Sandbox/fresh-image/instanced ROMS or web browser applications - Security Discussion

Hi,
I was curious if anyone knows of any instanced sandboxes for android; something were all your data is wiped during reset or logout. I'm searching for something that functions along the lines of a live disc or a sandboxed browser. I don't download new/unpopular apps or check out new websites because I'm always worried about the unlikely event of a virus or spyware in general - and it's not really much fun being stuck to the same routine sites.

Related

[Q]How to be full anonymous on Android

Is it possible to use Internet while keep annonymous ??
Well as soon as you go on the internet you are going to leave a fingerprint behind. You can minimize this a bit but you can't visit websites and not visit them at the same time. You can only make it less obvious that you visited them.
Some things that can make it harder for you to be tracked:
- Use a costum rom (AOSP probably best) without Google Apps.
- Use a VPN (Virtual Private Network) while browsing the web. This way websites only know that a certain "server" visited them, but they do not know who is behind this server. This way it becomes a lot harder to trace the visit back to you.
- Use Firefox Browser, it helps especially compared to Chrome.
- Send DoNotTrack requests (With tools such as Ghostery). Most web browsers now have an option build-in.
- Use an Adblocker on untrusted websites (Pref not on XDA ). Adaway is one of the apps you can use on Android to achieve this.
If you this kind of things on your Android device you will become a lot more anonymous. Ofcourse this is all pretty basic, if you start throwing out your passwords and name in the stuff you post online, ofcourse you no longer be anonymous . The largest danger is in giving your information to random websites/people on the internet. Tools such as e-mail maskers are always useful. Also try to refrain from installing apps without checking their permissions and stuff. If you install "Cute Free Wallpaper App" you might be infesting your device with malware, no matter how much protection you use it still all boils down to common sense.
H-Cim said:
Well as soon as you go on the internet you are going to leave a fingerprint behind. You can minimize this a bit but you can't visit websites and not visit them at the same time. You can only make it less obvious that you visited them.
Some things that can make it harder for you to be tracked:
- Use a costum rom (AOSP probably best) without Google Apps.
- Use a VPN (Virtual Private Network) while browsing the web. This way websites only know that a certain "server" visited them, but they do not know who is behind this server. This way it becomes a lot harder to trace the visit back to you.
- Use Firefox Browser, it helps especially compared to Chrome.
- Send DoNotTrack requests (With tools such as Ghostery).
- Use an Adblocker on untrusted websites (Pref not on XDA )
If you this kind of things on your Android device you will become a lot more anonymous. Ofcourse this is all pretty basic, if you start throwing out your passwords and name in the stuff you post online, ofcourse you no longer be anonymous . The largest danger is in giving your information to random websites/people on the internet. Tools such as e-mail maskers are always useful. Also try to refrain from installing apps without checking their permissions and stuff. If you install "Cute Free Wallpaper App" you might be infesting your device with malware, no matter how much protection you use it still all boils down to common sense.
Click to expand...
Click to collapse
Thanks a lot bro.. for your gud suggestions
You can install Orbot and Orweb to browse through the Tor network. This is much slower than using a VPN, but you don't have to trust a VPN provider to keep you anonymous.
Thanks you too !:good:
Tor isn't for beginners or total secure but people seems not able to understand it.
It your traffic isn't encrypted this means you sent plain text, passwords etc it goes unencrypted to the nodes and if these notes are compromised it's 'easy' to identify what you sent via deep package inspection. Silkroad was busted by this, an compromised www site with an sql hack and ... Tor is useless, so easy is that. Again it's not designed and never will be for beginners if we talking about 'total security'.
Heavyly hetting detected in the Web!
I was EDV-Technikan, and would really know more about be Nearly-Anonymouse. have a few tips without VPN, WARP,Tor Browser... If your Phone is rooted you can do more so how whats best Magisk,Root, Apps or other things i can USE ??
Thanks for Helping
How far are you ready to go in order to achieve anonymity?
It's kind of possible, but it's a bit cumbersome.
First, you need different browsers for different activities so that you have different fingerprints.
For example, one browser only for personal stuff where you real name appears like emails, tickets, banks etc., one browser only for emails and accounts where your real name doesn't appear, and one browser only for web surfing on websites where you aren't registered and don't need to be.
On all browsers try to avoid as much as you can to have Java script enabled, for banks and tickets you mostly can't but you can for emails (at least some of them so depending on which email you use you may want to change for one that doesn't require Java script to be enabled) and you can for many websites as long as you don't watch videos.
Atlas is a good browser, it isn't open source but it's clean and it enables you to switch between Java script and non Java script easily.
Naked browser is a good clean choice too.
Avoid like plague Chrome, and even Mozilla that isn't anymore what it used to be (unless you build your own version and you remove the nasty stuff).
Then you need different identities depending on which browser you use.
That is, everytime you switch browser you turn the WiFi off, you fire a script that changes your Mac address, your android ID and all the other IDs your phone may have, including phone model, phone manufacturer etc., and then you turn the WiFi back on and switch IP on your VPN if you use one (I personally don't, I don't see the point since I'm not a bad guy and since anyway a government agency could most likely oblige your VPN provider to give you away).
Now as said above you'll need a clean AOSPish ROM, without any Google apps (which is where most people's desire on privacy hiccups, because they can't live without the Google apps' suite).
You'll have to be rooted.
You'll need a firewall like AF+.
You'll need a network log app to check which app connects where, specially for newly installed apps that require internet access.
You'll have to be careful with the apps you install and go as much as possible with open source apps.
If you are into social networking, don't install their apps (unless you know how to patch closed source apps, see below), it's far safer, and battery friendly, to access their sites from a browser.
You'll have to learn how to compile your ROM, your kernel and your apps from source, and clean whatever needs to be cleaned before compilation because even pure AOSP has some unpleasant code like analytics and connections to Google everytime you turn the internet on (even if you don't have any Google apps installed, and even if you haven't opened any browser or internet allowed app yet) and because even open source apps use sometimes stuff you don't want.
If needed, you'll have to learn how to patch closed source apps to remove the analytics, the gms and the Facebook spywares​ if present, and whatever else you may find (Firebase, crashlytics etc.), and to remove the unwanted permissions, services, receivers and providers.
You'll have to learn how to use and read logs because patched apps often crash.
Last but not least, you'll need some common sense and change the way you interact with the internet...
If you do all of the above, you'll have a good level of anonymity.
So it's definitely possible, but one has to work a bit...
Are you willy to work?
I habe just tryed permissions ruler,3 WebBrowser,Network Connector to See what Apps and scrips works in Background of Android. Most is Google Framework nearly Evers secound Sending or looking up for anything...! AS i like some Google Services i will SetUp now next Rom without Google Services .... Would you have some Ideas,Apps,Roms,Markets like 1Market,Blackmart, Network Connector,Anty Spyware ?
Thanks a lot
Fdroid is good for open source apps. a good firewall. find a privacy oriented browser , i.e. yandex , startpage , duckduck go , tor. FairEmail for your email client. very privacy oriented.
https://forum.xda-developers.com/showthread.php?t=3824168

[GENERAL] Get back data privacy on android

Hi there,
I hope this is the right place to post such question, otherwise, please feel free to move to the right place.
I am quite into mobiles, since day 1 (1999 for me). This is also why I bought an HTC G1 ...
Anyway, when installing "Network Connections", I was quite surprised, how many connections, how many apps had, to several servers, even of services I dont use. My weather app calling Facebook, even though I dont have facebook on my mobile et all. "Brave" Browser, no tabs open, however, six connections...
Then the news with the Apps using trackers (PayPal, Outlook etc.). I really like my privacy, but I dont see, that this is respected. I do know, that nothing comes for free in life, and I do know, that it is a trade-off, data against services. And for Google it is okay (Google Maps e.g. couldnt live without it), but I think a few too many, want to have a peace of the cake, in particular, after I have paid for the apps (because, I also know, they need to make a living).
Anway, long story short, what is there I can do to protect myself, learn how it works etc. Pleasese refrain from tellin gme to sell my mobiel, turn off the internet etc
I used xprivacy on my Nexus4 - still a good idea?
I am using Android and iOS.
Thanks a lot in advance
Try MyAndroidTools to disable Google spyware embedded in apps. Components like these:
GcmInstanceIDListenerService GcmMessageListenerService
AppMeasurementService FirebaseInstanceIdService FirebaseMessagingService
AppMeasurementInstallReferrerReceiver AppMeasurementReceiver FirebaseInstanceIdInternalReceiver FirebaseInstanceIdReceiver
FirebaseInitProvider
These are all Google-related tracking/ analytics. Along with any Crashlytics components you see.
Stop using ALL Google apps. Including Chrome. Including bundled spyware. Including Play store. Including Calendar. Including SMS. Remove all of them from your rooted device and install non-Google equivalents. Try Osmand and others for maps and other apps from f-droid to get the functionality you want. Yes, it takes time.
Find app to change hostnames and Mac addresses and clean persistent cookies if you want. Find websites such as https://apps.evozi.com/apk-downloader/ to download some apps you can't get from f-droid.org. Some apps rely on Google Play being installed. In my experience, none of them are worth it. If your app requires them and you can't live without it, probably forget any decent privacy.
If using a Mozilla-based browser, add these to your block list in Adaway:
accounts.firefox.com
blocklist.addons.mozilla.org
blocklist.settings.services.mozilla.com
detectportal.firefox.co
dynamicua.cdn.mozilla.net
fhr.cdn.mozilla.net
firefox.settings.services.mozilla.com
incoming.telemetry.mozilla.org
input.mozilla.org
install.mozilla.org
location.services.mozilla.com
mozorg.cdn.mozilla.net
mz.la
search.services.mozilla.com
shavar.services.mozilla.com
snippets.cdn.mozilla.net
tracking-protection.cdn.mozilla.net
updates.push.services.mozilla.com
versioncheck-bg.addons.mozilla.org
webextensions.settings.services.mozilla.com
...to help stop browser spyware.
Download apps from f-droid. Use a good firewall. Use AdAway. Customise your blocklist in AdAway. Disable all auto update components unless you trust the CIA and NSA to 'take care' of your device.
Etc.
https://www.zerohedge.com/news/2017-08-28/how-cia-made-google
You may wish to consider blocking these Google domains if you are adamant you want no business with Google:
adservice.google.com
adservice.google.com.au
ajax.googleapis.com
apis.google.com
books.google.com
books.google.com.au
clients1.google.com
clients2.google.com
clients3.google.com
chart.googleapis.com
crashlytics.com
cse.google.com
console.firebase.google.com
encrypted-tbn0.gstatic.com
firebase.google.com
fonts.googleapis.com
fonts.gstatic.com
ggpht.com
googleanalytics.com
id.google.com.au
imasdk.googleapis.com
lh3.ggpht.com
lh4.ggpht.com
lh5.ggpht.com
lh6.ggpht.com
mail.google.com
maps.googleapis.com
ota.googlezip.net
payments.google.com
safebrowsing-cache.google.com
safebrowsing.google.comsb-ssl.google.com
ssl.gstatic.com
support.google.com
www.googleapis.com
www.googlecommerce.com
You can add more if you are really enthusiastic.
Many are safe to add to your AdAway block list, but some of these will annoy you on some websites or apps that use Google infrastructure, so be warned. You can always temporarily disable AdAway ad-blocking or identify the domain you want to remove from the blocklist by using the Log DNS Requests feature.
Thank you
Thank you @comfortable - I really appreciate you took the time, to give me such a long and detailed reply.
Persepctively a complete avoidance of Google is the long-term goal. At this stage, I am more interested in avoiding smaller fish (like my alarm clock, which unfortunately offers a unique feature: slowly increasing alaram sound, gibes you a relaxed wake-up).
I am using Adhell already, and already diabled background call via AMB shell, however this made apps stop working compeltely (Runtastic e.g.).
Thanks for pointing out the relevant components! Thats quite helpful... I already condiered installing pihole and surfing via OpenVPN so this would filter out quite a bit of such stuff?
So yes- thanks again, I have a new project and will work off the measures you listed!!! Thank you. :good:

Do Android Phones get Malware or Viruses by just going on a website

So basically I went on a website with loads of pop up ads, scan for virus stuff and other suspicious stuff. I didn't click on them but I want to ask if by just clicking on a weird website, can you get malware or a virus on an android phone? I researched but all I find is that the only dangerous thing that can get you a virus or malware is downloading something outside of google play store or mainly on the web. Replies are much appreciated
You may get a malware by visiting ugly websites, the pop-up you dismissed might have been faked and pushed crap on the phone. When this happens, hit home and force close the browser and remove its data.
I would suggest adblocker although it might be not 100 % sure but still protects you.

Any reports of Google services spying on non-Google apps?

Today I was on my Sony Xperia XZ2 Compact, reading Facebook (using the Android Facebook app).
I was reading a bicycle forum, and replied to a thread regarding a local landmark.
I decided to double-check I was getting the name right, so I went to the Google search widget, and started typing the name of the landmark. The landmark is called "Hawk Hill" - I typed "ha" and "Hawk Hill" popped up as the first suggestion.
Now, that seems way too damned coincidental for it not to have been Google services scanning what I type in other apps.
I've searched here for discussions on what kinds of spying Google does; I mean, I know they scan data in their own apps, examine my search history, look at what web sites I've visited, etc. I don't love that, but I can live with it.
However, Google spying on my Facebook app? Really? I thought that the terms of service don't allow Google services to spy on non-Google apps. I could believe that they might see what websites I visit, but on an SSL-encrypted connection, how could they be reading the data exchanged?
Has anyone been following what the current state of Google spying on user activity is, especially vis a vis "always on listening" on the mic, or spying on other apps data?
- Tim
G-Works
tbessie said:
Today I was on my Sony Xperia XZ2 Compact, reading Facebook (using the Android Facebook app).
I was reading a bicycle forum, and replied to a thread regarding a local landmark.
I decided to double-check I was getting the name right, so I went to the Google search widget, and started typing the name of the landmark. The landmark is called "Hawk Hill" - I typed "ha" and "Hawk Hill" popped up as the first suggestion.
Now, that seems way too damned coincidental for it not to have been Google services scanning what I type in other apps.
I've searched here for discussions on what kinds of spying Google does; I mean, I know they scan data in their own apps, examine my search history, look at what web sites I've visited, etc. I don't love that, but I can live with it.
However, Google spying on my Facebook app? Really? I thought that the terms of service don't allow Google services to spy on non-Google apps. I could believe that they might see what websites I visit, but on an SSL-encrypted connection, how could they be reading the data exchanged?
Has anyone been following what the current state of Google spying on user activity is, especially vis a vis "always on listening" on the mic, or spying on other apps data?
- Tim
Click to expand...
Click to collapse
Lool that's the point of google company lol... get custom ROM and don't install gapps, lol even facebook is spying on your activities, even your personal data aka phonebooks, messagess, etc... where did you live all these years lool...
Don't get me wrong but all that gapps and others social apps were make that way. that's the price of your digital life.. you become a product.
I'll never gonna use that [email protected], spyware, datamining, etc in my life.. get custom ROM and don't install [email protected] and you'll be safe.
Respect your privacy and your device.
Good luck and stay safe.
tbessie said:
Today I was on my Sony Xperia XZ2 Compact, reading Facebook (using the Android Facebook app).
I was reading a bicycle forum, and replied to a thread regarding a local landmark.
I decided to double-check I was getting the name right, so I went to the Google search widget, and started typing the name of the landmark. The landmark is called "Hawk Hill" - I typed "ha" and "Hawk Hill" popped up as the first suggestion.
Now, that seems way too damned coincidental for it not to have been Google services scanning what I type in other apps.
I've searched here for discussions on what kinds of spying Google does; I mean, I know they scan data in their own apps, examine my search history, look at what web sites I've visited, etc. I don't love that, but I can live with it.
However, Google spying on my Facebook app? Really? I thought that the terms of service don't allow Google services to spy on non-Google apps. I could believe that they might see what websites I visit, but on an SSL-encrypted connection, how could they be reading the data exchanged?
Has anyone been following what the current state of Google spying on user activity is, especially vis a vis "always on listening" on the mic, or spying on other apps data?
- Tim
Click to expand...
Click to collapse
Hi Tim,
Let me start by saying that I am not in favor of all these practices and I do not like that these companies use our information however they please.
That said I will try to be as impartial as possible
"I've searched here for discussions on what kinds of spying Google does; I mean, I know they scan data in their own apps, examine my search history, look at what web sites I've visited, etc. I don't love that, but I can live with it."
You can look at myActivity (google it) and see all the data they have collected from you, you can delete it, pause the data collection (partially) or even have it deleted only after a few months.
They do everything you just said, and much more.
"However, Google spying on my Facebook app? Really? I thought that the terms of service don't allow Google services to spy on non-Google apps. I could believe that they might see what websites I visit, but on an SSL-encrypted connection, how could they be reading the data exchanged? "
Well technically all they did was read your clipboard, which if you're using gboard , they can.
Also note that Facebook will not work without Google's cloud services installed on the phone, so there is already a comunication overlay between the two services .
You can try to take some control back by using a different keyboard , using the web browser version of facebook and/or installing blokada wich will block not only ands but some of the more intrusive trackers they use .
if you have any questions or observations , please tell me!
FB is spyware... and malware.
I ditch it after a month over 12 years ago.
Wouldn't call any of this spying, just an auto/smart suggestion based on your browsing/typing history. Also doubt Google is reading everytging from your Facebook app to make these suggestions.
If you are using gboard, that most likely is how this suggestion was made. If you aren't using gboard then it would be a bigger mystery. Either change keyboard or look into keyboard settings and turn off suggestion/autocomplete/learning and similar "smart" settings.
Also, got rid of intrusive Facebook years ago...
drnightshadow said:
Lool that's the point of google company lol... get custom ROM and don't install gapps, lol even facebook is spying on your activities, even your personal data aka phonebooks, messagess, etc... where did you live all these years lool...
Don't get me wrong but all that gapps and others social apps were make that way. that's the price of your digital life.. you become a product.
I'll never gonna use that [email protected], spyware, datamining, etc in my life.. get custom ROM and don't install [email protected] and you'll be safe.
Respect your privacy and your device.
Good luck and stay safe.
Click to expand...
Click to collapse
That's a lot of lols and lools.
You're not telling me anything I don't already know. If you'll reread my post, I was asking for info on the specifics of what types of spying are KNOWN and verified to be occurring - what is google spying on? What is the mechanism of action? Are they recording every keystroke, reading every encrypted stream, reading all app data, etc? What info is exchanged between Android/google and other apps? Etc.
I'm a software guy, and I was asking for TECHNICALLY SPECIFIC answers, as this is a technical forum. General warnings and hyperbole aren't helping. :-/
Disable Google Firebase... it inventories all kinds of personal files.
With regards to the question asked with this thread's title:
Google Play Services is a library ( read a collection of software routines accessed by Android programs - mainly GMS apps ) not an Android program , hence you must not fear you - or any app - will be spied on by Google Play Services.
FYI:
Google Play Services basically acts as a shim between the normal Android apps and the installed Android OS. Right now Google Play Services handles the Google Maps API, Google Account syncing, remote wipe, push messages, the Google Play Games back end, and many other duties.
If you ever question the power of Google Play Services, try disabling it. Nearly every Google App ( keyword: GMS ) on your device will break.
Don't confuse things!
jwoegerbauer said:
With regards to the question asked with this thread's title:
Google Play Services is a library ( read a collection of software routines accessed by Android programs - mainly GMS apps ) not an Android program , hence you must not fear you - or any app - will be spied on by Google Play Services.
FYI:
Google Play Services basically acts as a shim between the normal Android apps and the installed Android OS. Right now Google Play Services handles the Google Maps API, Google Account syncing, remote wipe, push messages, the Google Play Games back end, and many other duties.
If you ever question the power of Google Play Services, try disabling it. Nearly every Google App ( keyword: GMS ) on your device will break.
Don't confuse things!
Click to expand...
Click to collapse
I normally run with it disabled; it saves time, trouble and battery (a fair amount too). Disabling it saves me from firewall blocking a bunch of apps; it's easier to toggle gps on/off when needed.
Keeps Find my Device from setting it's self as a System Administrator, which I really don't want running, ever. Kills gmaps too, yah.
Maps, location don't need to constantly be running in the background unless you need them to be running.
The only time disabling it is a pain is to access Playstore which requires a reboot with it enabled. I have only one app that requires constant Playstore connection to work, SD Maid Pro; it gets disabled anyway as I get tired of it constantly running in the background.
I flat out don't trust any Google product... as a result of Google's actions and history.

Apps for finding spyware someone installed on my phone?

I've looked at a lot of anti-spyware apps, but I can't find one that specifically says it can find stealth apps that someone installed when they got ahold of your phone. So it would look like an app that I personally wanted to have. They mostly talk about apps that were installed by a virus or link, etc.
It would be nice to be able to disable camera/mic functions too, or at least be notified when they are being accessed.
I don't mind paying to purchase the app, but most require a double digit monthly subscription, and I make next to nothing because I'm disabled so chances are even if I subscribed the money wouldn't be there to continue the subscription.
I've lurked here for many years without signing up, I love you guys! There are so many tutorials and apps that would never have known about if not for you guys. The developers here are geniuses. So thank you immensely in advance for your help!
Maybe try play store free app Bitdefender which has 5 million dl's & 4.7 rating. I have not tried it....
"Bitdefender Antivirus is one of the few actually free antivirus apps. It hasn’t changed much over the years. It offers a basic scanning feature, a simple interface, quick performance, and no configuration. This is a great one for super basic needs. All it really does is scan stuff ..." androidauthority
galaxys said:
Maybe try play store free app Bitdefender which has 5 million dl's & 4.7 rating. I have not tried it....
"Bitdefender Antivirus is one of the few actually free antivirus apps. It hasn’t changed much over the years. It offers a basic scanning feature, a simple interface, quick performance, and no configuration. This is a great one for super basic needs. All it really does is scan stuff ..." androidauthority
Click to expand...
Click to collapse
Thanks for the reply. Do anti-virus apps detect spyware though?
They can, just read some of the app playstore reviews and it's Developer app description for details....
Try ‘Malwarebytes for Android’.
If you really think there's spyware do a hard reset.
If you still aren't satisfied go full nuke and have the firmware reflashed.
No virus detection has a 100% detection rate and the worst trojans only a reflash can eradicate them.
A better question is why do you think there's spyware on the phone?
In over 6 years of using outdated OS's I've never had to do a reload because of malware.
Once found a nasty trojan preloader before it could be triggered with Malwarebytes.
I had a infected jpeg that damaged files in the download folder. Deleting the jpeg and some of the files ended it's brief rain of terror.
Be careful what apps you load, what you download*, what you click and never let others have unsupervised access to your device. React quickly to abnormal behavior to find it's cause.
Delete any file you suspect of being malware including jpegs and pngs.
Be prepare to do a hard reset at any time if you believe the device has been infected.
Always keep at least 2 complete isolated data backups for the device. Stagger syncs to them so a virus can't get embedded on both of them... hopefully.
Lol, paranoid yet?
*use only cloud based email apps like gmail
Google apps are spyware, Facebook is spyware, Whatsapp is spyware, Instagram is spyware. In principle all Social Media apps are spyware.
All apps what are designed to track your Internet browsing habits, such as frequented sites and favorite downloads, and then provide advertising companies with marketing data are spyware. All apps what can access your contacts data are spyware ...
Android, the spyware party mix...
You can try Bitdefender Free or Malwarebytes Premium. I have not used the second one before but have read a review at https://antivirusdoctor.net/ and think about using it on my smartphone.

Categories

Resources