IMPORTANT --- Security Flaw in TapaTalk - Security Discussion

If you're site is using TapaTalk, update now! There was a security flaw found in TapaTalk and they decided NOT to inform anyone or advise anyone to update their files.
I did not find out until today, when I just happen to scroll over and found a post about it.
They even publicly admit to patching it silently, but NOT issuing a release or any notice telling people they should replace their files (because they did not even bother changing the version number either).
So I can only imagine how many sites are using the other copy without knowing they have a problem. This is completely irresponsible.
TapaTalk said:
Hi,
This issue has been addressed in April 26th, 9 days before this site published the issue. However, since this is a low risk item - we have simply replaced all the plugins that are affected. If this is concerning you and If you have updated the plugin after April 26th, you are not affected.
Click to expand...
Click to collapse
Source: https://support.tapatalk.com/threads/tapatalk-cross-site-scripting-vulnerability.24719/#post-131407
attached screenshot to confirm

Socially Uncensored said:
If you're site is using TapaTalk, update now! There was a security flaw found in TapaTalk and they decided NOT to inform anyone or advise anyone to update their files.
I did not find out until today, when I just happen to scroll over and found a post about it.
They even publicly admit to patching it silently, but NOT issuing a release or any notice telling people they should replace their files (because they did not even bother changing the version number either).
So I can only imagine how many sites are using the other copy without knowing they have a problem. This is completely irresponsible.
Source: https://support.tapatalk.com/threads/tapatalk-cross-site-scripting-vulnerability.24719/#post-131407
attached screenshot to confirm
Click to expand...
Click to collapse
Thanks for the heads up - we actually do use this plugin, even though we have this particular 'smartbanner' plugin disabled, I removed the files just to be safe.

bitpushr said:
Thanks for the heads up - we actually do use this plugin, even though we have this particular 'smartbanner' plugin disabled, I removed the files just to be safe.
Click to expand...
Click to collapse
You're welcome.
Wish that they (TapaTalk) had informed you about it (as well as everyone else they should have informed). As a part-time webmaster / administrator, I know how frustrating these little things can be. I also know I use a lot of the goodies I find here on XDA and would always want it safe and secure. So when I found out about this, figured I should inform a few places including here.
Glad I could be of some help

I am a user of a different forum that was taken off Tapatalk this week for good due to 'security and privacy concerns' - so they told me.
Is it a risk to use Tapatalk?
Is there a possibility that user account details/credentials could be harvested like those Snapchatters recently who used an unofficial app?

Related

[UPDATED] Samsung firmwares may close

Just thought some people not following their twitter might want to know:
@SamsungFirmware: BAD NEWS MAYBE WE HAVE TO CLOSE OUR WEBSITE! BECAUSE COPYRIGHT! We are checking it out.
This was posted an hour ago
UPDATE:
@SamsungFirmware: We missed a Disclaimer about our website.. We fix it all tonight and hope we keep running!
UPDATE:
Updates from their twitter:
@SamsungFirmware: Samsung wants my domain... Because of the name. samsung-firmware.com is already down they have the same problem.
@SamsungFirmware: We are busy with a new domain so site could be offline soon again YEAH
@SamFirmware: Site DOWN Why because we change it to www.SamFirmware.webs.com Later we go to www.SamFirmware.com
In the last post you can see they changed their twitter name
Sent from my SAMSUNG-SGH-I897 using XDA App
ronandi said:
Just thought some people not following their twitter might want to know:
@SamsungFirmware: BAD NEWS MAYBE WE HAVE TO CLOSE OUR WEBSITE! BECAUSE COPYRIGHT! We are checking it out.
This was posted an hour ago
Sent from my SAMSUNG-SGH-I897 using XDA App
Click to expand...
Click to collapse
this is bad news indeed!
Looks like they have to go... underground
Quick everyone, Start downloading and archiving it all before it is too late!
ronandi said:
Just thought some people not following their twitter might want to know:
@SamsungFirmware: BAD NEWS MAYBE WE HAVE TO CLOSE OUR WEBSITE! BECAUSE COPYRIGHT! We are checking it out.
This was posted an hour ago
Sent from my SAMSUNG-SGH-I897 using XDA App
Click to expand...
Click to collapse
Not sure how its a copy writing issue, they aren't making any money off samsungs property (roms). They aren't editing them and releasing them as a samsung property....should be interesting.
Sent from my GT-I9000 using Tapatalk
Clienterror said:
Not sure how its a copy writing issue, they aren't making any money off samsungs property (roms). They aren't editing them and releasing them as a samsung property....should be interesting.
Sent from my GT-I9000 using Tapatalk
Click to expand...
Click to collapse
I've asked if they can provide any more details at this time. Will post if I find out more.
Sent from my SAMSUNG-SGH-I897 using XDA App
You don't have to do anything wrong to get a letter from a company lawyer. If some exec gets a bug up his butt and sics his legal department on you, right and wrong have nothing to do with it.
dc41 said:
You don't have to do anything wrong to get a letter from a company lawyer. If some exec gets a bug up his butt and sics his legal department on you, right and wrong have nothing to do with it.
Click to expand...
Click to collapse
That's true. But out of curiosity I've been looking up forms of copy write laws, and they all basically deal with either taking someone's work and putting your name on it exclusively, or selling it or both, or a combination of the two. Besides that the rest applies to copying music which is obviously considered illegal but that is still kind of a gray area. And of course copying games and programs.....but that's targeted towards paid games/apps. So as far as "Copy write infringement" by definition it holds no water. Then again if someone can sue NC Soft for making Linage II too addicting and actually successfully start a lawsuit anything could happen rofl.
I can see why they would get in copyright hot water over what they do. All the work that they host is technically property of Samsung and their partners after all. I would hate for them to be killed off, as their releases have helped us a lot. Samsung should think twice about this though, because I bet without the glimmer of hope shown by the GPS improvements in JH2, there would have been a lot more returns Samsung would be dealing with.
New update from their twitter:
@SamsungFirmware: We missed a Disclaimer about our website.. We fix it all tonight and hope we keep running!
Sent from my SAMSUNG-SGH-I897 using XDA App
Well, either they've taken it down for updating, or it's down completely, either way I can't get to it right now.
From facebook:
Samsung-Firmware Webs SITE IS DOWN. WE HAVE TROUBLE WITH SAMSUNG. WE ARE WORKING ON NEW DOMAIN,
way to have your **** together... >.<
It figures, the day that I decide I'm going to update. Hope they can get it back up soon.
Updates from their twitter:
@SamsungFirmware: Samsung wants my domain... Because of the name. samsung-firmware.com is already down they have the same problem.
@SamsungFirmware: We are busy with a new domain so site could be offline soon again YEAH
@SamFirmware: Site DOWN Why because we change it to www.SamFirmware.webs.com Later we go to www.SamFirmware.com
In the last post you can see they changed their twitter name as well
Sent from my SAMSUNG-SGH-I897 using XDA App
rajendra82 said:
I can see why they would get in copyright hot water over what they do. All the work that they host is technically property of Samsung and their partners after all. I would hate for them to be killed off, as their releases have helped us a lot. Samsung should think twice about this though, because I bet without the glimmer of hope shown by the GPS improvements in JH2, there would have been a lot more returns Samsung would be dealing with.
Click to expand...
Click to collapse
So if they are getting in trouble due to basically posting roms from samsung and nothing else what do you call it when people modify their original code to make custom roms? Are they going to jail because not only are they posting samsung property their modifying without samsungs permission.
This is probably a trademark issue, since their domain included Samsung in its name. If it was a copyright issue, they couldn't just change the domain name and continue operating.
Sent from my Nexus One using XDA App
Clienterror said:
So if they are getting in trouble due to basically posting roms from samsung and nothing else what do you call it when people modify their original code to make custom roms? Are they going to jail because not only are they posting samsung property their modifying without samsungs permission.
Click to expand...
Click to collapse
Dont forget that what xda does is illegal too, but its been tolerated by the companies so far because of the positive effects xda has on the popularity of the smartphones from these companies.
I dont think that samsung has a problem with what these website does, but purely of the use of her brandname. For example: the first time i heard of samsung-firmwares i thought it was something official by samsung. After visiting xda i learned it was not.
So the reason is just that samsung doesnt want to be associated with this website, because of the experimental stuff. You will get lot of stupid people complaining to samsung about broken smartphones.

[Q] modifying .apk

I am not a developer, while I seem to have more knowledge than the daily user, I do not have the knowledge base to attempt the project that I am curious about. I work for a local tow company as AAA tow truck driver. AAA has provided all its contract stations with an android device that runs an app that is basically a native interface for a web based portal for dispatching the calls. To make a long story short if I were to log into the web interface from my E4GT I can view the dispatched calls ok and the office seems to be able to track me ok, but the native app on the AAA device seems to be able to update statuses while the web interface doesn't seem to actually send the information. I got a hold of the native app apk file and it installed ok, however it asks for a user name that the web interface does not ask for. I assume that this is to prevent people (like me ) from installing on devices that weren't approved by AAA. I was wondering if perhaps there was a way to modify the program to skip this step and allow me to move right in to the log in. If anyone can point me in the direction of someone who may be able to undertake this project for me, I know several people who would rather use their own devices than the AAA device which we are held financially responsible for if it ever is broken or lost. If I were able to run it on my device I could toss their device in a drawer where it will stay safe until I need to return it. Please help. I included the .apk file if anyone is interested in giving this a go.
The likelihood is that modifying this original app in any way works break the law.
AAA obviously paid for the app to be developed and they will own the rights to it.
I suspect that your request breaks the rules of XDA.
The app was downloaded fire free with no copyright permissions agreed to at this location. (I tried to post a link but I guess in too new, I have it tho if you need evidence] therefore I would assume no laws were broken. That web page is the web based program and allows you to download the app without agreeing to anything.
Sent from my SPH-D710 using xda app-developers app
Mark1537 said:
The app was downloaded fire free with no copyright permissions agreed to at this location. (I tried to post a link but I guess in too new, I have it tho if you need evidence] therefore I would assume no laws were broken. That web page is the web based program and allows you to download the app without agreeing to anything.p
Click to expand...
Click to collapse
You can post a link by sticking it in as clear text, with no 'http://' if you really need to.
Just because you are able to download it for free doesn't mean there are no inherent copyright and licences - you will often find them as part of the installation procedure.
OK here's the link. d3me.ersace.com/d3me/htmls/index.jsp
The AAA servers have been having issues over the last couple days so the website seems to be down right now. It actually has been making with really tough because all or calls are being dispatched late and customers aren't happy. But there were no permissions on the installation either. It installed fast and asked for a user ID that I'm assuming belongs to someone in their tech dept. That's all.
After that it should go straight to the contract station and driver log in.
Sent from my SPH-D710 using xda app-developers app
The website is up again. Feel free to check it out. I've been trying to get a hold of someone from AAA to talk about getting me a log on, but I have no response. I can't see how they could object to me using software that they want me to use. I just don't want to risk the device that they are holding me responsible for. Aside from the fact that I don't want to carry multiple devices around. I don't want to break any laws, but there doesn't seen to be any restrictions on this particular app.
Sent from my SPH-D710 using xda app-developers app
Mark1537 said:
The website is up again. Feel free to check it out. I've been trying to get a hold of someone from AAA to talk about getting me a log on, but I have no response. I can't see how they could object to me using software that they want me to use. I just don't want to risk the device that they are holding me responsible for. Aside from the fact that I don't want to carry multiple devices around. I don't want to break any laws, but there doesn't seen to be any restrictions on this particular app.
Click to expand...
Click to collapse
The website seems to be back down again, at least as far as I can tell.
I just checked it this moment. And it's up.
Sent from my SPH-D710 using xda app-developers app
Mark1537 said:
I just checked it this moment. And it's up.
Click to expand...
Click to collapse
Yeah, just discovered that it's an https:// not an http:// link
By pressing ACCEPT, you agree not to use this application while operating a motor vehicle, and agree to the other limitations with respect to the use of this application as described in the accompanying materials.
Click to expand...
Click to collapse
That would be implicit to the software as well, so I would assume that the 'accompanying materials' probably includes their restrictions of use.
Regardless, I can't see you getting anywhere without the username and password. I reckon that social engineering is likely to be more successful than hacking the app, but I may be proved wrong.
I'm finally getting some response from AAA, it was a handbook given during the training for the software. I have read through it and an struggling to find anything regarding the licensing or copyright infringement. I don't deny the ethical gray area that I am standing in, I am just trying to make my working life easier. If I can accomplish the task through the proper means by acquiring a log in of my own I will do that, I was just wondering if the same results could be achieved through alternative means.
Sent from my SPH-D710 using xda app-developers app
Mark1537 said:
I'm finally getting some response from AAA, it was a handbook given during the training for the software. I have read through it and an struggling to find anything regarding the licensing or copyright infringement. I don't deny the ethical gray area that I am standing in, I am just trying to make my working life easier. If I can accomplish the task through the proper means by acquiring a log in of my own I will do that, I was just wondering if the same results could be achieved through alternative means.
Sent from my SPH-D710 using xda app-developers app
Click to expand...
Click to collapse
Hi I know this is a little old but my station just up graded to the tablets also so I am in the same boat now and was wondering if you where able to get any further with this
nope
bearclaw001 said:
Hi I know this is a little old but my station just up graded to the tablets also so I am in the same boat now and was wondering if you where able to get any further with this
Click to expand...
Click to collapse
Noboy was willing to help either here or at AAA, however; if you are a reliable driver that doesn't need to be tracked everywhere that you go, justmake sure that your dispatch tells you when they send you a call and the web link will work. It will even track you if you leave it runnng. But there is no alert sound. So if dispatch just sends calls and doesn't tell you, its no good. Luckily I have been able to just deal with it for now. I'm extra careful with their device, and hopefully nothing will happen. But the tablets...... that sems pricey.
Mark1537 said:
Noboy was willing to help either here or at AAA, however; if you are a reliable driver that doesn't need to be tracked everywhere that you go, justmake sure that your dispatch tells you when they send you a call and the web link will work. It will even track you if you leave it runnng. But there is no alert sound. So if dispatch just sends calls and doesn't tell you, its no good. Luckily I have been able to just deal with it for now. I'm extra careful with their device, and hopefully nothing will happen. But the tablets...... that sems pricey.
Click to expand...
Click to collapse
To say "Noboy was willing to help either here or..." is rather unfair. Nobody here would have any benefit from modifying the application to do what you wished, even if they did want to get involved in the legal gray area, and you can't exactly expect a developer to simply spend hours or days taking an app apart in the hope of modifying it when there is no real reason for them to do so.
Your best bet always was, and still is, to go back to AAA and ask them. If enough of the drivers start doing so they may consider allowing installation on a different device - although they may demand the device by sent to them first for the installation so they can pre-enter the required log-on information.
not an insult.
SimonTS said:
To say "Noboy was willing to help either here or..." is rather unfair. Nobody here would have any benefit from modifying the application to do what you wished, even if they did want to get involved in the legal gray area, and you can't exactly expect a developer to simply spend hours or days taking an app apart in the hope of modifying it when there is no real reason for them to do so.
Your best bet always was, and still is, to go back to AAA and ask them. If enough of the drivers start doing so they may consider allowing installation on a different device - although they may demand the device by sent to them first for the installation so they can pre-enter the required log-on information.
Click to expand...
Click to collapse
My post was not meant as an insult, just a statement of fact. I always aknowledged the legal gray area, and more than understand why nobody would get involved. I guess I was hoping somebody might point me in the right direc,tion to accomplish the task on my own. I have since given up the task as I have stated already, and continue to utilize the various recources this site provides. I'm sorry you were offended, but once agan, it was not an insult. Have a nice day.
simple
Guys i know this is kinda a dead post but AAA locks the tablet to go to the one website only.. that is when you click on the "app" on the tablet, it is just opening the web page. its your shop number, password, truck id and user id.. no install needed.
If you install this on your own device (only some clubs allow "bring your own device") you need to enter the location url for your particular club usually http://spp.aaa.com/d3me*** where the *'s are your club number. Then you have to have an application username which is simply a password that gives you access rights to install the application. You will never see this on a club owned device like a cell phone or tablet provided by the club you are contracted for because it is preinstalled. So as "simple" as stated that is all you need on a club device but if you are trying to install on your device (which likely runs much faster and better anyway) then you need a club that allows BYOD to get the application installer password. (And no I wont post the installer password!)

android security flaw article (how serious is this? )

Came across this article today claiming most Android devices are at major risk of being hacked does anyone anyone know what this flaw is and how serious it actually is.
Admittedly this news sure is sensationalist.
http://www.news.com.au/technology/hackers-can-control-almost-all-android-phones/story-e6frfro0-1226674770520
Some security company or other has been saying that for a long time - Android is a security risk... If the problem was a real danger then Thank you BlueBox security for telling all those people so inclined about the exploit... Good job....
They mention 1 Android device that has been fixed but don't say which one.
Considering this is from a "mobile security company" I'm sure they'll release a fix you can pay for in due course, if you're so inclined...
ultramag69 said:
Some security company or other has been saying that for a long time - Android is a security risk... If the problem was a real danger then Thank you BlueBox security for telling all those people so inclined about the exploit... Good job....
They mention 1 Android device that has been fixed but don't say which one.
Considering this is from a "mobile security company" I'm sure they'll release a fix you can pay for in due course, if you're so inclined...
Click to expand...
Click to collapse
S4 is the device..
Anyway, in a theory is something else than in a practice. They didnt either mention that you dont get it from Google Play or apps in Google Play. They are just fishing headlines, imho.
What i understood, you need to allow an app installation from unkown sources and go there to get a package to install. How many of us do that? The real problem is in Asia/East and among users who use unofficial 3rd party market places for example...
I could also write a headline "100% of users having smart devices are in risk to get a trojan, virus etc." and it's even true! Of course Blueboxs news is abit different but still.. But it is good, anyway, that people find vulnerabilities, especially before criminals find them. Bluebox is doing right but the announcement was a bit odd, i quess..
enigma_x said:
What i understood, you need to allow an app installation from unknown sources and go there to get a package to install. How many of us do that?
Click to expand...
Click to collapse
I'd guess that more than a few folks side load the latest Adobe Flash Player version and may download apps from Amazon and/or ROMs from Sammobile. Pretty sure these sites would get classified as Unknown Sources.

How Funky huawei works?

What does the site owner got specifically that XDA members don't have access? Is he anyway related to Huawei? Is the owner doing all of it legally.
I think what he did is, he started testing out how the update works on Huawei phones.
He started directing all the packets sent and received when trying to update to his computer to see how the update works and what kind of checks huawei performs on the phone before the update.
So apparently he figured a way out to simulate these "checks" on his own server, to make them always authenticate the update. This is why you have to redirect your router to his DNA. So that when the phone tries to perform the checks, instead of doing it in huawei servers, it would do it on Funky's server and always approve the update.
How does he get access to unreleased software? I don't know. It could be possible that while he was trying to do all this, he discovered some hidden directories where all the hidden files are.
And I suppose that someone could possibly reverse engineer Funky to see how it works. I doubt he stores all these updates on his server, he probably redirects the update from huawei servers to the phone but just spoofs and fixes the checks. Who knows.
If you want to rebrand your phone or upgrade your phone, you don't have to use Funky anymore. Someone discovered a new way to do this.
Check it out at https://forum.xda-developers.com/mate-9/how-to/guide-mate-9-flash-update-package-t3593108
backb0ne5p1d0r said:
I think what he did is, he started testing out how the update works on Huawei phones.
He started directing all the packets sent and received when trying to update to his computer to see how the update works and what kind of checks huawei performs on the phone before the update.
So apparently he figured a way out to simulate these "checks" on his own server, to make them always authenticate the update. This is why you have to redirect your router to his DNA. So that when the phone tries to perform the checks, instead of doing it in huawei servers, it would do it on Funky's server and always approve the update.
How does he get access to unreleased software? I don't know. It could be possible that while he was trying to do all this, he discovered some hidden directories where all the hidden files are.
And I suppose that someone could possibly reverse engineer Funky to see how it works. I doubt he stores all these updates on his server, he probably redirects the update from huawei servers to the phone but just spoofs and fixes the checks. Who knows.
If you want to rebrand your phone or upgrade your phone, you don't have to use Funky anymore. Someone discovered a new way to do this.
Check it out at https://forum.xda-developers.com/mate-9/how-to/guide-mate-9-flash-update-package-t3593108
Click to expand...
Click to collapse
Thankyou for the insights.
Sounds illegal to me. Taking a file from a server that doesn't belong to you, and charging money out of it. Heck development FW are not even meant for the public.
You guys do know that many things Done here are tech illegal right? Legality means little when it comes to many things.
zelendel said:
You guys do know that many things Done here are tech illegal right? Legality means little when it comes to many things.
Click to expand...
Click to collapse
But I never found anyone here charging for such things.
vipivj said:
But I never found anyone here charging for such things.
Click to expand...
Click to collapse
Then you have not been in the right place. We have a whole section for it. An example is the HTC unlock tool. It has a $25 price tag last I remember.

Two noob questions regarding security/privacy

hi,
I would really appreciate if someone could help answer these two questions for me :
1. I have to revert back to marshmallow from nougat, to use xprivacy with better compatibility. But the security patch of custom roms are not latest, mostly '16.
Is it something to look out for, security wise?
2. Are open source apps actually secure as compared to closed source ones? Yes their code is open but I heard they are more vulnerable to attacks. Please enlighten me.
Thanks.
1. newer version of os is better prepared against attacks, but marshmallow is good enough for NOW. in the future marshmallow will become not good enough.
2. it depends how well the app/code is maintained. open source means revealing more attack vectors to an malicious attacker, however it also means broader chance for the good guys to review code and find security holes and patch them before bad guys uses the security holes. more developer involved = better security generally. same principle goes to closed source code; more developers paid by the company who is responsible for the code generally means better security. thus it is not a matter of source being open or closed; it is a matter of how many active people are involved in maintaining the code and how much effort is made in keeping the code secure.
juniecho said:
1. newer version of os is better prepared against attacks, but marshmallow is good enough for NOW. in the future marshmallow will become not good enough.
2. it depends how well the app/code is maintained. open source means revealing more attack vectors to an malicious attacker, however it also means broader chance for the good guys to review code and find security holes and patch them before bad guys uses the security holes. more developer involved = better security generally. same principle goes to closed source code; more developers paid by the company who is responsible for the code generally means better security. thus it is not a matter of source being open or closed; it is a matter of how many active people are involved in maintaining the code and how much effort is made in keeping the code secure.
Click to expand...
Click to collapse
Thanks pal.
juniecho said:
1. newer version of os is better prepared against attacks, but marshmallow is good enough for NOW. in the future marshmallow will become not good enough.
2. it depends how well the app/code is maintained. open source means revealing more attack vectors to an malicious attacker, however it also means broader chance for the good guys to review code and find security holes and patch them before bad guys uses the security holes. more developer involved = better security generally. same principle goes to closed source code; more developers paid by the company who is responsible for the code generally means better security. thus it is not a matter of source being open or closed; it is a matter of how many active people are involved in maintaining the code and how much effort is made in keeping the code secure.
Click to expand...
Click to collapse
shadowbone said:
Thanks pal.
Click to expand...
Click to collapse
Just be careful of what u doing and always be update your latest security patch and android.
Sent from my Pixel 2 XL using Tapatalk
JohnMichaelCost said:
Just be careful of what u doing and always be update your latest security patch and android.
Click to expand...
Click to collapse
Thank you for your advice But thing is cm13 for my device has its last security patch from dec 2016. And lineage OS 14.1 has latest security patch, but lacks xposed stability, especially for xprivacy, the one I need the most( because I am on No Gapps). So, that's the confusion I have.
And I completely go along with your words of being careful with what I do with my device.
After moving into a NoGapps environment I mostly use open source apps except for 2 or 3 apps whose functionality are not found in any apps on FOSS. Yet those apps from play store themselves have google analytics and measurement services in them. For a privacy freak like me, it is intimidating, I guess.
To be honest open source apps are just as secure as closed Sourced apps. The reason being is very few people are looking at either for security exploits. As for the security updates that is a personal choice. I don't put much worth to them as they are exploits that have been around since the beginning and Google is just pushing patches so they appear to be worried about security. Kinda funny coming from a company that makes its money from collecting and using personal data
zelendel said:
To be honest open source apps are just as secure as closed Sourced apps. The reason being is very few people are looking at either for security exploits. As for the security updates that is a personal choice. I don't put much worth to them as they are exploits that have been around since the beginning and Google is just pushing patches so they appear to be worried about security. Kinda funny coming from a company that makes its money from collecting and using personal data
Click to expand...
Click to collapse
Ooo.... Interesting. I didn't look at it in that perspective (regarding google and its patches). :laugh:
shadowbone said:
Ooo.... Interesting. I didn't look at it in that perspective (regarding google and its patches). :laugh:
Click to expand...
Click to collapse
Sounds familiar "android vs ios" sorry i mean open vs closed sources, the cloesd sources is very hard part for security longntime to hacked & hard finding the source "pay developer just like Apple"
Android other hand is open source is very cool unlike "cloesd sources" is updated everyday and developer are fighting against hackers to does not hacked the source
I will not to worried. Look my screen shot.
JohnMichaelCost said:
Sounds familiar "android vs ios" sorry i mean open vs closed sources, the cloesd sources is very hard part for security longntime to hacked & hard finding the source "pay developer just like Apple"
Android other hand is open source is very cool unlike "cloesd sources" is updated everyday and developer are fighting against hackers to does not hacked the source
I will not to worried. Look my screen shot.
Click to expand...
Click to collapse
Um not its not. Android isnt open source. Only AOSP is open source and that comes preloaded on 0 devices. Everything else is closed sourced. Even Google uses closed sourced files for their devices.
Also no one is looking at open source apps. Developers dont care about open source apps. As there is no money to be made from open source apps.
As for your screen shots. They mean nothing really as any hack would bypass it as it would happen when you are using the device. A perfect example is a built in screen recorder that then loads the videos up into a server when the device is asleep (Xiaomi is known for doing this)
Mobile security really is a myth. If someone wants your info (they really dont. They couldnt care less as your personal info is worth less then nothing) they can get it from social media sites easy enough.
zelendel said:
Um not its not. Android isnt open source. Only AOSP is open source and that comes preloaded on 0 devices. Everything else is closed sourced. Even Google uses closed sourced files for their devices.
Also no one is looking at open source apps. Developers dont care about open source apps. As there is no money to be made from open source apps.
As for your screen shots. They mean nothing really as any hack would bypass it as it would happen when you are using the device. A perfect example is a built in screen recorder that then loads the videos up into a server when the device is asleep (Xiaomi is known for doing this)
Mobile security really is a myth. If someone wants your info (they really dont. They couldnt care less as your personal info is worth less then nothing) they can get it from social media sites easy enough.
Click to expand...
Click to collapse
you're right. Android security So really is nothing special in fact.
May i ask you about Xiaomi why they are doing this ? And google vs AOSP ?
JohnMichaelCost said:
you're right. Android security So really is nothing special in fact.
May i ask you about Xiaomi why they are doing this ? And google vs AOSP ?
Click to expand...
Click to collapse
They are required to by the Chinese government. I take it you don't know much about how they do things. Here is a fast run down. China requires all data from its citizens to be monitored and recorded. This is part of the reason for China's great firewall. When people buy devices made for China this is something that happens.
As for Google vs aosp. Think about it this way. Why would you buy a pixel device is you can get all the same features from aosp? No money to be made there so not good business. Yes Google pushes a lot to aosp. But it is getting less and less. Heck even the base aosp apps have not gotten any real updates in years. Google wants you to use their closed Sourced apps. Allo, duo, Gmail, contacts, phone etc. If it wasn't for 3rd party developers like the ones here aosp apps would still be bare bones.
I second your view zelendel. Although, I have to ask, not that I don't understand your valuable thoughts you posted before, but..
Now that more and more vulnerabilities are brought to light these days like the blueborne or KRACK, and google or devs here, for that matter, pushes security patches to fend against these vulnerabilities. Would you say extending privacy capabilities using root and xposed tools and some common sense while using apps , should suffice against threats of these sorts?
Edit : nvm. Got hold of the desired ROM with latest patch. Thanks for your input guys.
shadowbone said:
I second your view zelendel. Although, I have to ask, not that I don't understand your valuable thoughts you posted before, but..
Now that more and more vulnerabilities are brought to light these days like the blueborne or KRACK, and google or devs here, for that matter, pushes security patches to fend against these vulnerabilities. Would you say extending privacy capabilities using root and xposed tools and some common sense while using apps , should suffice against threats of these sorts?
Edit : nvm. Got hold of the desired ROM with latest patch. Thanks for your input guys.
Click to expand...
Click to collapse
Just not to be worried about hacking our phone. Developer of app/google/aosp/etc. here to save us from hackers in fact maybe.....
But as for root,CFW,etc they doesn't hooked even you have gapp.
But hacking WiFi WAP so... i don't worries, just i said earlier "be careful what you doing" remember that.
If you need very privacy like "donald trump" [emoji13] so vpn your phone install x private and cover with your camera, encryption your phone and always be updated your apps/security patch and android of course.
Sent from my Pixel XL using XDA-Developers Legacy app
shadowbone said:
I second your view zelendel. Although, I have to ask, not that I don't understand your valuable thoughts you posted before, but..
Now that more and more vulnerabilities are brought to light these days like the blueborne or KRACK, and google or devs here, for that matter, pushes security patches to fend against these vulnerabilities. Would you say extending privacy capabilities using root and xposed tools and some common sense while using apps , should suffice against threats of these sorts?
Edit : nvm. Got hold of the desired ROM with latest patch. Thanks for your input guys.
Click to expand...
Click to collapse
To be honest if I was really worried about security then root would be out of the question as it opens up doors that can be exploited. An example is a root binary that was found to work so it auto granted root to every app and removed the logs of it doing so.
The KRACK vulnerability is a whole other thing as patching a device is pointless if the router you are connecting to is not patched.
Just use common sense really. As long as Android pushes a lot of code open source there will always be issues like this that pop up. (its soo much easier to find exploits when you have access to all the code. And before you say it, no not as many people are looking for security threats as people think)
Thanks you guys for your valuable advice's. I'll make sure to keep a watch out. :good:
(might be this is off topic but i need your help guys)
Hi guys i need your help with my Old nexus 5 (stock never did ctf or rooted) and mtk phone as a same problem.
In google camera when I video mode it crash even open it please help me.
Nexus 5 and mtk phone are running both android 6.0 stock.
Any idea what happened ?
JohnMichaelCost said:
(might be this is off topic but i need your help guys)
Hi guys i need your help with my Old nexus 5 (stock never did ctf or rooted) and mtk phone as a same problem.
In google camera when I video mode it crash even open it please help me.
Nexus 5 and mtk phone are running both android 6.0 stock.
Any idea what happened ?
Click to expand...
Click to collapse
Have a take a look.
JohnMichaelCost said:
Have a take a look.
Click to expand...
Click to collapse
I'm not sure. Are you using official/stock build or some ported apk?
shadowbone said:
I'm not sure. Are you using official/inbuilt build or some ported apk?
Click to expand...
Click to collapse
Ok.. but thanks anyway is working again.....
i am officially build.
Sent from my Pixel XL using XDA-Developers Legacy app
JohnMichaelCost said:
Ok.. but thanks anyway is working again.....
i am officially build.
Sent from my Pixel XL using XDA-Developers Legacy app
Click to expand...
Click to collapse
You are Gonna have to run a logcat to find out. Chances are if you are not rooted or been messing around then it will be hard are.

Categories

Resources