Related
I was wondering with all these reports on Chinese hackers. Can we be vulnerable to malicious roms. I know that some apps in the play store can be malware.
Is it possible that a Trojan virus may be hidden in a popular rom. Like maybe miui? Or other roms floating around on the web.
Here's one example of a popular game with Effed'up agendas.
http://bit.ly/HA4JwI Angry Birds? You'll be FURIOUS - fake game infects Android handsets and lets foreign cyber-criminals ... #MailOnline.
I starting to wonder all this when I had people hack me personally and steal banking information. Also my girls email account was being logged in by some one in China.
If any one has some real insight and professional knowledge of this. I would love to hear any input that might be helpful.. since I'm always flashing roms.
Sent from my Nexus S using Tapatalk
Not an expert, but definitely!
I'm not an expert, but I know that definitely the answer is yes.
A couple of months ago, there was a linux desktop OS that claimed to be made by the hacktivist group "Anonymous" that was filled with trojans and malware. Here is the article from Tom's Hardware.
Therefore, I don't see how flashing custom ROMS is any different. Just like you posted with the angry birds virus, a developer could easily put programs or scripts into a ROM that could do the same. However, the key thing is only flashing the trusted sources. I really only trust this website and don't go to any others Also, I always review and study everything I flash to my phone. I read what the developer says and the feedback from other users.
Hope I helped a little!
I think we should not use roms from china. They are not to be trusted. We should have all Telecom stuff made in USA to protect USA national defense. But then again the USA govt has back doors into our devices that we don't know about.... yet.
Sent from my Nexus S 4G using xda premium
This writer seems to think so.
http://www.theverge.com/2012/2/16/2801916/home-baked-roms-its-going-to-blow-up-sometime-soon
Actually he makes some valid points (and I use a Custom ROM myself).
Absolutely ZERO disrespect intended to the ROM developers here --- we should appreciate their very hard work and opening our devices up to so many other options and enhancing performance.
But after reading this article, what do people think about the safety of ROM flashing .... not in terms of bricking the device (we all know the risks), but in terms of:
A) Unintentionally opening the device up to exploits due to poor coding etc
B) A rogue developer intentionally exploiting to capture data for profit
Are you comfortable doing bank transactions on a rooted android device w/ custom ROM?
Interesting question
I have never even thought about what I do and don't do on my custom devices.
Forget the internet banking etc, there's also the entire gamit of email, social sites, work email etc etc
Just as well I trust you all!
This is definitely a concern......
Here in Korea though, the banking apps do not allow you to use them with a rooted device.....So each time, I have to unroot my device in order to do banking.
I do not know, however, if once I root again it would give the developer or hackers access to that data......
Something to think about as well though!
I realized: I never looked for an app that investigates security issues on a smart phone.
perhaps someone with knowledge in this field can give a few hints to usefull apps?
and yes, "I am with stupid too"
Motorola Defy+ with Quarx's CM9 nightlies and most of the time I still have no clue to what I am doing precisly.
But on the bright side: I do not use my phone for banking, there's nothing to "bank around"
Hmmm -- I had never considered that banks would block it -- have not tried yet. You make a good point about what remains on the device later -- at a minimum clearing browser history is a good idea -- but even that could be circumvented with a devious enough approach.
[email protected] said:
This is definitely a concern......
Here in Korea though, the banking apps do not allow you to use them with a rooted device.....So each time, I have to unroot my device in order to do banking.
I do not know, however, if once I root again it would give the developer or hackers access to that data......
Something to think about as well though!
Click to expand...
Click to collapse
I agree. From what I have seen most of the "advanced" posters here dismiss antivirus packages as a waste of time and money and they could well be right. Still I have not been able to find any real discussions on the risks the article I posted raised. It would be great if some of the more "expert" members here could offer their views.
I am loving my rooted G-Note with custom ROM ---- but I do not really have confidence in Android and its various hacks yet. Unfortunately the alternatives are rather poor.
gentle_giant said:
I realized: I never looked for an app that investigates security issues on a smart phone.
perhaps someone with knowledge in this field can give a few hints to usefull apps?
and yes, "I am with stupid too"
Motorola Defy+ with Quarx's CM9 nightlies and most of the time I still have no clue to what I am doing precisly.
But on the bright side: I do not use my phone for banking, there's nothing to "bank around"
Click to expand...
Click to collapse
I would say I agree and disagree with the article.
For me personally, when I decide to get all flash happy with my Android devices, I tend to not put any information regarding banking or credit cards. Logically, at least to me, the concerns sited in this article do occur to me. Then again, to be honest I do not put any of this information on my non jail broken company secured and encrypted I phone either. Call me paranoid.
Where I disagree with the article is in the insinuation that using a stock ROM with apps downloaded from let's say th he iTunes store is really much more secure. If a baked ROM can be pulling information behind your back, and somehow bypass security measures written into a banking app, why could not a fart app some momo downloads to be the life of the party do the same?
Flyer
I have been thinking about this ever since I've rooted my phone and flashed the first custom rom...
-and I still don't have a real answer.
Thats why I prefer stock ROM
finally its your (user) wish, weather to use custom rom or stock rom.
none of the developers are forcing to use their custom rom.
rom development is hobby,passion, and part-time for some of developers.
my few words.pls correct me if I'm wrong
Ever heard of pdroid? Droidwall?
reversegear said:
finally its your (user) wish, weather to use custom rom or stock rom.
none of the developers are forcing to use their custom rom.
rom development is hobby,passion, and part-time for some of developers.
my few words.pls correct me if I'm wrong
Click to expand...
Click to collapse
You are not wrong, but you are definitely off topic.
This is so one sided. You can say the same about any OpenSource program with small userbases. Take any little Linux Distri, any small OSS and you get to this problem quickly. Most of us can't review the source code properly so we have to rely on others. But at least you CAN rely on someone. You can't rely on anyone at closed source programs.
That's why you use Truecrypt for encrypting your hard drive and not Bitlocker, that's why you should use a Linux Distri and not Windows and that's why i use OpenSource ROMs and not the closed source StockRoms and even try to have as much OpenSource Apps on my Phone as possible.
Just my 2 cents.
He has the points and those are sorely his.
Calling other ROM flashers idiots is ridiculous and not very nice. In fact, based on what he typed, he seems to be an idiot himself.
Now to other Rom flashers, as long as then understand the risk of doing so, they entitle and fully responsible for their actions, no need to teach them.
Security issue? I drive a car to a bad area, get off, windows still lower, not even care to lock the car. That is my choice.
Now I'm going to the very nice, high educated area, I choose to lock the car, put the steering-wheel lock on. Again, it's my choice. Home wireless network, I choose to set the password or not, it's my decision. I understand the risk of not doing that. And if I choose not to do that, it doesn't make me an idiot.
Next, not all baked ROM are based on leaked official one. CyanogenMod team is well-known and they based on the Google source code, ASOP, not a leak one from vendors.
So, if ROM flashers realize what source they use, they're all set.
Writing a long article with just one-minded lopsided thinking like this is pretty lame.
an0nym0us_ said:
Ever heard of pdroid? Droidwall?
Click to expand...
Click to collapse
Pdroid: looks very promissing but you need to be a programmer and only for Gingerbread.
Droidwall: from what I understand from it it is a kind of fine-tuning of your data traffic. Pdroid goes much, much further and I would prefer it.
A real shame I'm not a developper/programmer and also very happy with my custom ICS ROM.....
On the bright side; I like tweaking but not social networking or any other more "dangerous stuff" Just like I'm used on my PC.
I've never bothered with a custom ROM, partly because I just realise that pretty much everything I could do with a custom ROM, I can do manually with a rooted phone. I don't like to install a package of software someone else thinks I should use, I prefer to pick and choose the stuff I want. Security concerns never really bothered me, I don't care too much about the security of my phone (I guess maybe some people would be annoyed at me if my contacts were stolen or something, but other than that there isn't really anything I care about on my phone). I never do online banking etc. on it, but that's just because that's something I do very rarely and only do when I'm at a computer anyway.
gentle_giant said:
Pdroid: looks very promissing but you need to be a programmer and only for Gingerbread.
Click to expand...
Click to collapse
You don't need to be a programmer. All you do is get your ROM zip, run the PDroid patcher on the ROM zip, it'll give you a patch zip, flash the patch zip in recovery, install PDroid from market. And I think there are unofficial ports to ICS possibly.
Doesn't stop me from flashing custom ROMs.
Oh well...?
Sent from the future.
I though the article itself was a bit sensationalistic but at the same time I think changing the ROM in a system (not to mention giving root permissions to apps) is a lot more potentially intrusive than downloading apps from Itunes or Gplay.
Anyway I like my custom ROM setup but I sort of feel like I am whistling in the dark at times. I think a lot depends on how sophisticated we are as users.
Case in point:
When I flashed my ROM for the first time, I freaked out seeing a bunch of Chinese names every time I made a call to certain numbers. The good thing about XDA is if you search you can find anything about ROM issues and in this case I learned that this was due to the developer using the contacts part from the leaked Chinese ICS and it had something to do with a "Phone locator service" that could be disabled. Ok so I disable and go back to whistling in the dark --- but I have not been able to learn what the phone locator service is in the first place or WHY i had Chinese names showing in my calls.
As a relative Noob I can follow instructions from most of the generally well written instructions on XDA and not get into trouble --- but (rhetorically) do I really understand the background issues and risks with some of these things?
What is this phone locator service anyway? Why the Chinese Names and Locations in the call indicators?
mcord11758 said:
Where I disagree with the article is in the insinuation that using a stock ROM with apps downloaded from let's say th he iTunes store is really much more secure. If a baked ROM can be pulling information behind your back, and somehow bypass security measures written into a banking app, why could not a fart app some momo downloads to be the life of the party do the same?
Flyer
Click to expand...
Click to collapse
Well you are right that we are all responsible for our own choices. I just think it is better for all that people can make as informed as choices as possible. That is why discussions like these can be good (even if the article was inflammatory).
To extend your analogy, maybe you think it is your choice to leave your car unprotected. But maybe your insurance company will disagree and try to teach you better? Maybe the police inform you to secure your car because you make more work for them when your car is stolen?
So as a car driver it is your choice, but many might argue that the community of car drivers needs to be educated on the risks of their behavior so that they can make more informed decisions. Then you benefit and the community benefits (keep insurance rates down, free up police resources etc.)
I hope I made sense
votinh said:
Now to other Rom flashers, as long as then understand the risk of doing so, they entitle and fully responsible for their actions, no need to teach them.
Security issue? I drive a car to a bad area, get off, windows still lower, not even care to lock the car. That is my choice.
Click to expand...
Click to collapse
I'd rather take the risk and enjoy life than sit on the sidelines. Considering that all smartphones have vulnerabilities, stock or no, I'll take my chances. I also have a bit of faith left in humanity in general and more so some in communities like XDA and Rootz where the general idea is clearly that these are places for everyone to contribute to everyone else, not to come in and scam.
Let's be real: if someone comes through here and drops something that ends up defrauding other for every person involved in coding the malicious item there are ten more capable devs who will have the motivation to take them to task in most unpleasant ways. I, for one, would not put my butt on the line by choosing a dev forum to release or market my malware.
I ran into this article today and I wanted to see what the people on XDA think about it. This company is working on a Android phone that it's primary purpose is to protect the users privacy.
Here's the link: http://mobile.theverge.com/2014/1/1...nn-silent-circle-geeksphone-blackphone-launch
Read the article, watch the video and let me know what you think.
Sent from GNote 3 rooted with kingo.
Saw news about this and came here to seek out does any1 have opinions about it.
i wonder, does the safety come from hardware or is it the OS what makes this so safe.. if it is the OS, i hope some1 smart enough makes custom rom for this.
I really don't see how this phone is gonna change anything. Apps and websites have keyloggers, You still need a carrier to get service from and they have control of all your traffic. What about radio frequencies that can be intercepted, IP addresses, GPS chips sending signals to satellites, baseband and firmware are connected thru the cell towers of the carrier. I'm starting to think this phone is a scam.
They said nothing about how they're dealing with all this. They are probably using the whole NSA scandal momentum to fool people into believing they are safe if they buy this phone.
Sent from GNote 3 rooted with kingo.
I saw an article about this venture also. This is a good thing. If he gets press about this phone, maybe other venders will take notice and start building in privacy features as well. :good:
I don't see the need for new hardware here. If they really want to secure something, they could create a mod for Android, that could be installed on a variety of devices for example.
Besides, if they encrypt telephony, messages and stuff, they will need to be decrypted again - but the question is where and how? I bet they won't have any hardware encryption module and even if they do, it will make communication with other phones impossible. Software encryption means other phones will need to install some additional software to communicate with the Blackphone and it might be a bit inconvenient.
orangek3nny said:
I don't see the need for new hardware here. If they really want to secure something, they could create a mod for Android, that could be installed on a variety of devices for example.
Besides, if they encrypt telephony, messages and stuff, they will need to be decrypted again - but the question is where and how? I bet they won't have any hardware encryption module and even if they do, it will make communication with other phones impossible. Software encryption means other phones will need to install some additional software to communicate with the Blackphone and it might be a bit inconvenient.
Click to expand...
Click to collapse
That's a good point. how a non blackphone device is gonna decipher the encryption? how is it going to get the key? How can a non blackphone device even a establish the same "secure" connection?
Sent from GNote 3 rooted with kingo.
Andronote3 said:
That's a good point. how a non blackphone device is gonna decipher the encryption? how is it going to get the key? How can a non blackphone device even a establish the same "secure" connection?
Sent from GNote 3 rooted with kingo.
Click to expand...
Click to collapse
I think you are missing the point. As you or I may not NEED this kind of security, I'm sure you can think of someone who does.
Obviously, there would be two levels of privacy/security... Connections between 2 black phones and everything else. So who utilize a black phone? How about corporations and governments? Law offices, professional sports teams, or doctors and hospitals.
Now, even though I do not NEED this, if it was affordable, I would heavily consider it.
Sent from my Nexus 5 using XDA Premium 4 mobile app
JamieFL said:
I think you are missing the point. As you or I may not NEED this kind of security, I'm sure you can think of someone who does.
Obviously, there would be two levels of privacy/security... Connections between 2 black phones and everything else. So who utilize a black phone? How about corporations and governments? Law offices, professional sports teams, or doctors and hospitals.
Now, even though I do not NEED this, if it was affordable, I would heavily consider it.
Sent from my Nexus 5 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
I understand what you are saying and I completely agree with you. It looks like a device that corporations and the government would "benefit" more than regular users. Either way, It won't fix 90% of all the problems people face when it comes to staying safe against privacy/security breaches. I truly believe that they are using the whole NSA scandal momentum to make people believe that they are safe/secured if they buy this phone.
P.S: Nice quotes.
I saw this phone.
It isn't an answer to every privacy issue.
What its an answer to is, not having to agree to an android apps permissions to gain access to the app.
These apps don't make their money off the app sales, they make their money sending information to retailers.
Retailers own the world.
The question I still pose is... What's wrong with retailers knowing where you are?
There's nothing you can do about the government. They won't let us make things that are government proof, nor would they (The retailers ) want to.
But, what's wrong with these apps fine tuning my specific desires to my Location?
You can't stop people from stealing your identity. The hacker/firewall paradox is, for every walk you build, they will build a taller ladder.
The only thing really close to full privacy in data sending is, that light source that sends data. It's a light bulb, and the light has data in it, a sensor receives it. It can be held within the walls of a room. But that only effects a closed circuit type system. If that light source is connected to the Internet, then game over.
Why do you think record companies and movie companies keep their computer systems offline and deal in only physical media? A hacker will get into anything I'd you give him the tools and time.
This phone gives a sense of security that is non existant
You've Just Been Tapatold ♧♢dbombROMv3.4♤♡
My Theme ( Taking Requests )
http://forum.xda-developers.com/showthread.php?t=2658527
SaintCity86 said:
I saw this phone.
It isn't an answer to every privacy issue.
What its an answer to is, not having to agree to an android apps permissions to gain access to the app.
These apps don't make their money off the app sales, they make their money sending information to retailers.
Retailers own the world.
The question I still pose is... What's wrong with retailers knowing where you are?
There's nothing you can do about the government. They won't let us make things that are government proof, nor would they (The retailers ) want to.
http://forum.xda-developers.com/showthread.php?t=2658527
Click to expand...
Click to collapse
nailed it
The problem is Android itself. Thanks to Xprivacy, it's a lot easier to control what leaks out of your device. Personally I'd rather see more encryption mechanisms than this. FFOS seems to be on the right path
There Is nothing you can do to stop identity theft.
Nothing.
And there is nothing you can do to do the government from tapping your lines.
You want a safer form of communicating, send Voice recordings over text.
That's an entirety separate warrant, and harder to get. Other than that. It's hopeless
You've Just Been Tapatold ♧♢dbombROMv3.4♤♡
My Theme ( Taking Requests )
http://forum.xda-developers.com/showthread.php?t=2658527
d1rX said:
FFOS seems to be on the right path
Click to expand...
Click to collapse
I think you mean FOSS[1] = Free and Open Source Software. Anyway, I fully agree, in fact, that is the ONLY way. Closed source encryption programs can't be 100% trusted by definition. There might be security flaws, intentional or not.
Anyway. the NSA has backdoors to every operating system[2], so if you're really a target, they get you. Also, there are more than enough security holes in the layers under the operating system[3].
I think what these phones are supposed to do is bring end-to-end encryption for e.g. industry users so they don't get spied on. The NSA and the US government can get their hands on encryption keys for servers like in Lavabits case[4]. But this is the transport encryption. The data is, if not otherwise secured, available in plain text on the servers of providers. This also means, the officials can decrypt ANY data that comes in, not just the one of actual targets.
Now, end-to-end encryption makes sure even the provider can't see your data in plain text because you encrypt and decrypt it on your device. What Blackphone does is, it uses the apps from Silent Circle, a closed source encryption programm for VoIP and messages. Although the owner of that company is the well trusted cryptographer Phil Zimmerman, one can never be sure.
That's a good point. how a non blackphone device is gonna decipher the encryption? how is it going to get the key? How can a non blackphone device even a establish the same "secure" connection?
Click to expand...
Click to collapse
You can install and use Silent Circle on any(ok, a lot of) phone(s). Just make sure you don't have additional malicious software installed. Any yes, it costs $100/year or so. And you get a subscription for SpiderOak, sort of a Dropbox but they encrypt the data before uploading. Any you get a better overview over what app uses what permissions. A few extra tweaks basically.
Alternative: Android Phone with CyanogenMod/Replica. TextSecure for messages, RedPhone for VoiP and owncloud for files. Way cheaper too, and open source, also made by well respected cryptographers like Moxie Marlinspike[5]
[1] de.wikipedia.org/wiki/Free/Libre_Open_Source_Software
[2] zerohedge.com/news/2013-09-08/nsa-has-full-back-door-access-iphone-blackberry-and-android-smartphones-documents-re"]backdoors to every operating system
[3] forum.xda-developers.com/showthread.php?t=2530044
[4] techdirt.com/articles/20131002/17443624734/lavabit-tried-giving-feds-its-ssl-key-11-pages-4-point-type-feds-complained-that-it-was-illegible.shtml
[5] thoughtcrime.org
if they want to spy on us they can ... that's it...
More info?
Hi all - looking for more info on this phone - just joined XDADev to post this.
Specifically, what brands might this hardware be found under? Know it's a Tinno S8515 but have yet to find out anything about that; seems like Tinno generally makes phones for other companies?
Any help is appreciated!
Best,
-Cx
:cyclops::cyclops::cyclops:
The greatest challenge to securing a phone is not the OS or the apps running on it, it's the baseband. We have known for well over 30+ yeasr how to harden a *nix based system (like AOS), but we haven't even started to question WTF is going on in the closed source 10-100 MB baseband RTOS, which have fulll access to your entire FS and the most important phone operations, like SIM, RF, EMMC etc etc.
Only forcing the corrupt modem OEM's to release the sources of the Baseband firmware could improve the situation. This will never happen, unless there is another baseband Snowden out there somewhere...
We already know that the BP/CP FW is extremely insecure, and relies almost solely on obscurity as their main mechanism of protection. If this was not the case, the iPhone unlock developers would have been fekked long time ago, and the rest of us would sit around with SIM/network locked bricks filling up our bookshelves.
Unfortunately the greatest majority of the millions of XDA members are completely carefree about this issue and are only happy as long as they can "tweak some ROMs". So this will never be the place to find/see any serious baseband reversing, no matter how important it would be from a security standpoint.
So to summarize, your Qualcomm baseband will continue to send your exact GPS coordinates to the network provider at will, without you ever knowing, and without anyone (here) caring. So goes for the FM transmitter that is part of the baseband FW in both Intel and Qualcomm based phones. Do you have control over that? Never.
Only a serious long term spectrum analysis study could reveal whats going on there, where and when you're not (able) to watch.
This phone is the biggest scam lol.
hyshys said:
Saw news about this and came here to seek out does any1 have opinions about it.
i wonder, does the safety come from hardware or is it the OS what makes this so safe.. if it is the OS, i hope some1 smart enough makes custom rom for this.
Click to expand...
Click to collapse
I was wondering this too. If it is only the rom (just like the $1300 pwnphone). It should be port-able
iliass01 said:
I was wondering this too. If it is only the rom (just like the $1300 pwnphone). It should be port-able
Click to expand...
Click to collapse
Blackphone. - no hardware security, just software, and most of it is NOT open source. Some here (@SaintCity86 , @repat) has their points, and they are mostly right! If you want some security (and I said some!!!), then get rid of most of your apps (permission check and some common sense), all Google apps (yes, all of them), install a paid (not free) and high quality VPN software, don't use the phone feature (only data sim-prepaid), get an internet phone number (with no personal details), use end to end encrypted apps to make calls and send and receive texts, install Xposed and Xprivacy (or any other variant) and limit even more the apps you have on your phone. Don't use it as your only phone, but as a secure device and share your number and other infos with trusted people! In this case, maybe, you will be able to add some layer of security and actually be able to use it. And most important, don't give your phone in the hands of anyone! It is a bit paranoid, but it's the only way! But, don't be fooled! You can have some security, only if you stay under the radar, and don't gain some attention. If yes, then you have no luck! Personally, I have seen the Blackphone, and tested it for some time, and I am not really convinced it can be trusted.
Good luck!
Andronote3 said:
I really don't see how this phone is gonna change anything. Apps and websites have keyloggers, You still need a carrier to get service from and they have control of all your traffic. What about radio frequencies that can be intercepted, IP addresses, GPS chips sending signals to satellites, baseband and firmware are connected thru the cell towers of the carrier. I'm starting to think this phone is a scam.
They said nothing about how they're dealing with all this. They are probably using the whole NSA scandal momentum to fool people into believing they are safe if they buy this phone.
Sent from GNote 3 rooted with kingo.
Click to expand...
Click to collapse
Would just like to correct this common misconception, GPS is one way.
GPS receivers as found in your phones, or navigation systems, receives GPS signals only. Nothing gets sent to satellites in this process, the algorithm is purely one way.
I want to buy ONE+7 for flashing roms n rooting.But i recently faced some-fissy matters about Oneplus backdoor,According to this person Elliot Alderson, Oneplus r giving permissions to hackers by creating a backdoor on the chipset(probably).
>https://www.wired.com/story/oneplus-phones-have-an-unfortunate-backdoor-built-in/
>https://motherboard.vice.com/en_us/article/59y4vz/oneplus-backdoor-engineer-mode
guys i m very worried about this thing.Need help to investigate.is it possible to hack ?!?!?
My 1+7P does not have the Engineering Mode app. Those articles are 2 years old, so my guess is they don't ship with that app any more.
jdhedden said:
My 1+7P does not have the Engineering Mode app. Those articles are 2 years old, so my guess is they don't ship with that app any more.
Click to expand...
Click to collapse
Its not an app, its behind the scenes, its located in system/app folder, which can be debloated with root. But I have had been using OnePlus devices since OnePlus One with no issues, Identity theft or hacking. Always had bootloader unlocked and rooted.
markmywordz said:
I want to buy ONE+7 for flashing roms n rooting.But i recently faced some-fissy matters about Oneplus backdoor,According to this person Elliot Alderson, Oneplus r giving permissions to hackers by creating a backdoor on the chipset(probably).
>https://www.wired.com/story/oneplus-phones-have-an-unfortunate-backdoor-built-in/
>https://motherboard.vice.com/en_us/article/59y4vz/oneplus-backdoor-engineer-mode
guys i m very worried about this thing.Need help to investigate.is it possible to hack ?!?!?
Click to expand...
Click to collapse
Yes it's possible to hack. This is a serious Memory Leak vulnerability in the chipset, where a hacker can chain multiple hardware level exploits to leak sensitive information in your CPUs TLB cache.
Chill man, we're using android OS, with all sorts of components from different manufacturers, in a digital age where privacy is a myth. You can't do anything if Snapdragon has a backdoor in their chipset, or your NFC/Bluetooth chip might have. Google knows everything about you and what you do on the phone.
You can't do anything to save yourself from the components you use (Google's OS, Different vendors chipsets, OnePlus's Phone), they all collect certain amount of data from you, and that's expected, everybody everywhere does it. And there's always a flaw everywhere that hackers are constantly using to hack your device (recent WhatsApp's bug which was actually a flaw in the SRTP protocol itself), they're called 0-days when they're discovered. Unless they aren't, you won't even know how many hackers have access to your data and your device.
So either don't use smartphone or any sort of connected digital equipment, or use it and stop worrying about hackers.
rootSU said:
Yes it's possible to hack. This is a serious Memory Leak vulnerability in the chipset, where a hacker can chain multiple hardware level exploits to leak sensitive information in your CPUs TLB cache.
Chill man, we're using android OS, with all sorts of components from different manufacturers, in a digital age where privacy is a myth. You can't do anything if Snapdragon has a backdoor in their chipset, or your NFC/Bluetooth chip might have. Google knows everything about you and what you do on the phone.
You can't do anything to save yourself from the components you use (Google's OS, Different vendors chipsets, OnePlus's Phone), they all collect certain amount of data from you, and that's expected, everybody everywhere does it. And there's always a flaw everywhere that hackers are constantly using to hack your device (recent WhatsApp's bug which was actually a flaw in the SRTP protocol itself), they're called 0-days when they're discovered. Unless they aren't, you won't even know how many hackers have access to your data and your device.
So either don't use smartphone or any sort of connected digital equipment, or use it and stop worrying about hackers.
Click to expand...
Click to collapse
Privacy is not a myth.
Only for privacy reason many users falsh a custom rom, use microg instead of google.
But Snapdragons already have a backdoor, Just like intel management engine it has build in engine(2nd OS) inside chipset(intregrate with ARM architecture)
>https://thehackernews.com/2016/03/android-root-hack.html?m=1
>https://www.osnews.com/story/27416/the-second-operating-system-hiding-in-every-mobile-phone/
>https://www.androidauthority.com/qualcomm-critical-flaw-chipsets-979708/
https://wccftech.com/security-exploits-put-snapdragon-powered-devices-at-risk-of-hacking/
markmywordz said:
Privacy is not a myth.
Only for privacy reason many users falsh a custom rom, use microg instead of google.
But Snapdragons already have a backdoor, Just like intel management engine it has build in engine(2nd OS) inside chipset(intregrate with ARM architecture)
>https://thehackernews.com/2016/03/android-root-hack.html?m=1
>https://www.osnews.com/story/27416/the-second-operating-system-hiding-in-every-mobile-phone/
>https://www.androidauthority.com/qualcomm-critical-flaw-chipsets-979708/
https://wccftech.com/security-exploits-put-snapdragon-powered-devices-at-risk-of-hacking/
Click to expand...
Click to collapse
The debate on this is endless, but I'd just say that you contradicted yourself by first saying that Privacy is not a myth, and then saying SD has a backdoor inbuilt.
Nobody buys a $700 phone with the latest chipset and 4G/5G connectivity to debloat and not install anything on it. As soon as you're on the internet, no matter custom rom, no matter what apps you have installed on it, you're giving up your privacy one way or the other.
If you truly want privacy, live a life like Richard Stallman, look him up, and see how he accesses the internet to maintain his privacy: https://stallman.org/stallman-computing.html
Richard Stallman said:
I am careful in how I use the Internet.
I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it (using konqueror, which won't fetch from other sites in such a situation).
Click to expand...
Click to collapse
markmywordz said:
I want to buy ONE+7 for flashing roms n rooting.But i recently faced some-fissy matters about Oneplus backdoor,According to this person Elliot Alderson, Oneplus r giving permissions to hackers by creating a backdoor on the chipset(probably).
>https://www.wired.com/story/oneplus-phones-have-an-unfortunate-backdoor-built-in/
>https://motherboard.vice.com/en_us/article/59y4vz/oneplus-backdoor-engineer-mode
guys i m very worried about this thing.Need help to investigate.is it possible to hack ?!?!?
Click to expand...
Click to collapse
Old articles that have nothing to do with the 7 Pro or any recently released OnePlus device.
If you are that worried, unlock the boot loader and root.
Then run an app that sniffs all traffic leaving the phone.
Moderator Announcement: Thread cleaned and closed as it developed into (nicely called) a political discussion and consparicy discourse.
XDA Forum Rules (excerpt):
...
2. Member conduct.
(...)
2.4 Personal attacks, racial, political and / or religious discussions: XDA is a discussion forum about certain mobile phones. Mobile phones are not racial, political, religious or personally offensive and therefore, none of these types of discussions are permitted on XDA.
...
Click to expand...
Click to collapse
So I'm looking to buy a new phone and it seems that about 70% of the market share in the best buys is comprised of Chinese owned manufacturers.
There have been numerous reports of such manufacturers collecting user-identifable data and phoning home with it. I know that western owned phone companies collect data but believe that the rules /laws, ehtics and security are better followed in the west. I'm not trying to get into a debate of east vs west btw this is just my opinion. Yes I know that almost all phones are manufactured in China but I'm more concerned about who is influencing the companies themselves if they are Chinese.
So given that I value my privacy and want to keep personal data out of the hands of bad actors I'm left with a choice of buying a western owned phone which are generally much lower spec for a price point or perhaps buying Chinese and rooting.
My question is whether this is a practical answer given the need to use a phone as a secure device e.g. 2FA and internet banking apps etc and a daily driver? Also my experience tells me that when one takes a custom ROM they take on responsibility for applying patches and updates which is something of an administration burden I probably don't have the time /inclination for.
For the record I've flashed and used custom roms on about 3-4 devices in the past so have some first hand experiance but wondered if things have changed for the better or worse?
They could have embedded hidden backdoors in the hardware or worse.
Well, things are still the same, if not even worse. Beside security patches, Google has been cracking down on rooted users, so in the near future some features and some apps might stop working. Unfortunately users with just an unlocked bootloader might be caught in the crossfire. As for privacy, try Xiaomi. Sure, there have been rumors of Spyware on Xiaomi devices. Well, back in January some cybersecurity firm from Germany test that theory. Proved it was false.
Germany: No evidence of spying from Xiaomi phones
One point for Xiaomi
www.gadgetmatch.com
Thus Xiaomi might be one of the good ones. At least in terms of being spied by them. Sure, third party apps also spy on you, but for that you have adb.
Fytdyh said:
Well, things are still the same, if not even worse. Beside security patches, Google has been cracking down on rooted users, so in the near future some features and some apps might stop working. Unfortunately users with just an unlocked bootloader might be caught in the crossfire. As for privacy, try Xiaomi. Sure, there have been rumors of Spyware on Xiaomi devices. Well, back in January some cybersecurity firm from Germany test that theory. Proved it was false.
Germany: No evidence of spying from Xiaomi phones
One point for Xiaomi
www.gadgetmatch.com
Thus Xiaomi might be one of the good ones. At least in terms of being spied by them. Sure, third party apps also spy on you, but for that you have adb.
Click to expand...
Click to collapse
That's bad to hear that Google are trying to put the squeeze on and a deterrent to investing time and energy installing Roms that may only get worse with time in terms of G Apps and services.
Hmmm that article refers to an absence of censorship rather than not spying.
Here's an example of the story which I've seen repeated elsewhere on Xiaomi spying:
Exclusive: Warning Over Chinese Mobile Giant Xiaomi Recording Millions Of People’s ‘Private’ Web And Phone Use
Xiaomi is collecting users’ browser habits and phone usage, raising red flags for privacy researchers.
www.forbes.com
steveyc2 said:
That's bad to hear that Google are trying to put the squeeze on and a deterrent to investing time and energy installing Roms that may only get worse with time in terms of G Apps and services.
Hmmm that article refers to an absence of censorship rather than not spying.
Here's an example of the story which I've seen repeated elsewhere on Xiaomi spying:
Exclusive: Warning Over Chinese Mobile Giant Xiaomi Recording Millions Of People’s ‘Private’ Web And Phone Use
Xiaomi is collecting users’ browser habits and phone usage, raising red flags for privacy researchers.
www.forbes.com
Click to expand...
Click to collapse
Sorry about that.
At this point, I doubt there isn't a smartphone maker that does not track its users. From chinese makers to American makers, everyone tracks their users. Their data sells the best. At this rate, if you want to totally protect your privacy, don't buy a phone. Anything and everything can be tracked. Dumb phones and smartphones. So picking a smartphone isn't going to keep your privacy secure. You might have a say in how many people do you want to track you, based on phone's price.
steveyc2 said:
So I'm looking to buy a new phone and it seems that about 70% of the market share in the best buys is comprised of Chinese owned manufacturers.
There have been numerous reports of such manufacturers collecting user-identifable data and phoning home with it. I know that western owned phone companies collect data but believe that the rules /laws, ehtics and security are better followed in the west. I'm not trying to get into a debate of east vs west btw this is just my opinion. Yes I know that almost all phones are manufactured in China but I'm more concerned about who is influencing the companies themselves if they are Chinese.
So given that I value my privacy and want to keep personal data out of the hands of bad actors I'm left with a choice of buying a western owned phone which are generally much lower spec for a price point or perhaps buying Chinese and rooting.
My question is whether this is a practical answer given the need to use a phone as a secure device e.g. 2FA and internet banking apps etc and a reliable daily driver? Also my experience tells me that when one takes a custom ROM they take on responsibility for applying patches and updates which is something of an administration burden I probably don't have the time /inclination for.
For the record I've flashed and used custom roms on about 3-4 devices in the past so have some first hand experiance but wondered if things have changed for the better or worse?
Click to expand...
Click to collapse
To be on the safe side, you can install an alternative ROM, such as LineageOS, instead of the preinstalled OS: requires phone's bootloader is unlockable.
Be aware that no cell phone provides you with true anonymity.
xXx yYy said:
To be on the safe side, you can install an alternative ROM, such as LineageOS, instead of the preinstalled OS: requires phone's bootloader is unlockable.
Click to expand...
Click to collapse
yes i know i can do that- and the firmware too- my question was about the practicality of living with such a phone once done
xXx yYy said:
Be aware that no cell phone provides you with true anonymity.
Click to expand...
Click to collapse
Yes, aware of that, just trying to minimise exposure while still having a usable phone
blackhawk said:
They could have embedded hidden backdoors in the hardware or worse.
Click to expand...
Click to collapse
worrying but if one wipes the firmware and ROM then that would mitigate any hardware backdoor risks I would have thought?
Has anyone actually tested a custom rom on a chinese phone that was known to send data back to chinese servers?
For example:
test with stock rom: wireshark shows phone sending information to chinese IP
test with custom rom: wireshark shows no packets sent to chinese IPs.
sso003 said:
Has anyone actually tested a custom rom on a chinese phone that was known to send data back to chinese servers?
For example:
test with stock rom: wireshark shows phone sending information to chinese IP
test with custom rom: wireshark shows no packets sent to chinese IPs.
Click to expand...
Click to collapse
Some infos could go to an American proxy server then to Chinese. In order to be sure no one gets you data, learn to code and make your own rom and your own apps. Open source apps are an option if you know to check the source yourself.