Database Info

Custom ROMs have a security hole when installing apps from the market!

While working on my Toggle 2G app, I found that I can run an app in the CM6 system process by signing it with the CM6 cert. If you download the apk from my app thread, and install it, you will see that the app will have access to your entire phone and all permissions are listed. This is a good thing since it actually tells you that it will have all permissions.
However when I posted this app to the market, and installed it, it only showed the 1 permission! This means that anyone running a custom ROM, like CM6, with a key that is available to anyone can download an app from the market that has full access to your phone without you knowing it.
Discuss....

TheMasterBaron said:
While working on my Toggle 2G app, I found that I can run an app in the CM6 system process by signing it with the CM6 cert. If you download the apk from my app thread, and install it, you will see that the app will have access to your entire phone. This is a good thing!
However when I posted this app to the market, and installed it, it only showed the 1 permission! This means that anyone running a custom ROM, like CM6, with a key that is available to anyone can download an app that has full access to your phone without you knowing it.
Discuss....
Click to expand...
Click to collapse
Have you checked this with TeamDouche?

No, I don't think it specific to CyanogenMod. Any custom ROM signed with a cert that's publicly available could has this problem.

i don't see how that's a good thing...
that is most likely a bad thing considering they can put malicious code into your phone without you even knowing it.

mr_billionaire said:
i don't see how that's a good thing...
that is most likely a bad thing considering they can put malicious code into your phone without you even knowing it.
Click to expand...
Click to collapse
What I was saying is that it's a good thing that if you install the apk from your sd card, you are correctly warned of all the permissions the app will have access to.
It's when installing from the market that you don't get warned of all the permissions the app will have access to. That's the bad thing.

TheMasterBaron said:
What I was saying is that it's a good thing that if you install the apk from your sd card, you are correctly warned of all the permissions the app will have access to.
It's when installing from the market that you don't get warned of all the permissions the app will have access to. That's the bad thing.
Click to expand...
Click to collapse
I don´t like what your saying here...but there´s no way out (yet), right?

I think it would be up to Google to fix the Android Market app to properly list all the permissions an app will inherit instead of just listing the ones that the app has explicitly specified.
Another option is have all ROM coders add code to prevent apps from installing from the market if they share a process with system apps.

the CM team could have the cert only on the build server, it's only accessable by those we trust to build the roms, I'd be happy with that.

Any updates on this issue, as it is a security concern?

Just read the user comments. If it is malicious, people will say so. I never read the permissions anyway.

installing an apk

ok, i have just done the v10d update and the video is much better...
Now id like to install an apk from my desktop of minidiary but it doesnt install..
Is that what rooting is for? to accept all apk's?
Sorry for the dumb question, i was a symbian s60v3 and s60v5 user..

Nope. To install apk's you just need to tell the phone to accept non-market items. Go to your phone's settings, then Applications and check the top option (should be called something like Unknown Sources, I have to translate from Dutch).
Then just copy the apk to your phome and use Polaris Office or a separate apk installer from the market to browse to the apk and install it.

Hello
I tried that and it didnt work, was not installed or something like that. I ticked it to accept non android market apps.
Its probably pirated i guess.. found it on the net. Does rooting make it accept all non-signed apps? What is root for?
Thanks
ps: does anyone know where i can download mini-diary. Great little app i saw in the galaxy s2

No, rooting gives you administrative access to some files which you normally don't have so you can customize the phone the way you like it.
The safest way to download applications is via the Market app on your phone (you can also try http://market.android.com). However if you don't want to pay for some apps then you can search google adding the ".apk" and the apk version in the search bar.

Changing Device Name for Market

Hello All,
I use a Viewsonic gTablet with Brilliant Corners ROM 1.3.0 installed, I thought it was supposed to come with the latest market version ( 3.1.3 ), but mine didn't seem to..of course I've already fixed that. My issue now is that when I try and install a new app. on my gtab, my device seems to be identified wrong. i downloaded and installed the Android ID Changer successfully, but I can't seem to change the items I want to change correctly with it. I also have installed the Root Explorer app. installed on my gtab, I can get into the system/build.prop folder and view everything ok, but i don't see any way to edit in there. It was my understanding that a 'text editor' was included with the root explorer app., but either I can't find it or don't know how to use it. Can anyone help me ?
Thanks,
David

Att LG G3 Carrier IQ Removal Guide

Well I hate carrier IQ and just today I finally got it to 0 using Voodoo Carrier IQ Detector. I got some of it right away using the old G2 method, but I still was not clean so I spent a couple days poking around. Finally I found LADDM.apk.
You need ROOT, this is for the Att version.
Apps:
Android Tuner
Root Explorer (I think Android Tuner has a root exploer too)
More details from adiliyo (Thanks)
ok, for people who are new to this, here is how i did it
download android tuner
click on application manager
click / pivot to apps tab
click the button on the bottom that says user and it will change to system
longpress on android system
click open
click details
pivot to all the tabs and uncheck anything with carrier iq in it
remove lib files
uninstall apk mentioned
presto!
Using Android Tuner go to Apps then Android System. Go through and uncheck all Carrier IQ listings.
Then find LADDM.apk and delete it (Backup first is advised). This is a nasty app, all carrier IQ as far as I can tell and check out the permissions before you delete it, it really looks at how you use your phone.
I also went into System/lib and backed up then deleted the 2 carrier IQ files in there.
Reboot and then run Voodoo Carrier IQ Detector!
Here is my log:
Carrier IQ was not found
Detection score: 0
Test for: Linux kernel interfaces
(KERNEL_INTERFACES, weight 50)
nothing found
Test for: Android logcat debugging log
(LOGCAT, weight 100)
nothing found
Test for: Linux kernel drivers
(KERNEL_DRIVERS, weight 50)
nothing found
Test for: System services
(SERVICES, weight 70)
nothing found
Test for: ROM binaries and daemons
(SYSTEM_BINARIES, weight 70)
nothing found
Test for: ROM configs
(ETC_CONFIG, weight 0)
nothing found
Test for: Packages
(PACKAGES, weight 70)
nothing found
Test for: Running processes
(RUNNING_PROCESSES, weight 200)
nothing found
Test for: Suspicious classes
(SUSPICIOUS_CLASSES, weight 0)
found: com.carrieriq.iqagent.service.receivers.BootCompletedReceiver
Test for: Linux kernel dmesg log
(DMESG, weight 100)
nothing found
--
Voodoo CarrierIQ Detector 2.0.5
Sent via mobile device

This works great! You should also post this guide in the ATT G3 section.
http://forum.xda-developers.com/att-lg-g3

sn707 said:
Well I hate carrier IQ and just today I finally got it to 0 using Voodoo Carrier IQ Detector. I got some of it right away using the old G2 method, but I still was not clean so I spent a couple days poking around. Finally I found LADDM.apk.
You need ROOT, this is for the Att version.
Apps:
Android Tuner
Root Explorer (I think Android Tuner has a root exploer too)
Using Android Tuner go to Apps then Android System. Go through and uncheck all Carrier IQ listings.
Then find LADDM.apk and delete it (Backup first is advised). This is a nasty app, all carrier IQ as far as I can tell and check out the permissions before you delete it, it really looks at how you use your phone.
I also went into System/lib and backed up then deleted the 2 carrier IQ files in there.
Reboot and then run Voodoo Carrier IQ Detector!
Here is my log:
Carrier IQ was not found
Detection score: 0
Test for: Linux kernel interfaces
(KERNEL_INTERFACES, weight 50)
nothing found
Test for: Android logcat debugging log
(LOGCAT, weight 100)
nothing found
Test for: Linux kernel drivers
(KERNEL_DRIVERS, weight 50)
nothing found
Test for: System services
(SERVICES, weight 70)
nothing found
Test for: ROM binaries and daemons
(SYSTEM_BINARIES, weight 70)
nothing found
Test for: ROM configs
(ETC_CONFIG, weight 0)
nothing found
Test for: Packages
(PACKAGES, weight 70)
nothing found
Test for: Running processes
(RUNNING_PROCESSES, weight 200)
nothing found
Test for: Suspicious classes
(SUSPICIOUS_CLASSES, weight 0)
found: com.carrieriq.iqagent.service.receivers.BootCompletedReceiver
Test for: Linux kernel dmesg log
(DMESG, weight 100)
nothing found
--
Voodoo CarrierIQ Detector 2.0.5
Sent via mobile device
Click to expand...
Click to collapse
Never used Android Tuner - could you give a more perceise step by step? I have no idea where you are talking about Apps then Android System

could you list the names of the files you unchecked from android tuner as well as in system/lib ?
i haven't been able to find any suspicious files on mine aside from the apk which i uninstalled (thanks!)
EDIT:
ok, i found the libs unsing the voodoo iq detector, everything else looks clean though, all i did was delete the apk...
i only show the libs (which i will delete now) and the boot detection agent that you have still showing as well, so i'm clean?
EDIT 2: as after removing the two iq libs, i get "android system has stopped" and it just looks time for adb
to be clear i had removed "libiq_client.so" and "libiq_service.so" from /system/lib
replacing them got rid of the crash. what am i missing?

adiliyo said:
could you list the names of the files you unchecked from android tuner as well as in system/lib ?
i haven't been able to find any suspicious files on mine aside from the apk which i uninstalled (thanks!)
EDIT:
ok, i found the libs unsing the voodoo iq detector, everything else looks clean though, all i did was delete the apk...
i only show the libs (which i will delete now) and the boot detection agent that you have still showing as well, so i'm clean?
EDIT 2: as after removing the two iq libs, i get "android system has stopped" and it just looks time for adb
to be clear i had removed "libiq_client.so" and "libiq_service.so" from /system/lib
replacing them got rid of the crash. what am i missing?
Click to expand...
Click to collapse
I got the same- but I am not in a place where I can add them back on FUUUUU

nest75068 said:
I got the same- but I am not in a place where I can add them back on FUUUUU
Click to expand...
Click to collapse
if you have root explorer and didn't just delete them (i had moved them to back them up) you can slowly just copy them back (keep pushing ok and clicking on stuff before the error comes up again)
that's what i ended up doing since adb didn't want to see my phone on this computer. took like 10 minutes though...still looking for the files to remove so it works!
EDIT: added the files in case anyone deleted them and needs them

EDIT ok luckilyI saved them to dropbox - took a lot of quick finger movements but got them exported backa nd copied back into Sys Lib
So for anyone wanting to try this, don't just root explorer delete - just an FYI lol

ok, for people who are new to this, here is how i did it
download android tuner
click on application manager
click / pivot to apps tab
click the button on the bottom that says user and it will change to system
longpress on android system
click open
click details
pivot to all the tabs and uncheck anything with carrier iq in it
remove lib files
uninstall apk mentioned
presto!

adiliyo said:
if you have root explorer and didn't just delete them (i had moved them to back them up) you can slowly just copy them back (keep pushing ok and clicking on stuff before the error comes up again)
that's what i ended up doing since adb didn't want to see my phone on this computer. took like 10 minutes though...still looking for the files to remove so it works!
EDIT: added the files in case anyone deleted them and needs them
Click to expand...
Click to collapse
Thank you so much for posting these. I was a dolt and forgot to save a backup copy and just simply renamed the files.

Pdj7969 said:
Thank you so much for posting these. I was a dolt and forgot to save a backup copy and just simply renamed the files.
Click to expand...
Click to collapse
no problem! retyping with that error screen would have been a 3 hour process

nest75068 said:
EDIT ok luckilyI saved them to dropbox - took a lot of quick finger movements but got them exported backa nd copied back into Sys Lib
So for anyone wanting to try this, don't just root explorer delete - just an FYI lol
Click to expand...
Click to collapse
Thanks for the idea! Downloaded the copy of the files in the post above to my work PC, saved them to Dropbox, then spent about 10 minutes furiously tapping on my screen to go to Dropbox app, export the files to the phone, open Root Explorer, select both files, navigate to the \system\lib folder, and paste. As soon as the paste completed, the errors stopped. I think I'll wait until I get home to tinker with this some more....that was a stressful hour trying to figure out how to fix this.

adiliyo said:
ok, for people who are new to this, here is how i did it
download android tuner
click on application manager
click / pivot to apps tab
click the button on the bottom that says user and it will change to system
longpress on android system
click open
click details
pivot to all the tabs and uncheck anything with carrier iq in it
remove lib files
uninstall apk mentioned
presto!
Click to expand...
Click to collapse
Nailed it thanks! I am thinking they need to be unchecked before you remove the system/lib files. Sorry that some had issues with that. I didnt have any problems that way.

adiliyo said:
ok, for people who are new to this, here is how i did it
download android tuner
click on application manager
click / pivot to apps tab
click the button on the bottom that says user and it will change to system
longpress on android system
click open
click details
pivot to all the tabs and uncheck anything with carrier iq in it
remove lib files
uninstall apk mentioned
presto!
Click to expand...
Click to collapse
THANK YOU - that worked perfectly.
No more carrieriq according to Voodoo

sn707 said:
Nailed it thanks! I am thinking they need to be unchecked before you remove the system/lib files. Sorry that some had issues with that. I didnt have any problems that way.
Click to expand...
Click to collapse
yes, after unchecking it's all fine to remove the libs (probably because system is no longer trying to access the libs!)

adiliyo said:
yes, after unchecking it's all fine to remove the libs (probably because system is no longer trying to access the libs!)
Click to expand...
Click to collapse
l got boot loop and I'm pretty sure I unchecked first. I'm on Att ... same thing happened on a s5 before. I thought it was just the s5, but apparently g3 rigged to crash too without ciq. I deleted on my g2 last year and no problem... Att got smart. Trying to kdz flash as we speak.

mjgspr95 said:
l got boot loop and I'm pretty sure I unchecked first. I'm on Att ... same thing happened on a s5 before. I thought it was just the s5, but apparently g3 rigged to crash too without ciq. I deleted on my g2 last year and no problem... Att got smart. Trying to kdz flash as we speak.
Click to expand...
Click to collapse
My guess is you missed something, I'm running with no issues after removing the libs. Did you go through all the tabs in system to get everything? I think there's like 5 or so items to uncheck.
Sent from my LG-D850 using Tapatalk

Mine is running just fine after following the op. big thanks and an up yours to at&t.
Sent from my LG-D850 using XDA Free mobile app

got them all... maybe in conjunction with other crap I removed since rooting I goofed. Tot recluse almost done. we shall see...

mjgspr95 said:
got them all... maybe in conjunction with other crap I removed since rooting I goofed. Tot recluse almost done. we shall see...
Click to expand...
Click to collapse
Here I posted screen shots of everything I've frozen along with everything I've unchecked. This should help you out a bit... Also do it in the following order.
1. Freeze laddm.apk
2. Uncheck all boxes with android tuner
3. Rename lib files to .bak extension
http://forum.xda-developers.com/showthread.php?p=54225359
http://forum.xda-developers.com/showthread.php?p=54225487
Sent from my LG-D850 using XDA Premium 4 mobile app

So I'm coming from an iPhone4 and I followed the steps and did all this. Except I just renamed the lib files to .bak but they're still showing up when I run the carrier iq checker. Do I HAVE to delete them? I figured renaming would do the trick just fine...

installing google dialer on honor 8

i couldn't install the google dialer apk on my honor 8 phone (FRD-L04). Tried sideloading various versions of it downloaded from apk mirror, nothing get installed.
Could somebody help out if you have managed to install the same

https://play.google.com/store/apps/details?id=com.google.android.dialer

Google store says my phone isn't compatible.

Are you rooted?
Is your phone rooted? It's the only way this will work.
Take this apk, use a root file explorer (I like solid explorer) and copy it to root/system/priv-app. Then edit the read/write permissions ( I usually enable everything).
You can also use link2sd to make the apk a system app.
Then just reboot your phone and you should be good to go.
You'll have to go to apps, settings, pick defaults, and choose it as the dialer.
Also, if you are rooted, you can then delete the stock dialer, but be careful, you might delete the wrong thing and then no phone for you. (I had that issue, but a kind forum member was able to get me the missing apk)
If somehow it DOES get messed up, you'll have to reflash via dload, or get the correct apks and place them on priv-app (again, if you're rooted)

thanks for the reply.. i don't want to root my phone though..
SolarisSixth said:
Is your phone rooted? It's the only way this will work.
Take this apk, use a root file explorer (I like solid explorer) and copy it to root/system/priv-app. Then edit the read/write permissions ( I usually enable everything).
You can also use link2sd to make the apk a system app.
Then just reboot your phone and you should be good to go.
You'll have to go to apps, settings, pick defaults, and choose it as the dialer.
Also, if you are rooted, you can then delete the stock dialer, but be careful, you might delete the wrong thing and then no phone for you. (I had that issue, but a kind forum member was able to get me the missing apk)
If somehow it DOES get messed up, you'll have to reflash via dload, or get the correct apks and place them on priv-app (again, if you're rooted)
Click to expand...
Click to collapse

yeah same here...
Not sure how the compatibility check works..
Google has published these contacts and Phone / dialer app in play store. but its not installable in all phones..
i followed another thread..
and installed google contacts sync apk, (gave it all permissions) then contacts apk and then dialer apk, this way i am able to get the dialer app installed (but its version 3.x only, other versions i couldn't get install),
Now i got the Dialer icon (blue) one it opens the regular dialer interface. but when i make call the interface goes to Honor 8 dialer app interface.. not sure how this works..
denism81 said:
Google store says my phone isn't compatible.
Click to expand...
Click to collapse

its shows my device is not compatible..
zimmen said:
https://play.google.com/store/apps/details?id=com.google.android.dialer
Click to expand...
Click to collapse

I know this is a few months old...
I was looking for a higher version number of Google Dialer that could be compatible with the Honor 8.
To the best of my knowledge, this is the only version compatible: http://www.apkmirror.com/apk/google...71529-nonnexus-android-apk-download/download/
I've used this very same version on my Moto X Pure.

marv_in_lbc said:
I know this is a few months old...
I was looking for a higher version number of Google Dialer that could be compatible with the Honor 8.
To the best of my knowledge, this is the only version compatible: http://www.apkmirror.com/apk/google...71529-nonnexus-android-apk-download/download/
I've used this very same version on my Moto X Pure.
Click to expand...
Click to collapse
This is best compatible with AOSP ROMs.

Wasn't the first question about installing Google Dialer on an Honor 8? It was even stated that they tried to sideload multiple different versions as well... from APK Mirror... the same place I shared the link from. I merely wanted to state that the version I linked to is the last version that I know personally works on phones that aren't Nexus/Pixel. All you can do is try it or not. It works. Just download, install normally, set it to default app.

The dialer installs just fine on the honor 8. I'm running it right now. There's a few threads about how to do it correctly here on XDA. First rule, search before asking.

agraceful said:
The dialer installs just fine on the honor 8. I'm running it right now. There's a few threads about how to do it correctly here on XDA. First rule, search before asking.
Click to expand...
Click to collapse
This isn't a new thread - it's months old. Someone just resurrected it by adding a new comment. And yes, the app can be side loaded onto the Honor 8, but it will only be the dialer and contact list UI. The in call UI will remain stock and caller id will not work.
Results with rooted devices may vary though.