on previous devices galaxy 8plus just to reverse back to the compromised state.
Click to expand...
Click to collapse
I'm very sorry to hear that, I can't imagine what it's like to have to deal with this for such a long time. I slowly started losing my sanity when my devices were infected, especially my primary device (the Samsung Galaxy S9+), and had started becoming irrational at times due to the paranoia and lack of understanding about what had been going on the entire time.
I have yet to flash any of my devices, so I don't know just how well it'll work out doing so. What Android version is your Samsung Galaxy S8+, though? Because devices running on Android 9 (Pie) and up are pretty unique in the sense that the security rids the device of malware & spyware once a factory reset takes place, so if you have a newer operating system like you do on your Samsung Galaxy Note 20 Ultra 5G, then you may be able to fix that issue. Although, it would only clear up issues you have on your firmware/software & not be able to help issues you'd occur with a compromised hardware & network connection.
When I factory reset my Samsung Galaxy S9+ (which runs on Android 10), the oddity disappeared! I wish I had done it sooner or routinely, at least, because it would've saved me from so much stress & anxiety.
Although, as @JesseJamez55 mentioned, you may be directly targeted, and that makes a huge difference in the matter. I, for one, am not specifically in the center of attention — my best friend is, and I suppose I somehow got involved in this awfulness just for knowing about so many of the concerning experiences he's had in the last several years.
JesseJamez55 said:
To be honest, I eventually gave up on it because whoever it is that wants access to my devices clearly has the resources to do so.
On top of that, no one would believe me when I tried to explain to them how serious it is and all the information I've gathered to prove my point.
Unfortunately, I'm not fluent enough in coding or low level system management to professionally explain my concern for anyone to listen to.
I came to the realization that in the bigger picture, I'm a nobody in the cybersecurity field and what that means is no one will take me, and most likely you, seriously nor do others want to spend their time assisting us for anything short of a fortune.
If you are experiencing something similar to what I've posted here then chances are high you are being targeted specifically and without the relevant cybersecurity knowledge to protect yourself, you will never get away from it.
Hate to be negative here but I can assure you that I spent countless days, weeks, months trying to figure it out by researching, contacting cybersecurity specialists, forums etc. all to no avail.
I genuinely wish you luck and if you happen to find some information you could share with me, I'd appreciate it.
Outside spending a small fortune to hire an expert to come to my house and dig deep into my network, I don't see a way to resolve it, personally.
Good luck
Click to expand...
Click to collapse
I was planning on doing the same thing when I had gotten tired of it; I was just going to accept that my life will always be this way and there's nothing I can do to try to stop it from happening because I wasn't educated enough about the problems I was facing, and couldn't find any real information due to the DSN spoofing.
It's best to not share this with too many people — we'll end up looking like nutjobs, which we probably are a little of, due to apophenia & the heightened stress/anxiety (causing paranoia), haha. But in all seriousness, the people of people won't understand or believe is — especially when we're more suspectable to being discredited.
I think that's what the hackers/stalkers do — pick out & mess with those that have disadvantages (such as if one uses illegal substances known to distort our thinking or if one is diagnosed with a serious mental illness) because we're easily discredited.
How long has this been happening to you, if you don't mind me asking?
JesseJamez55 said:
I'm glad that at least someone believes me.
My God, seriously.
I really hope you were able to get this fixed. I haven't been able to since my entire network has been infected. It's a really long story but the bottom line is that I've never seen malware with these capabilities. They are incredible and not one you would ever want to be infected with.
Click to expand...
Click to collapse
I was extremely relieved when I found out there are others that believed me too & who were suffering from the same issues & malware.
I was able to get it fixed, thankfully, but I've also changed my way of thinking about this whole thing. I've started taking my medications, too (or I'm starting to again). And I agree, it's definitely a considerably severe form of electronic harassment. But I suppose it's inevitable, and there's no point in stressing out so much over it anymore — for me, at least.

JesseJamez55 said:
To be honest, I eventually gave up on it because whoever it is that wants access to my devices clearly has the resources to do so.
On top of that, no one would believe me when I tried to explain to them how serious it is and all the information I've gathered to prove my point.
Unfortunately, I'm not fluent enough in coding or low level system management to professionally explain my concern for anyone to listen to.
I came to the realization that in the bigger picture, I'm a nobody in the cybersecurity field and what that means is no one will take me, and most likely you, seriously nor do others want to spend their time assisting us for anything short of a fortune.
If you are experiencing something similar to what I've posted here then chances are high you are being targeted specifically and without the relevant cybersecurity knowledge to protect yourself, you will never get away from it.
Hate to be negative here but I can assure you that I spent countless days, weeks, months trying to figure it out by researching, contacting cybersecurity specialists, forums etc. all to no avail.
I genuinely wish you luck and if you happen to find some information you could share with me, I'd appreciate it.
Outside spending a small fortune to hire an expert to come to my house and dig deep into my network, I don't see a way to resolve it, personally.
Good luck
Click to expand...
Click to collapse
Your completely right. I thank you for your feedback and I greatly appreciate it. I usually get laughed at or from IT support at cox or other companies that will explain how to what is happening to my digital life is none existent and has not been developed yet and send me on my way after a virus scan resulting in 0 threats.
Your also think your right been someone targeting me. At this point I need to get my foil hat.. I really don't share that thought because even my bf has advised me to get a mental health evaluation... I understand after hearing me try to figure it out for mths 24/7..
This is the reason why I believe that it is a possibility. When all this came about I lived in North Las Vegas it's pretty bad unfortunately I didn't know when I bought and moved in from California. I felt safe it's a gated community!
I'm just gonna lay it out and I know what I sound like and I did end up going to get checked out clean menta aside from some anxiety from all of this.
After moving in a mth later I had some tampering with my truck but wasn't sure maybe by accident I did it .. I was always on the run.. but a few wks later I heard the back door open and I asked who was there and I caught someone's backside running out. I figured some stupid curious teen .. so concerned me living alone employed running a company and also a side business flipping cars and a truck a sports car and a classic that I was rebuilding.. maybe was drawing attention of the wrong kind. I got me a dog! Problem fixed um no still night noises outside and once on the roof that my BF was there that night and we would call the Police dept.. over and over again. So time to get cameras. Started with the ring system I had cameras in every direction including a couple inside. It was amazing! For a day that night someone tripped by breaker lost power again we ran out it was the BF of the person that managed the community... another police report for the pile. To make it short unless I was looking at it live what ever that was recorded I would get to see it original video maybe once and when I would try to show someone video would be gone or edited (at the time I did not know that video could be edited or set privacy guards filters from amazon etc) also I would started to see at night someone with lazer pointers. Later I was told it would disable the camera. True or not after looking like a mad woman with claiming to have proof to call the police.. and I no longer had the evidence no matter where I would back It up to.. I was mad all that money on the ring for this BS.. so I got Canary then I got Alfred and a long list of cameras apps and all the same. Luckily I was giving some credit when on a motion in an inside my home you could see a hand reaching to move the camera a I was able to show my BF and a friend but by the time pd showed up the video had been edited and the beginning with the dogs barking and the hand over my bed reaching for the camera was missing.. yes someone was in my bedroom while I was asleep and my BF was in bed asleep with me. The other hard evidence was not digital.. I was in the bathroom and heard noise coming from under my home.. I screamed out for help to the people that had come over for a get together. They saw the guy run from under the house and they chased him about a block and jumped into a waiting minivan. The rest of evidence I had in video that I once could see actual break ins in process and video with excellent quality would with in a min turn to a smear of colors exta zoomed imaged glared lights .. that nobody believed that I saw the person committing the crime. I had kept the videos and images of my smeared proof with hopes that one day I could get help and reverse the editing that destroyed my proof. I don't have many left..
After living in fear with most of my belongings and valuable stolen a walked away from my purchased home to rent in a safer neighborhood. Un the process I lost my job my side business..the classic dismantle my truck crashed into while parked at night hit and run ofcourse and turbo taken out of sports car .. and almost losing my mental.. having to deal with "hacking" constantly having to change passwords removing my device form child restrictions or fighting with my own virus protection software that would be program to restrict me accessing help and getting error codes when accessing government agencies google cox and tmobile.. it was the worst I believe. I'm glad I'm safe but still with this issue issue.. I've been trying to learn on my own and I Google everything.. I mean every word I come across and YouTube if I need further clarification and I started taking some classes to understand and remove and prevent what is happening to me one day.
Sorry about the novel.. lol
I'm going to attach a sample of my smeared images and some images of the modification that I have currently maybe someone understand all of this
Where I'm at .. I bought this phone and did not connect to wifi disabled blue tooth and disabled automatic downloads and I had not even turned on my data .. so I looked into OTA .. over the air programing and issues with samsung the data breaches etc.. I talk to samsung they said the modifications was not via OTA .. the IT rep could have been right ?? Not sure yet .. how else could possibly else be .. (about 2 years ago I found in my google shared doc that I was sharing to other my experiments results with radio data communication.. and was very common for me to see the verbiage spectrum radio, RTU, Scada, unlicensed radio, IoT, Ericson, transmitting data over radio as a wifi alternative. Alot of the apps I had then had something to do with that technology and companies) My ignorance at the time told me it had something to do with the huge radio antena that came with the home.
So I revisited that idea as a possible entrance point of infection??
I found libav64 with over 1060 system files saved on my device
Also in the framework files I found several of Verizon files.. I have t mobile never had Verizon. Because I have a Verizon build enforcing t mobile .. tmobile support accused me of inserting a Verizon chip .. I explained that I don't have one and never did .. she asked me to return it manufactur and exchange for new one.
I'm having an issue with upload speed for the images so I will repost with just the images

Sentimental Sugarcube said:
I'm very sorry to hear that, I can't imagine what it's like to have to deal with this for such a long time. I slowly started losing my sanity when my devices were infected, especially my primary device (the Samsung Galaxy S9+), and had started becoming irrational at times due to the paranoia and lack of understanding about what had been going on the entire time.
I have yet to flash any of my devices, so I don't know just how well it'll work out doing so. What Android version is your Samsung Galaxy S8+, though? Because devices running on Android 9 (Pie) and up are pretty unique in the sense that the security rids the device of malware & spyware once a factory reset takes place, so if you have a newer operating system like you do on your Samsung Galaxy Note 20 Ultra 5G, then you may be able to fix that issue. Although, it would only clear up issues you have on your firmware/software & not be able to help issues you'd occur with a compromised hardware & network connection.
When I factory reset my Samsung Galaxy S9+ (which runs on Android 10), the oddity disappeared! I wish I had done it sooner or routinely, at least, because it would've saved me from so much stress & anxiety.
Although, as @JesseJamez55 mentioned, you may be directly targeted, and that makes a huge difference in the matter. I, for one, am not specifically in the center of attention — my best friend is, and I suppose I somehow got involved in this awfulness just for knowing about so many of the concerning experiences he's had in the last several years.
Click to expand...
Click to collapse
My situation isn't on Android only, it's my entire network which includes the following;
PC's
Android Phones
Android Tablets (No longer own)
Macbook Pro (No longer own)
MacBook Air (No longer own)
Chromebook (After allowing Linux via Developer Settings)
Router
Samsung Smart TV (No longer own)
Sony AV Receiver
My CCTV DVR System (No longer own)
Any other device that either connects to my network or can be accessed via the Nearby Devices pervasive permission within Android (This is my best guess for how devices are being infected when I haven't in any way accessed my network)
After all my research and some helpful clues/texts/emails sent to me, i found out that I am being specifically targeted by my upstairs neighbor that strongly dislikes me and finds me extremely amusing.
I won't go into further details but this is why I gave up. They are exponentially more fluent in cybersecurity than I could ever hope to be and since they have local access to my devices, I could never hope to win. I need to move which I will be doing very soon.
This is why I say if you are going through anything close to what I am then it's almost certainly a targeted attack. I'm sure there are other possibilities but this is what my experience is.
Do you ever use the Tor network? Depending on where you decided to browse or what you may have downloaded, you can get some especially nasty malware from there, too. Even just browsing some sites can deliver drive-by malware or not having your browser/firewall set up correctly is enough to lose your anonymity. Something to think about since it could be a government agency keeping tabs on you for a reason only you would know. Just a thought.I'll leave you with one final thought; would you honestly consider yourself a very interesting person? Do you have hobbies others would be interested in learning more about it they had the relevant skills to do so?After thinking about it, I do. I have my hobbies that I would find different or weird if I were someone else. So that mixed with some neighbors that have networking skills, are always home and way to damn nosy is how I got where I'm at.That's my real situation so just something to consider.

I am so glad I came across this thread. Honestly. Had the exact same issue Dec last year. Although I suspect they were in the network for a couple of years before I realised. Tried to solve it for 6 weeks. Gave up, threw all network devices out and started over. All good. For three months. Even with the most strictest routines in watching what I was clicking online, not downloading anything, updates ran regularly, new vpn and more costly antivirus and equipment. It returned.
I honestly don't think its a personal attack, but it's insane how it spreads. I've worked constantly on it since June. Contacted so many people. I can't afford to throw this new stuff out, don't have money to replace it all again. My doc sent me to see a psychiatrist. Said I'm delusional. I told them I was feeling stressed and exhausted just trying to boot whoever this was out of my network and life. Psychiatrist says I'm sane, just needing to relax and have someone actually listen to me.
I have 2 pcs, laptop, 3 mobile phones, xboxes and TV being controlled by whatever this is. Root trust certs are all wrong. Traffic being directed to http although looks legit as if its https. All have been flashed with wrong ota updates. I am considering flashing my phone but don't think it will help as will be doing it with infected pc... seems pointless.
I am starting to realise I have to live with it and just get on with stuff. I've been seriously slacking in work and been so focused on this malware/spyware/rootkit whatever it is.
Honestly it's a massive relief to know I am not alone.

I am having the same issue. What I have learned so far:
> The malware is a RAT
> It can infect and embed itself in most IoT capable devices and most anything that has RF capability, including BT, NFC, Zigbee, etc.
>It enumerates all devices in your local network. After this step it appears to inject malicious code into device drivers, specifically network interfaces. It then creates virtual network interfaces, swaps and/or spoofs MAC addresses on the devices in your network. For example, what appears to be your router on first glance, is actually your xbox or laptop which is now hosting all your devices while your router is throwing out hidden wifi networks that connect other devices.
>It creates virtual BT interfaces and is capable of discreetly connecting with other BT capable devices in the background.
>It appears to be sending a continous video/audio stream to servers located in New York and Ashburn, VA.
>It changes VPN settings for your carrier.
>It routes browser traffic to a CDN server so you get preloaded versions of certain webpages and apps.
>Some of the code I discovered in app manifests include instructions for the phone to access a created hidden camera interface called "hiddencamera0", while specifying that the led indicator for the camera remains turned off.
>It prevents me from doing a hard reset and won't allow usb or wireless debugging, making it impossible (for me at least) to flash a new OS to my device.
>When I removed certain DNS entries from the registry or updated my AD on any of my 4 Windows based computers, the OS was wiped. When it was reinstalled, the same activity resumed.
>Using simple network command prompts, I discovered early on that my computers had established connections with various servers, even with all of the network capable devices turned off. I was able to stop these by disabling each device.
>Each time the device is restarted, the malware seems to gain more control over the system.
>Antivirus software does not detect it and the only way I was able to see what was going on was to uninstall my antivirus and go into Windows Defender Firewall as an admin. There I was able to see over a hundred rules enabling communication between my device and the remote server. I immediately deleted the inbound and outbound rules, but they repopulated until I manually disabled each interface. The first time I did this on my laptop, my phone and my son's phone actually switched back to the appropiate mobile network for about 15 minutes. Then my computer reset itself and it went back to it's malware version of operation.
I will attach screenshots a bit later.
Oh y
sudo_null said:
I am having the same issue. What I have learned so far:
> The malware is a RAT
> It can infect and embed itself in most IoT capable devices and most anything that has RF capability, including BT, NFC, Zigbee, etc.
>It enumerates all devices in your local network. After this step it appears to inject malicious code into device drivers, specifically network interfaces. It then creates virtual network interfaces, swaps and/or spoofs MAC addresses on the devices in your network. For example, what appears to be your router on first glance, is actually your xbox or laptop which is now hosting all your devices while your router is throwing out hidden wifi networks that connect other devices.
>It creates virtual BT interfaces and is capable of discreetly connecting with other BT capable devices in the background.
>It appears to be sending a continous video/audio stream to servers located in New York and Ashburn, VA.
>It changes VPN settings for your carrier.
>It routes browser traffic to a CDN server so you get preloaded versions of certain webpages and apps.
>Some of the code I discovered in app manifests include instructions for the phone to access a created hidden camera interface called "hiddencamera0", while specifying that the led indicator for the camera remains turned off.
>It prevents me from doing a hard reset and won't allow usb or wireless debugging, making it impossible (for me at least) to flash a new OS to my device.
>When I removed certain DNS entries from the registry or updated my AD on any of my 4 Windows based computers, the OS was wiped. When it was reinstalled, the same activity resumed.
>Using simple network command prompts, I discovered early on that my computers had established connections with various servers, even with all of the network capable devices turned off. I was able to stop these by disabling each device.
>Each time the device is restarted, the malware seems to gain more control over the system.
>Antivirus software does not detect it and the only way I was able to see what was going on was to uninstall my antivirus and go into Windows Defender Firewall as an admin. There I was able to see over a hundred rules enabling communication between my device and the remote server. I immediately deleted the inbound and outbound rules, but they repopulated until I manually disabled each interface. The first time I did this on my laptop, my phone and my son's phone actually switched back to the appropiate mobile network for about 15 minutes. Then my computer reset itself and it went back to it's malware version of operation.
I will attach screenshots a bit later.
Click to expand...
Click to collapse
One more thing that is particularly disturbing: It appears to be connected to my vehicle BT and Uconnect interface. There is more, but I will inckude that later as well.

This is exactly what I am facing.
It seems like it has been a couple of years.
Yes the LED of the camera is off too.
Did you manage to solve it ?
Anyone with a solution?

To be honest I'm not into the cybersecurity field but it sounds like the ultimate type of malware - one that hacks everything conveniently. I hate to say it, but you might have to replace literally everything. You could try to at least backup some stuff that's important but you're going to have to look at the local technician to see what you need. I could provide some help for those who need it in this forum.
Glow1717 said:
Your completely right. I thank you for your feedback and I greatly appreciate it. I usually get laughed at or from IT support at cox or other companies that will explain how to what is happening to my digital life is none existent and has not been developed yet and send me on my way after a virus scan resulting in 0 threats.
Your also think your right been someone targeting me. At this point I need to get my foil hat.. I really don't share that thought because even my bf has advised me to get a mental health evaluation... I understand after hearing me try to figure it out for mths 24/7..
This is the reason why I believe that it is a possibility. When all this came about I lived in North Las Vegas it's pretty bad unfortunately I didn't know when I bought and moved in from California. I felt safe it's a gated community!
I'm just gonna lay it out and I know what I sound like and I did end up going to get checked out clean menta aside from some anxiety from all of this.
After moving in a mth later I had some tampering with my truck but wasn't sure maybe by accident I did it .. I was always on the run.. but a few wks later I heard the back door open and I asked who was there and I caught someone's backside running out. I figured some stupid curious teen .. so concerned me living alone employed running a company and also a side business flipping cars and a truck a sports car and a classic that I was rebuilding.. maybe was drawing attention of the wrong kind. I got me a dog! Problem fixed um no still night noises outside and once on the roof that my BF was there that night and we would call the Police dept.. over and over again. So time to get cameras. Started with the ring system I had cameras in every direction including a couple inside. It was amazing! For a day that night someone tripped by breaker lost power again we ran out it was the BF of the person that managed the community... another police report for the pile. To make it short unless I was looking at it live what ever that was recorded I would get to see it original video maybe once and when I would try to show someone video would be gone or edited (at the time I did not know that video could be edited or set privacy guards filters from amazon etc) also I would started to see at night someone with lazer pointers. Later I was told it would disable the camera. True or not after looking like a mad woman with claiming to have proof to call the police.. and I no longer had the evidence no matter where I would back It up to.. I was mad all that money on the ring for this BS.. so I got Canary then I got Alfred and a long list of cameras apps and all the same. Luckily I was giving some credit when on a motion in an inside my home you could see a hand reaching to move the camera a I was able to show my BF and a friend but by the time pd showed up the video had been edited and the beginning with the dogs barking and the hand over my bed reaching for the camera was missing.. yes someone was in my bedroom while I was asleep and my BF was in bed asleep with me. The other hard evidence was not digital.. I was in the bathroom and heard noise coming from under my home.. I screamed out for help to the people that had come over for a get together. They saw the guy run from under the house and they chased him about a block and jumped into a waiting minivan. The rest of evidence I had in video that I once could see actual break ins in process and video with excellent quality would with in a min turn to a smear of colors exta zoomed imaged glared lights .. that nobody believed that I saw the person committing the crime. I had kept the videos and images of my smeared proof with hopes that one day I could get help and reverse the editing that destroyed my proof. I don't have many left..
After living in fear with most of my belongings and valuable stolen a walked away from my purchased home to rent in a safer neighborhood. Un the process I lost my job my side business..the classic dismantle my truck crashed into while parked at night hit and run ofcourse and turbo taken out of sports car .. and almost losing my mental.. having to deal with "hacking" constantly having to change passwords removing my device form child restrictions or fighting with my own virus protection software that would be program to restrict me accessing help and getting error codes when accessing government agencies google cox and tmobile.. it was the worst I believe. I'm glad I'm safe but still with this issue issue.. I've been trying to learn on my own and I Google everything.. I mean every word I come across and YouTube if I need further clarification and I started taking some classes to understand and remove and prevent what is happening to me one day.
Sorry about the novel.. lol
I'm going to attach a sample of my smeared images and some images of the modification that I have currently maybe someone understand all of this
Where I'm at .. I bought this phone and did not connect to wifi disabled blue tooth and disabled automatic downloads and I had not even turned on my data .. so I looked into OTA .. over the air programing and issues with samsung the data breaches etc.. I talk to samsung they said the modifications was not via OTA .. the IT rep could have been right ?? Not sure yet .. how else could possibly else be .. (about 2 years ago I found in my google shared doc that I was sharing to other my experiments results with radio data communication.. and was very common for me to see the verbiage spectrum radio, RTU, Scada, unlicensed radio, IoT, Ericson, transmitting data over radio as a wifi alternative. Alot of the apps I had then had something to do with that technology and companies) My ignorance at the time told me it had something to do with the huge radio antena that came with the home.
So I revisited that idea as a possible entrance point of infection??
I found libav64 with over 1060 system files saved on my device
Also in the framework files I found several of Verizon files.. I have t mobile never had Verizon. Because I have a Verizon build enforcing t mobile .. tmobile support accused me of inserting a Verizon chip .. I explained that I don't have one and never did .. she asked me to return it manufactur and exchange for new one.
I'm having an issue with upload speed for the images so I will repost with just the images
Click to expand...
Click to collapse
You need to right now remove the malware, as that's the problem. The symptoms of this malware seems to be that people randomly attack you because they know your location and are listening to you 24x7. You remove that malware first and then fix the home security later. Good luck

This seems a bit over-exaggerated, the "dangerous" processes you're talking about actually look like normal services on a samsung device lol, it's not uncommon for some frameworks and stuff to have a lot of privileges, the message you're saying you see on boot could maybe be the:
Code:
The phone is not running Samsung's official software. You may have problems with features or security. and you won't be able to install software updates.
This is typical for a bootloader unlocked/modified device, feel free to send photos of the messages you're describing, and it can help point into the correct direction.
The "traced" app you're using seems very misinforming though. The Call app having permissions to call and read storage/contacts is normal.
If you're really that paranoid about random services (which look fairly normal) - feel free to format everything, debloat down to the core OS, wrap your walls in tin-foil, throw out your phone and hide under your bed lol (sarcasm)

rainyskye said:
This seems a bit over-exaggerated, the "dangerous" processes you're talking about actually look like normal services on a samsung device lol, it's not uncommon for some frameworks and stuff to have a lot of privileges, the message you're saying you see on boot could maybe be the:
Code:
The phone is not running Samsung's official software. You may have problems with features or security. and you won't be able to install software updates.
This is typical for a bootloader unlocked/modified device, feel free to send photos of the messages you're describing, and it can help point into the correct direction.
The "traced" app you're using seems very misinforming though. The Call app having permissions to call and read storage/contacts is normal.
If you're really that paranoid about random services (which look fairly normal) - feel free to format everything, debloat down to the core OS, wrap your walls in tin-foil, throw out your phone and hide under your bed lol (sarcasm)
Click to expand...
Click to collapse
And remember kids, if someone tells you "the government wouldn't do that!", Oh yes they would.

rainyskye said:
This seems a bit over-exaggerated, the "dangerous" processes you're talking about actually look like normal services on a samsung device lol, it's not uncommon for some frameworks and stuff to have a lot of privileges, the message you're saying you see on boot could maybe be the:
Code:
The phone is not running Samsung's official software. You may have problems with features or security. and you won't be able to install software updates.
This is typical for a bootloader unlocked/modified device, feel free to send photos of the messages you're describing, and it can help point into the correct direction.
The "traced" app you're using seems very misinforming though. The Call app having permissions to call and read storage/contacts is normal.
If you're really that paranoid about random services (which look fairly normal) - feel free to format everything, debloat down to the core OS, wrap your walls in tin-foil, throw out your phone and hide under your bed lol (sarcasm)
Click to expand...
Click to collapse
I love how we are calling them schizophrenias, when they clearly need help with cleaning a serious infection on their devices

fillwithjoy1 said:
I love how we are calling them schizophrenias, when they clearly need help with cleaning a serious infection on their devices
Click to expand...
Click to collapse
could that infection be called "blink" by any chance? it's a serious piece of software that makes its way onto every windows and android device without user discretion. that sounds a lot like what's happening, and blink has the ability to utilize any active internet connections when activated.

pmnlla said:
could that infection be called "blink" by any chance? it's a serious piece of software that makes its way onto every windows and android device without user discretion. that sounds a lot like what's happening, and blink has the ability to utilize any active internet connections when activated.
Click to expand...
Click to collapse
Possibly could be, but it does seem like the OP would need to completely reset their devices which won't be easy

Database Info

welcome