Android kernel - Security Discussion

Could someone tell me why the hell the Android kernel or shell need to communicate with the internet? I have installed a firewall in my phone and I waas disturbed to find out that for some reason, android shell and kernel have access to internet.
FYI, I use the firewall to prevent suspicious applications from communicating with the internet, and keep them isolated.
Of course, I have denied access to the kernel and shell, and everything seems to be working fine.
I currently run android 4.2.2 cyanogenmod 10.3 on a LG optimus 4x.

shadowcore said:
Could someone tell me why the hell the Android kernel or shell need to communicate with the internet? I have installed a firewall in my phone and I waas disturbed to find out that for some reason, android shell and kernel have access to internet.
FYI, I use the firewall to prevent suspicious applications from communicating with the internet, and keep them isolated.
Of course, I have denied access to the kernel and shell, and everything seems to be working fine.
I currently run android 4.2.2 cyanogenmod 10.3 on a LG optimus 4x.
Click to expand...
Click to collapse
Kernel has internet access, well because you want your device to internet access. The kernel pretty much has access to everything (outside of things lower than it. Kernel is the heart of the OS.
Shell user itself doesn't automatically have internet access, however when using adb shell one of the permissions granted to it is the internet permission (see /etc/permissions/platform.xml or on newer devices Shell.apk/AndroidManifest.xml). This is needed for debugging purposes mainly.

jcase said:
Kernel has internet access, well because you want your device to internet access. The kernel pretty much has access to everything (outside of things lower than it. Kernel is the heart of the OS.
Shell user itself doesn't automatically have internet access, however when using adb shell one of the permissions granted to it is the internet permission (see /etc/permissions/platform.xml or on newer devices Shell.apk/AndroidManifest.xml). This is needed for debugging purposes mainly.
Click to expand...
Click to collapse
Kernel's access to internet is used, for example, while playing youtube videos. Don't know why, though. If you block kernel access you won't be able to play videos.
I can suppose youtube has to use some kernel functions (maybe the ping?) to decide what's the fastest server to download data from.
I did a reverse lookup on blocked ip address and found:
PTR 173.194.70.95 fa-in-f95.1e100.net 24 hrsPTR 74.125.232.144 mil02s05-in-f16.1e100.net 24 hrs
1e100.net is registered to google. maybe they are the streaming servers.

Related

Connect to adhoc Wifi network

Hi,
I need the captivate to be able to connect to a adhoc wifi network created using my laptop. However, android doesn't seem to be supporting it, just access point networks. Has anyone tried this, any success?
Searching revealed one thread where a guy modified some code on an htc phone, and got it to work, but seemed a little dated. Not sure if that would work with the android 2.1 and the Samsung phone.
Help appreciated.
The Captivate can connect to ad-hoc networks, but not through the native GUI interface. I tested mine via adb shell issuing some iwconfig commands via script to connect to a MyWi router on a friend's iPad. It's buggy, to say the least..
agentdr8 said:
The Captivate can connect to ad-hoc networks, but not through the native GUI interface. I tested mine via adb shell issuing some iwconfig commands via script to connect to a MyWi router on a friend's iPad. It's buggy, to say the least..
Click to expand...
Click to collapse
agentdr8,
Thanks for the reply.
Care to share details on the commands you ran? Or are you saying it's not worth it because it's so buggy?
thanks
To avoid a hard lockup, start with the wifi turned off. I tested it numerous times with it already on, and it resulted in a battery pull.
You'll need busybox 1.7x (maybe 1.8x will work too?). You'll also need a working iwconfig binary (I symlinked mine from the WifiTether app dir: /data/ext2data/data/android.tether/bin to /system/xbin)
With an adb shell, try something like this:
$ su
# /system/xbin/ifconfig eth0 up
# /system/xbin/iwconfig eth0 mode ad-hoc
# /system/xbin/iwconfig eth0 essid YourEssidHere
# /system/xbin/iwconfig eth0 key WEPkeyhere
Now with wifi turned off, these commands will all error since the interface is down/off (eth0 is the wifi, at least on my Cap). Turn your wifi on and rerun the same commands, followed by:
# netcfg eth0 dhcp
This may or may not error out, but ultimately, you should see a dhcp address for eth0 as handed out by your dhcp server/mywi device.
You may need to also manually add the ad-hoc network in the GUI with its key. I can't remember if I needed that or not, but with it I can see the connection status and when it's grabbing the IP. Even shows connected and signal strength once it does connect (assuming it doesn't lockup).
agent can you help me pls. Im a newbie still.
Do i run all those commands in windows when my phone is connected or do i run it through something like terminal emulator an app on the phone??
You can either use adb shell on your Windows machine (part of the Android SDK), or you can use a terminal on the device itself (ConnectBot is my preferred). Your phone needs to be rooted if it isn't already.
Okay, I'll try out the connectbot. Can you tell me how to do this part then if it's needed??
"You'll also need a working iwconfig binary (I symlinked mine from the WifiTether app dir: /data/ext2data/data/android.tether/bin to /system/xbin)"
how do you do this symlinked part?? I don't really understand it.
I tried ur commands without doing the symlinked part....everything just returned a "not found" message.
Maybe you could give me a dumbed down step by step way of doing this hahahaha??? Im rooted and i have busybox 1.7x, just missing the working iwconfig because im not really sure what it is.
If you're not too familiar with linux commands, it would be best to wait for someone to build a widget/GUI app around this, as poking around in a root shell on your phone is never a good idea if you're not aware of the potential consequences of blindly running commands.
It's possible that with the Froyo update adhoc connections may just work as intended, not that I've read anything that suggests that.
The portal had a write up on how to connect an android device to an adhoc network a couple days ago.
Sent from my AOSP on XDANDROID MSM using XDA App
boborone said:
The portal had a write up on how to connect an android device to an adhoc network a couple days ago.
Sent from my AOSP on XDANDROID MSM using XDA App
Click to expand...
Click to collapse
Okay, i'll go look for it though a link would help.
Maybe i'll just wait until something like Cyanogens ROM comes, i hear it usually comes with ad-hoc connectivity.
Try this: http://www.xda-developers.com/android/android-ad-hoc-wireless-network-support/
Sent from my HTC Dream using XDA App
only problem is it's compiled for froyo and i think geared towards the Desire according to the replies.
I feel like it might mess up my captivate
Well if you're computer is windows7 you can use a program called conectify.
It makes win7's adhoc networks work as real hotspots
Sent from my HTC Dream using XDA App
Wanted to enable ad-hoc so I could tether the captivate to my iPhone
Yes I woild also know on a workaround , would love to tether my unlimited data from my iphone to my captivate
pewpewbangbang said:
Wanted to enable ad-hoc so I could tether the captivate to my iPhone
Click to expand...
Click to collapse
Why would you do that? Do you prefer safari over android browser or something?
Sent from my Nexus One using XDA App
cowballz69 said:
Yes I woild also know on a workaround , would love to tether my unlimited data from my iphone to my captivate
Click to expand...
Click to collapse
Then You need to jailbreak your iphone and get a tethering app
boborone said:
Then You need to jailbreak your iphone and get a tethering app
Click to expand...
Click to collapse
Issue isn't on iPhone-end, nor wpa-supplicant end (as the wpa-supplicant binary included in the android wireless tether app has this ability).
The problem is the GUI end of things (i.e., settings.apk) ALSO filters the results.
So it goes beyond simpy modifying the wpa-applicant (yes; this is sufficient for the basic-functionality), but is very crude & diffcult to do on the go from the tiny terminal emulator, etc.
What I've personally been looking for, is an update that modifies the neceasary files, and enables this extewmely useful function.
Something similar to the update package posted for the froyo-build, but instead for the ECLAIR-2.1 build of the captivate.
If anyone knows of anything availible like I'm describing (a GUI-centered mod that will remove ALL the STUPID damn (pardon language lol) IBSS filtration form the settings.apk, wpa-supplicant, wireless configuration files, etc for the ECLAIR-2.1 build of the Captivate so that it JUST WORKS lol -- this way we can SEE and CONNECT via our native GUI .
I've gotten this to work through running command line / configuration file hacks, but it's very messy/annoying AND to make things MORE annoying, once you've put it into Ad-hoc mode and have it all setup very nicely, guess what? The settings.apk application (which is needed to load the device into kernel), will actually COMPLETELY UNDO all the tedious command line efforts you've just made, and takes the wifi chip out of Ad-hoc mode every x amount of minutes! ARGH!! LOL!
Anyway, I've gone through the source code and patch diff's myself and it really doesn't seem very involved. I actually was planning on compiling the necessary modded binary (making a nice update.zip for all the frustrated captivate owners like myself lol), but I simply haven't had the time to setup the build environment for it at the moment (have several other build environments I'm juggling as it is with work).
Anyway, I apologize for the rant lol -- I just wanted to clarify exactly what is needed and point out it really wouldn't be much work (and would be VERY much appreciated!!!!) if someone with the skill, time, and a build environment for the galaxy s (captivate, speifically lol , could post an eclair mod for us -- you would receive AN ENORMOUS amount of praise & thanks lol .
OR -- if someone who has a little time, could simply modify the android wireless-tether-app to have one extra feature, 'connect to ad-hoc network' lol . This would also be ideal, as it already fully supports the initialization & loading of the captivate wireless driver properly, and can fully manage the interface & connections while running in the background (independent of settings.apk). PLUS -- it even already has full ad-hoc support built into it's own pre-packaged wpa-supplicant. Basically, all the hard work has already been done with the wireless-tether-app, just need a few extra functions to handle scanning for networks and connecting to them (relatively simple, considering they've already done ALL the hard work..lol)..
Okay, my rant is officially done! Lol! I just hope this helps those who have the capability to help, give a clear picture of all that's required. It's late, so some of this stuff may have already been mentioned and I missed it! Shoot, maybe someone just finished doing exactly what I just went on & on about? Lol.
In any case, if anyone is willing to help out -- or already knows of a solution already out there I've missed -- PLEASE let me' know! This functionality would truly help a great deal in my day to day work with my captivate! Thanks in advance!!!
holy need a bump batman!
i would really like this too!
I found this post last night, but I couldn't get it to work: http://forum.xda-developers.com/showpost.php?p=16632147&postcount=7758

[Q] JNI loading of kernel module

I was wondering if it is possible to load a kernel module from an application using jni as is done in hardware/libhardware_legacy/wifi/wifi.c
The main issue I see is that this would probably require the application/user to have root. I am trying to find if this is in fact the case.
If one does need root to do such an activity, is there any other way to hook netfilter? I am not trying to work on tethering, in case people are wondering.
Hi, despite using JNI, you will still need root to insmod the kernel module.
I have quite a bit of experience with Netfilter and LKM development, what is it you're trying to do precisely?
I am more interested in developing a firewall/application monitor, because I have an Incredible and after the update I was a little upset by all of the applications that a) get loaded and b) start up from boot and finally c) stay loaded and wont ever close. But if I am unable to do this without root it is kind of a worthless application for the average person. It could still be beneficial for root users to see who is connecting to the web at any given time and monitor which applications use it or setup rules like block everyone but who one would like to allow the ability to access the outside world.
Thanks for the reply though.

[Q] Cisco VPN

Would it be possible with the transformer? I need to set gateway, group name, group password, user name and userpassword. I don't see the group fields in the vpn configuration.
I would rather not root.
Yes, I really want know too if anybody knows about Cisco VPN. I heard somewhere Cisco built the client for Android but I have not found it anywhere.
The only client that I know working is VPN Connections (my friend has it working in his Evo phone), but it requires root access, so I have not tried it yet in my transformer.
Nothing available as of yet, I've spent hours searching.
Samsung had announced they were including this on the 10.1, however I posted the question in that forum, and it was not included in the initial release.
More on this topic at http://code.google.com/p/android/issues/detail?id=3902&cnum=500&cstart=1233#makechanges
I got this working last night !
I am running Prime 1.4 which includes the tun.ko kernel module which is needed. Then install this app: http://code.google.com/p/get-a-robot-vpnc/
The app is designed for phones, looks absolutely terrible on a tablet, and is unusable in portrait mode. BUT with all that said, I created a profile, entered the vpn address, group name, group password, username and left the user password blank (token auth for me). I set it up to load tun.ko automatically. long press the profile and select "Connect", got prompted for my password, entered it and bam! I'm vpn'd into my work cisco vpn.
Good luck.
That is super news that you got it working! The project is open source, so making it tablet friendly will surely happen. But installing a kernel module means having root.
ppirate said:
That is super news that you got it working! The project is open source, so making it tablet friendly will surely happen. But installing a kernel module means having root.
Click to expand...
Click to collapse
Indeed it does. I'm actually surprised/disappointed tun.ko is not a standard on all devices. I'd also like to see cifs.ko standard, but there are far fewer people tht wold find that useful I think.
If I understand correctly, the only thing asus would have to do is add tun.ko to the modules. Then everything can be done in userland.
One other link I found was the following:
https://www.nixuopen.org/blog/2011/5/android-and-cisco-ipsec-vpn/
This nicely integrates the cisco vpn support into android. This would be the perfect solution.
Starting with Cisco ASA version 8.4(1) Cisco is supporting Android remote clients using Android native VPN client (only L2TP/IPsec is supported at this point)
http://www.cisco.com/en/US/docs/security/asa/asa84/release/notes/asarn84.html
I hope Google will include a full featured VPN client (group support, etc.), and Cisco will provide clientless VPN support for Android devices.
lqaddict said:
Starting with Cisco ASA version 8.4(1) Cisco is supporting Android remote clients using Android native VPN client (only L2TP/IPsec is supported at this point)
http://www.cisco.com/en/US/docs/security/asa/asa84/release/notes/asarn84.html
Click to expand...
Click to collapse
Aha, this might be useful for me. One of the vpn addresses at my uni starts with asa1vpn.* . Thus in my case it might work, I'll probably better send the IT department the above link, they will help me further.
Though I still hope native cisco vpn gets supported in android.
Cisco is supposed to release the anyconnect ssl vpn client for android....but knowing how cisco works ot may be a while. Its supposed to be on their cius tablet.
Sent from my DROIDX using XDA App
timekillerj said:
I got this working last night !
I am running Prime 1.4 which includes the tun.ko kernel module which is needed. Then install this app: http://code.google.com/p/get-a-robot-vpnc/
The app is designed for phones, looks absolutely terrible on a tablet, and is unusable in portrait mode. BUT with all that said, I created a profile, entered the vpn address, group name, group password, username and left the user password blank (token auth for me). I set it up to load tun.ko automatically. long press the profile and select "Connect", got prompted for my password, entered it and bam! I'm vpn'd into my work cisco vpn.
Good luck.
Click to expand...
Click to collapse
How did you setup tun.ko to auto load? I've got get-a-robot-vnc working on my HTC Supersonic running CM7 out of the box. However, on TF104 running Prime 1.4 when I try to connect, I get an immediate "Failed to Connect" error. I'm guessing the tun.ko module is not loaded.
Looking online, I searched for the tun.ko module via "find -iname tun.ko" and found it at "/system/lib/modules/tun.ko"
To load it I did "inmod /system/lib/modules/tun.ko" and got a # prompt which I think is expected (I'm linux dumb).
I went back to VPN Connections and got the same error.
Looking at the LogCat, VPN_Connections is saying that tun doesn't exist
Edit in:
ok I think I had a typo in my command up there, should be ins[/]mod. When I run that command, I get "insmod: init_module '/system/lib/modules/tun.ko' failed (File exists)
jefbal99 said:
How did you setup tun.ko to auto load? I've got get-a-robot-vnc working on my HTC Supersonic running CM7 out of the box. However, on TF104 running Prime 1.4 when I try to connect, I get an immediate "Failed to Connect" error. I'm guessing the tun.ko module is not loaded.
Looking online, I searched for the tun.ko module via "find -iname tun.ko" and found it at "/system/lib/modules/tun.ko"
To load it I did "inmod /system/lib/modules/tun.ko" and got a # prompt which I think is expected (I'm linux dumb).
I went back to VPN Connections and got the same error.
Looking at the LogCat, VPN_Connections is saying that tun doesn't exist
Edit in:
ok I think I had a typo in my command up there, should be ins[/]mod. When I run that command, I get "insmod: init_module '/system/lib/modules/tun.ko' failed (File exists)
Click to expand...
Click to collapse
I had this problem as well. Doing a full wipe including cache and dalvik then reflashing prime 1.4 cleared that up for me.
Here is where I am at now. I can connect to the VPN, checking the netcfg from the shell or terminal emulator shows that my tunnel interface is up and has an IP address but when I attempt to use the connection either by web browser or ping from within the shell the tunnel interface drops out.
Checking the last connection log I can see the MOTD banner pop up and show I am connected then I see the following;
Device "wlan0
wlan0" does not exist
RTNETLINK answers: No such device
cp: can;' stat '/etc/resolv.conf' : No such file or directory
process stderr Device "wlan 0
wlan0" does not exist
RTNETLINK answers: No such device
cp: can;' stat '/etc/resolv.conf' : No such file or directory
Connection string detected
velocd said:
I had this problem as well. Doing a full wipe including cache and dalvik then reflashing prime 1.4 cleared that up for me.
Here is where I am at now. I can connect to the VPN, checking the netcfg from the shell or terminal emulator shows that my tunnel interface is up and has an IP address but when I attempt to use the connection either by web browser or ping from within the shell the tunnel interface drops out.
Checking the last connection log I can see the MOTD banner pop up and show I am connected then I see the following;
Device "wlan0
wlan0" does not exist
RTNETLINK answers: No such device
cp: can;' stat '/etc/resolv.conf' : No such file or directory
process stderr Device "wlan 0
wlan0" does not exist
RTNETLINK answers: No such device
cp: can;' stat '/etc/resolv.conf' : No such file or directory
Connection string detected
Click to expand...
Click to collapse
Fixed this issue by applying this fix in the link below.
http://bugs.gentoo.org/show_bug.cgi?id=331445
I also placed a set-x command at the beginning of the VPNC-script file to get a better debug in the lastconnection.log
Now I am seeing the following error;
+ fix_ip_get_output
+ sed s/cache//;s/metric \?[0-9]\+ [0-9]\+//g;s/hoplimit [0-9]\+//g
+ /system/bin/ip route add
RTNETLINK answers: No such device
I can still connection and in the log I can see the router tables build but I am having issues getting the data to pass through the tunnel. The tun0 interface drops as soon as I attempt to pass date through it.
Anyone have any ideas?
tun.ko / VPN Connections does NOT work on Prime 1.4.
Even if it looks like it is working it does not pass traffic through the tunnel.
M-A-A said:
tun.ko / VPN Connections does NOT work on Prime 1.4.
Even if it looks like it is working it does not pass traffic through the tunnel.
Click to expand...
Click to collapse
Yup, my problems were related to a lack of SuperUser providing root access to the VPN Connections software. I got the updated binary and it says it connects, but disconnects within minutes.
Must be a bug in either HoneyComb or the Prime 1.4 ROM. I have VPN Connections fully functioning on my HTC Supersonic running CM7
I checked out the project from the SVN, changed the target to Android 3.1 and rebuilt it.
Now, the UI is a lot better.
The thing that happens to me (it happened before), is that the apps stays on trying to disconnect. I checked on the ASA (the device that manages the connection), and it's not there... So dunno. I just kill the app...
I've attached the program below. Its license is GPLv3 so there shouldn't be a problem.
sh337 said:
I checked out the project from the SVN, changed the target to Android 3.1 and rebuilt it.
Now, the UI is a lot better.
The thing that happens to me (it happened before), is that the apps stays on trying to disconnect. I checked on the ASA (the device that manages the connection), and it's not there... So dunno. I just kill the app...
I've attached the program below. Its license is GPLv3 so there shouldn't be a problem.
Click to expand...
Click to collapse
This definitely looks a lot better! We just need to get the backend stuff working now
M-A-A said:
This definitely looks a lot better! We just need to get the backend stuff working now
Click to expand...
Click to collapse
What do you mean? It is working for me...
sh337 said:
What do you mean? It is working for me...
Click to expand...
Click to collapse
When I connect to my corp network, no packets flow. As soon as I try to access anything, the VPN session drops.
sh337 said:
What do you mean? It is working for me...
Click to expand...
Click to collapse
You have it passing traffic through the tunnel?

[Q] Android terminal nslookup issue

I have a transformer prime running ICS. when I use terminal emulation, I can not make my nslookup work. I can ssh to any server by IP but could not resolve DNS. My TP can get on internet no problem but for some reason, the terminal did not work with any DNS.
Where is the resolve.conf? How the android setup network interface? DNS?
Does anyone had the same issue?
chao0129 said:
I have a transformer prime running ICS. when I use terminal emulation, I can not make my nslookup work. I can ssh to any server by IP but could not resolve DNS. My TP can get on internet no problem but for some reason, the terminal did not work with any DNS.
Where is the resolve.conf? How the android setup network interface? DNS?
Does anyone had the same issue?
Click to expand...
Click to collapse
Yea, there's a lot of threads over the internet about this specific issue. The people that 'know their crap' say that we (like we compiled the binaries or something) compiled without the correct libraries.
Problem is, I didn't compile shiz, so they should really yell at the devs to compile with the correct libraries... OR tell us how to link the correct libraries AND give us a link to the correct binaries.
!!EDIT!!
Turns out, if you use the jrummy busybox installer to update busybox to the latest release, the terminal apps you use aren't updated (because of obvious reasons) so you have to do a little hacking for it to use the correct binaries (like, say remove their system dirs and link to xbin?)

PPP connection with android

I am trying to set up a PPP connection from a Zte MF820b 4G LTE USB modem/router to a WiFi only Android tablet with a 4.2.2 os that has a custom ROM installed which technically shouldnt of been jailbroken. The tablet is running a Linux version 2.4.3 and KERNEL:3.0.36. The problem here is me. I am a complete newbie, but do know a little about command prompts and how this should work in theory. The tablet is fully rooted and has all the necessary applets installed via busy box(chat, nc, pppd, ect) and terminal emulator, or at least I think that's what's necessary. I installed PPPwidget 2 and 3 but as apk's and since they are not from the Play Store will not function. I have Google play store installed but its all but useless since I can not log into my account, for reasons I suspect as being that the system is too old and says something about the connection not being secure or private and as such...can not actually get the app with license verification from Google play store. I tried to lucky patch the apk and remove license verification but that did nothing as well. However the apk will read the modem and ask permission to allow pppwidget to be used but shortly fail after for the aforementioned lack of correct license. There must be a way to manually call the modem and connect via terminal emulator using adb ppp or nc? Without any understanding on how to actually write a script I'm hoping someone can help me get this functioning. Situation beyond current controll will not allow me to work with anything other than what's at hand, and I'm willing to pay for someones time if I can actually get this working. I also have a tablet with a different os (8.1 Oreo) should that be easier. With the 4.2.2 the device pops up as "storage" in my file manager. With the 8.1 it pops up as a device Id number when I type in lsusb in my terminal emulator. The 8.1 has Termux installed should that open up a different venue. The carrier I'm using is T-Mobile and the nameserver and ISP info is NS1-AUTH.SPRINTLINK.NET; IP 206.228.179.10. The device is functional as when the opportunity arose I was able to plug up to a computer and try it out. That's no longer viable. Again, I'm willing to pay for the help as I'm sure I'll need to correspond back and forth a few times and will probably need help writing the correct script if needed. Please email me @ [email protected]. Thank you.

Categories

Resources