Database Info

HtcLoggers.apk and other eavesdroppers

By now, some you have seen reports about the latest bit of under-the-covers eavesdropping, this time by HtcLoggers.apk. In case you haven't, this post on Android Police details the whole thing pretty well.
One thing that really caught my attention was the graphic showing all the different ways various bits of Android snoop on you:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Those of us not running HTC software don't have to worry about most of these. The one that remains for all of us, at least according to the research so far, is Google Checkin, part of GoogleServicesFramework.apk. You can see in the graphic what kind of information Checkin collects and where it puts it. I've seen /data/system/dropbox before, occasionally I clear it out because it collects a huge number of files. I hadn't really paid much attention to /data/system/usagestats.
Using Root Explorer, I see that the permissions on both these directories is rwx------. As an experiment, to see if I can block whatever Checkin is collecting, I deleted their contents and then removed all permissions on these directories (and rebooted for good measure). I did this about an hour ago. So far, the directories have remained empty.
My G2 (running ILWT CM7 build 216) appears to be functioning normally, including the Market. If anything malfunctions, I'll report here.
Update. More directories to block: /data/anr, /data/tombstones, /data/dontpanic. File to block: /data/system/userbehavior.db (I first used SQLite Editor to empty the file).
Do not attempt this procedure on /data/system/throttle -- this caused my phone to enter a boot loop, which I had to repair by booting into recovery and then reverting my permissions change through ADB.

Quick follow-up... Looks like removing all permissions on the two directories has no effect on the phone's behavior. I've seen no breakage and the directories remain empty. So if you want to thwart some data collection, this looks like a decent approach.

So now that some time has passed, what is veridict? Were there any averse affects on the phone? Does everything still work?

Still seeing no problems. I did the same thing to my Nook Color, and it's also behaving normally.

This is very interesting, I'll try changing the permissions too.

Updated original post: added a few more directories to block based on additional information reported by the Carrier IQ Logging Test App.

I also gave this a try...
And so far so good! Thanks!

Storage Speed / Device Encryption

I have been toying around a bit with the feature of full phone encryption (not just the apps and data but also the "sdcard" internal storage partition.
Observation 1 (which may or not be known or evident to you already, but which I still find odd): It is possible to encrypt a "full" or half full device, but it seems to be not possible to go and decrypt the device again later on while retaiing the data (assuming the right password of course). Being a long time user of Truecrypt I find this irritating, one could of course argue it is safety measure of some kind, but I really would see no harm in enabling the possibility. As the password would of course be required to get into the system and initiate the decryption process there is no additional risk - if the attacker already has the password he can use it to gain access and copy the plaintexted data someplace else anyways. So is this caused by architecture of the pre boot authorization, just sloppy and careless coding or am I missing something vital here?
Observation 2: The performance impact with encryption enabled is worse than I would have dared to believe. I used two different SD Card Speed measurement apps from the market to test speed on a regular, non-encrypted setup and on an encrypted setup.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Encryption enabled
Plaintext operation
All other settings in the apps and the device were identical.
Is this sloppy coding or are the Snapdragon CPU just ill-equipped to handle encryption algorithms efficiently enough? I don't really want to get into a grassroots debate here over how useful encryption may or may not be on a device that most of us want s-off and rooted, therefore allowing all sorts of exploits etc. but I am honestly surprised by the heavy performance hit.
Does anyone know what algorithms are used? I assume some run of the mill AES?

[APP][2.2+] SDCard Watcher - Find out which apps clutter your SDCard

SDCard Watcher
Market Link: https://play.google.com/store/apps/details?id=com.desaster.sdcardwatcher
Description / Reasoning
Anyone who installs a lot of apps will soon find their SDCard cluttered with strange directories that don't seem to relate to any app you know. You could just remove them all, but how do you know which directories are from apps you are still using, and might contain some important data?
Since the sdcard filesystem lacks ownership info, there's really no easy way of knowing which app to blame. This app is my approach to the problem.
Basically the app lets you monitor any chosen directory for changes, and when a new file or directory is created, it checks which app is currently visible to the user, and saves this information in a database. This way, next time some app leaves an obscure directory rotting on your sdcard, you will know exactly which app to blame.
Why should you care?
Actually, you probably shouldn't. The extra bits of data often don't take any significant space on your memory card. However, it irritates me, and this app gives me a bit more of a sense of control. The XDA forum is probably the best place for me to post this app, since I know there are at least a few other like-minded people here who care about tweaking little things like these
Battery usage
The app's background process uses the kernel's inotify feature to catch changes in the filesystem, and thus uses virtually no processing power, and will not drain your battery.
Reliability
There are essentially two ways for an app to run a background service; as a background service, and as a background service with a notification icon. My app supports both ways, but the default is to run without a notification icon.
I am still unsure if android lets the service run reliably enough without the notification icon, so if you think you're missing file changes, I'd love to hear about it. In any case, the notification icon can be enabled in the settings and should help with the issue (should there be an issue).
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Should I keep using these Chinese phones? (Doogee, BlackView)

I bought 2 Chinese smartphones: One is from a company called "Doogee", and the second is called "BlackView"
The Doogee one came with many weird apps preinstalled, so I installed Malwarebytes, and it detected 2 malwares. Both removed. After a day, Malwarebytes prompted me that a malware app is trying to install itself (one of those I removed!) - So I stopped using this phone. Hopefully did not risk too much of my personal information (passwords, emails, etc).
Meanwhile, the other Chinese phone I ordered has arrived. Knowing about those security issues now, I immediately installed Malwarebytes, and it detected that the Sound Recorder app is a malware, and is actually using data(?):
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
T

@TroyGuard I would recommend to search for a custom rom build from source to get rid of that stock spy roms :good:

@TroyGuard
personally I wouldn't use them but as you have bought phones you probably want to.
Though on twitter recently Elliot Alderson (@fs0c131y was asking for such phones to analyse, he'd probably be happy to get one!
So If no custom ROM then you should be able to freeze those apps, system or preinstalled, that are risky or unknown (though they often come back, so freeze normally better). If you read the recent threads you will find links to a number of ways to do this, eg using TWRP, ADB, apps like Debloater etc which may work on those phones
WARNING: be careful freezing system apps, freezing an essential app can make your phone unusable, check online first if in doubt
Change all your passwords after this is done, to be safe.
(though there is still the possibility of a hardware backdoor , but I've not seen any reports of this.)
(Note: you probably won't get automatic OTA updates anymore as the ota updater is often part of the problem, besides you would have to refreeze apps after new install, but might be worth updating manually if it gives you important security patches)

55GB space missing on SDCard after deleting file

I use Syncthing regularly to backup some things from the phone to my PC and it works rather nicely.
Syncthing - Wikipedia
en.wikipedia.org
However, it often chokes on big files, eg I wanted to copy some kiwix files (aka precompiled wiki) to my SDCard (the other way around which works also very well for small files).
Kiwix - Wikipedia
en.wikipedia.org
Welcome to Kiwix Server
library.kiwix.org
Well, that full wiki has some 99GB and it got stuck. So I stopped Syncthing and deleted the remnant incomplete file... took forever, I got impatient and rebooted my fon.
Ouch, no empty space was recovered - I am missing about 55GiB "emptiness". Remembering vaguely that exfat is windows, I thought to just check it quickly in Win10... except it didn't work (check via properties):
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Can anyone explain this? What would be the proper way to enforce a check and free up my space?
PS: The card is a 512GB from Kingston with read/write above 70MB/s.

AFAIK modern SD-cards support CMD38 ( AKA TRIM ) command.
Check whether the SD-card in question supports CMD38 command and if, then apply it.
More info here:
Quickly Wipe an SD Card with ESP8266
In a previous story, I have written about connecting an SD Card to an ESP8266. During my adventures, I have discovered some interesting…
pawitp.medium.com

jwoegerbauer said:
modern SD-cards support CMD38 ( AKA TRIM ) command
Click to expand...
Click to collapse
Thanks! I would have expected a 512GB card is modern enough but no luck so far:
fstrim: /media/xxx/[email protected]: the discard operation is not supported
So I searched and found two apps:
https://forum.xda-developers.com/t/...ol-of-your-device-nand-chip-trimming.3038240/
https://forum.xda-developers.com/t/...tility-for-android-no-root-necessary.4258765/
Feature set was limited (basically just on and off, cannot select mounts/devices). Tried to set trim at reboot, no luck. Next step was busybox:
~ $ sudo busybox fstrim -v /storage/8549-8438
fstrim: ioctl 0xc0185879 failed: Function not implemented
Yeah, unless there is another idea... I think I just reformat it today (and won't reboot my fon next time so quickly if it occurs again).
PS: When moving all my files from sdcard to pc, something did get triggered and a lost-folder popped up. Unfortunately it was only half of it, instead of 55GB now "only" 34 were missing