Public Wifi and Android [in]security - General Questions and Answers

Open question to all, especially if you frequent establishments with open wifi --- What if any security do you use? I'd hope some kind of Firewall, possibly private VPN? And more importantly have you actually verified it provides you with any kind of security?
My issue is this - No matter what I do, cellphones leak data like a waterfall. Seems basically impossible to tell the damn devices to stop broadcasting to the world. Don't call home to clients1.google.com (or any incarnation thereof, and there are many). Don't enable bonjour / zeroconf. Etc.
I literally have no browser installed yet I noticed connecting to open Wifi with portals bring up some kind of browser. Does it store cookies? Does it leak my device id, model, serial # .. IMESI? (believe it or not some applications try to stuff that in an HTTP header).
One of the biggest reasons I ever rooted my phones is I've tried rootless firewalls, they do nothing but have a nice gui.
It's bloody infuriating.

Related

Public Beta for Norton Smartphone Security Premier Edition

Anyone interested
http://www.symantec.com/home_homeoffice/beta/overview.jsp?pvid=nssp1beta
Thanks, I needed a laugh.
I am particularly curios as to how they identify SMS as SPAM (with no subject or formatting to rely on)...
I'd say a few words on the antivirus part too but I don't want to give them any ideas ;-)
Oh almost forgot - it would be a super neat trick to hack in to smartphone via the internet (given utter lack of server components in the OS)!
i never heard about anybody who irl had a virus on their pda
much less of anybody who had a firewall
and yet plenty of people are willing to have both firewalls and virusscanners on their pda's
hope they overclock to make their pdas allmost as fast as if they dident
I read some news article (didn't save the link) about a very "good" spyware app for blackberry.
Not only could it monitor all mail and SMS on the device as well as phone calls but it could also turn on the microphone on without a call to turn the device in to a "bug" (as in surveillance device not the stuff MS software is full of).
One thing I couldn't figure out is how did this super dangerous program (which needed to be installed by user despite being referred to as a "Trojan") transfered all that data back to the source without the user noticing and without interfering with device operation.
How much upstream bandwidth does BB have?
Can it do data and voice at the same time (can it do voice at all?).
Any way I am sure that one of these days we will see a real virus for WM platform (a proof of concept file infection has been developed - that does not work with signed files of course).
But until than - if you have nothing better to do with your phone might as well keep the battery draining with a good antivirus / firewall.

[APP]Pixie Network Monitor (Wireshark/Kismet for Android)

So... I'm rather new here and I'm not 100% sure that this is the correct forum to post this in (since I know it says "xda developed apps/games only"). However, I have seen commercial Android apps discussed here before... so... *shrug*.
Let me first say that I am not the developer... I just think this app should get some attention.
Pixie Network Monitor by 9bitlabs (would post a link but my account is restricted. ;-) )
It is a network monitoring app similar to Wireshark, but for Android. It is $4.99 on the Android market, it requires root, and it does not work on all phones (since not all phones can have their wifi put into promiscuous mode). There is a companion app called "Pixie Probe" available on the market for free. Pixie Probe will determine whether or not your phone is compatible with Pixie.
I have tested it out on my Evo (running CM6.1 RC1) and it seems to work amazingly well.
Pixie does not contain all of the features of Wireshark/Kismet. This is from the Pixie FAQ:
Q: What's the difference between Pixie and a desktop tool like Kismet?
A: The biggest difference between the tools lies in how they interface with the network. Kismet interacts directly with the wireless adapter and places it in monitor mode, allowing it to hear any packet over the wifi, even if it is not associated with a network. This can be problematic with some hardware, but many of the newer wifi chipsets work great with Kismet.
Pixie, on the other hand, is constrained by Android. Rather than expose the wifi adapter as an 802.11b device, Android actually hides all of that functionality: the wifi connection actually appears to system processes as a plain old Ethernet device. This means that we don't get monitor mode and we also don't get to see wifi-specific data, such as beacons and associate/disassociate packets.
On the plus side, Pixie runs in your pocket and that's harder to do with Kismet, unless you have very large pockets. Pixie is also significantly easier to set up for folks without Linux experience.
Click to expand...
Click to collapse
The Pixie website gives very detailed information about the app, so I suggest you go there if you want more info.
In any case, I hope other people find it useful.

Solution/possible solution for Tether police issues

I don't have much time to look into it at the moment, but for those of you who tether either internet or bluetooth you should look into getting NAT going on your phone. This requires root as far as I know.
You can use iptables (comes with our kernels), ipchains, netfilter, or what ever else passes for NAT/firewall these days on linux. I'll probably end up compiling a ipchains binary here in the next couple weeks if I don't find one (I haven't been able to as of yet)
That will solve the problem of detection via originating address.
To bypass deep packet inspection, look into an encrypted VPN solution. There are some free ones out there, or you can try something like what Giganews offers. Depending on how AT&T does things, this could also potentially speed up your service because many ISPs give VPNs higher QOS priority. This could also be a bad thing because they could decide you need to be on the enterprise plan. Use at your own risk. If you really want to get crazy, tunnel a VPN through an SSL proxy.
One other thing that will help that will help in general is to install any firewall program. Here are a couple I found on the market (sorry can't link yet):
com.wemobs.internetfirewall
com.mm.plugins.contactsprotect.droidwall1
com.dexters.andfirewall
com.googlecode.droidwall.free
I have not tested any, but they all appear to allow you to pick and choose which applications can access the internet. What better way to make sure no applications are phoning home without permission.
These may or may not turn on the NAT functionality for you.
YMMV, but I hope this helps someone
I think tor has some android proxy service, should help.

[UPDATE] All Android Wifi Tools In One Place

I have done some reading and observed some Android Wifi tools which could be useful to you guys.
I know some of you guys already know about some of these apps whiles others don't.
My First Wifi Tool is Dsploit.
Introducing dSploit
dSploit is an Android network analysis and penetration suite which aims to offer to IT security experts/geeks the most complete and advanced professional toolkit to perform network security assesments on a mobile device. Once dSploit is started, you will be able to easily map your network, fingerprint alive hosts operating systems and running services, search for known vulnerabilities, crack logon procedures of many tcp protocols, perform man in the middle attacks such as password sniffing ( with common protocols dissection ), real time traffic manipulation, etc, etc . This application is still in beta stage, a stable release will be available as soon as possible, but expect some crash or strange behaviour until then, in any case, feel free to submit an issue on GitHub.
Here are some screen shots http://www.dsploit.net/images/shots/1.png
http://www.dsploit.net/images/shots/2.png
And A Walk through Video http://youtu.be/HrQl1cG2Hq0
And you could visit their website http://www.dsploit.net/
My srecond Wifi tool I wanna Show you Guys is Anti-Android Network Toolkit
What is Anti?
ZImperium LTD is proud to annonce Android Network Toolkit - Anti.
Anti consists of 2 parts: The Anti version itself and extendable plugins. Upcoming updates will add functionality, plugins or vulnerabilities/exploits to Anti
Using Anti is very intuitive - on each run, Anti will map your network, scan for active devices and vulnerabilities, and will display the information accordingly: Green led signals an 'Active device', Yellow led signals "Available ports", and Red led signals "Vulnerability found". Also, each device will have an icon representing the type of the device. When finished scanning, Anti will produce an automatic report specifying which vulnerabilities you have or bad practices used, and how to fix each one of them.
This App is Kind of a paid App. But you can get the free version from here http://zantiapp.com/anti.html
Here is a link to the walk through video http://youtu.be/tKW-XV59-gk
My third Wifi Tool is Wifi Kill
Its an application for killing wifi connections, that is preventing users on that network from getting to their websites.
I couldnt find the website for this app. (Seems they dont have any). But you could download it from
Here : http://mediafire.com/?ue5itmf89w5h4x2
Here is a link to the walk through video http://www.youtube.com/watch?v=MtaPF6NcOeo
My third Wifi Tool is Droid Sheep.
Its Actually in Two forms
DroidSheep [Root] is an Android app for Security analysis in wireless networks and capturing facebook, twitter, linkedin and other accounts.
DroidSheep Guard is another Android app for monitoring Androids ARP-table. It tries to detect ARP-Spoofing on the network, such as an attack by DroidSheep, FaceNiff and other software.
For Some reasons, the Doidsheep[Root] cant be downloaded from their website which is this http://droidsheep.de/
But dont worry you can find it here at http://depositfiles.com/files/ektsufdkl
On the other hand, DroidSheep Guard can be found at the playstore
https://play.google.com/store/apps/...h.droidsheep.guard.free&feature=search_result
The next one is Android Netspoof
Description
Network Spoofer lets you change websites on other people’s computers from an Android phone. After downloading simply log onto a Wifi network, choose a spoof to use and press start.
Please note that there is no intention for Network Spoofer to include any malicious features. This application is a fun demonstration of how vulnerable home networks are to simple attacks, with permission of the network owner - DO NOT attempt to use Network Spoofer on any corporate or other non-residential networks (eg. at school, university). It becomes very obvious when Network Spoofer is being used on a Network, and use of Network Spoofer will be considered malicious hacking by network administrators.
It can be downloaded from here http://sourceforge.net/projects/netspoof/files/latest/download
There is another App called AoutoProxy
Description
The most complete proxier on the Market. Autoproxy allows you to use Market, Gmail, maps or surf the web even behind the proxy from your home/school/office.
It works by creating a transparent/intercepting proxier running on your phone that redirects web traffic to your proxy. Other apps don't have to be aware there is a proxy!
All outgoing traffic is captured, formatted and transmitted through your network's proxy. That means it works with market, all browsers, gmail, maps, and others.
This is App is a paid app but they have got the light version.
here is a link to it https://play.google.com/store/apps/details?id=com.mgranja.autoproxy&hl=en
FaceNiff
FaceNiff is an Android app that allows you to sniff and intercept web session profiles over the WiFi that your mobile is connected to.
It is possible to hijack sessions only when WiFi is not using EAP, but it should work over any private networks (Open/WEP/WPA-PSK/WPA2-PSK)
It's kind of like Firesheep for android. Maybe a bit easier to use (and it works on WPA2!).
*** ROOTED PHONE *** is required. Please note that if webuser uses SSL this application won't work.
This application due to its nature is very phone-dependant so please let me know if it won't work for You
Use with stock browser (might not work with other)
Legal notice: this application is for educational purposes only. Do not try to use it if it's not legal in your country.
I do not take any responsibility for anything you do using this application. Use at your own risk
It can be downloaded from here http://faceniff.ponury.net/download.php
I will Be updating the list frequently.
UPDATE
So as i said, i would be updating this and guess what i have kept my promise.
There is this App called Intercepter-NG its another android wifi tool i find useful.
Intercepter-NG is a multifunctional network toolkit for various types of IT specialists. It has functionality of
several famous separate tools and more over offers a good and unique alternative of Wireshark for android.
The main features are:
* network discovery with OS detection
* network traffic analysis
* passwords recovery
* files recovery
Runs on Android >=2.3.3 with root+busybox
Looks better on high resolution, but completely comfortable on 480x720.
It can be downloaded from the playstore https://play.google.com/store/apps/...t#?t=W251bGwsMSwxLDEsInN1LnNuaWZmLmNlcHRlciJd
Another important Wifi tool for android is Wifi WOlf
- PCMag.com Editors' Choice award winner for network utilities
If you are a network administrator or a network engineer that has any WiFi / wireless on your network then you already know that you need a good WiFi network monitoring / analyzer tool or toolkit to properly manage and analyze inside your wireless network. Without the proper network tools you have no way to determine proper functionality of your WiFi network or identify security risk that comes with having wireless technology inside of your enterprise corporate LAN. As a network administrator or engineer you already have many other responsibilities with your network such as managing servers, routers, switches, workstations, inventory management, asset management, bandwidth monitoring, troubleshooting... the list is long. Make sure you have a tool that makes your wireless network management easier!
- Active Passive Pre-Deployment and Site Survey and WiFi Analyzer network tools for wireless professionals. Works on 802.11 N, G, B, and A networks (Depends on device)
Quickly perform wifi site surveys by simply double tapping on floor plan to register samples
2.4Ghz and 5Ghz wifi analyzer fully supported in all wireless tools
WiFi Heatmapper
WiFi AP Edge Map
WiFi Channel Map
WiFi Stumbler
WiFi Analyzer
Access point filters allow you to analyze AP edge individually
Wireless security filters identify and analyze secure and non-secure (WEP, Ad-Hoc, Open) wireless networks
Sub-filters allow you to filter out weak WiFi coverage areas
Network Icons for mapping out your hardware
Export all views for email or printing
Export and Import all surveys for backup or to share with other techs using Wolf WiFi Pro
Create multiple sites
Supports and analyze broadcast and hidden SSIDs (once known to device)
Complete help documentation at www.wolfwifi.com and videos on www.youtube.com
-WiFi Scanner and analyzer with summary view and detailed view
-Channel Graph displays and analyze channels in use to easily identify congestion
-Signal Tracker helps you track down access points and adjust antennas
-802.11 A/B/G/N support (depends on device)
It can also be downloaded from the store https://play.google.com/store/apps/...nByaXNpbmdhcHBzLmFuZHJvaWQud29sZndpZmlwcm8iXQ..
And one more thing, The app WifiKIll can also be used to redirect web pages to a specific site.
you can do so by first knowing the sites IP Address, then u open the wifi kill app and go to settings the select rejection method drop policy + redirect to.......
Afterwards click on redirect to IP and insert the Ip of the site you want to redirect to.
Note that None of these Apps are mine and all these apps require root, also i am not the cause of any damages these apps could do to your phone. Thanks
Enjoy:fingers-crossed:
But If you have any questions with these apps or questions on how to install any of them, feel free to ask.
Thanks once more.
DroidSheep link is broken
Turbokat said:
DroidSheep link is broken
Click to expand...
Click to collapse
Its not broken, just choose regular download and wait for the countdown to complete.
Sent from my myTouch 4g using xda app-developers app
here you guys might like this as well.
https://app.box.com/s/1h0mdqynmb5lcz0gasbf
Another tool for site survey
There is another free android tool for heat maps creation - "WiFi Maps Light", available on GOOGLE PLAY, documentation can be found on app's official site.
you gonna want for sure bcmon.apk if you want to get your wifi crack on. crack wep and wpa/wpa2-wps natively in rooted android rom.
http://bcmon.blogspot.com/
https://bcmon.googlecode.com/files/bcmon.apk
https://code.google.com/p/bcmon/
thisworks on a lot of devices i have it working on a samsung galaxy nexus sprint, htc glacier, samsung galaxy s2, nexus 7-2012-grouper, and a couple others. no need for custom rom even just root and youre golden
Commented to follow on this wonderful index
Sent from my E151
Network Toolbox for Android
Another great tool I came across recently is Network Toolbox for Android:
play .google .com/store/apps/details?id=com.appsropos.whois
It includes a bunch of handy admin tools including Whois, RBL checks, DNS and ARIN lookups, Ping, Port Scan, find external IP, Geo Location for Ip addresses, CIDR calculator, Email server tester, and much more! :good:
mark.worth.666 said:
Another great tool I came across recently is Network Toolbox for Android:
play.google .com/store/apps/details?id=com.appsropos.whois
It includes a bunch of handy admin tools including Whois, RBL checks, DNS and ARIN lookups, Ping, Port Scan, find external IP, Geo Location for Ip addresses, CIDR calculator, Email server tester, and much more! :good:
Click to expand...
Click to collapse
asdfghjkl
ktetreault14 said:
asdfghjkl
Click to expand...
Click to collapse
Trying to push it up?
Sent from my HTC Desire HD using XDA Free mobile app
mickeyasamoah said:
Trying to push it up?
Sent from my HTC Desire HD using XDA Free mobile app
Click to expand...
Click to collapse
yes lmao. i haven't found a reliable app for all the wifi tinkering and what not
A bit of help maybe please on Zimperium's anti
I had dsploit installed and stupidly uninstalled it because now I cannot find the last version apk anywhere.
Anyway, I installed Z's ANTI. Everything seemed to go OK. My android is rooted and superuser rights were granted to the app.
My problem is that when it runs a network scan it recognizes my router but no open ports and that seems to be the end of it.
Any advice?
silvanet said:
I had dsploit installed and stupidly uninstalled it because now I cannot find the last version apk anywhere.
Anyway, I installed Z's ANTI. Everything seemed to go OK. My android is rooted and superuser rights were granted to the app.
My problem is that when it runs a network scan it recognizes my router but no open ports and that seems to be the end of it.
Any advice?
Click to expand...
Click to collapse
Me too. I found zanti (dsploit) difficult to use. I would wish to have guides for learning purpose.
Sent from my XT1033 using XDA Free mobile app
I've tried various man in the middle hacks on my laptop with the new zAnti. Its actually very cool
Don't download droid sheep from here (virus)!! I looked at the md5 hash and it did not match the ones of the last 3 versions (the md5 hashes are on http://droidsheep.de/?page_id=23) and also android warned me and blocked the installation
Download the one on https://forum.xdadevelopers.com/showthread.php?t=1539105 from the comment of user "Dlll" i verified the md5 and it matched the version 14 on http://droidsheep.de/?page_id=23 (verify it yourself if you don't trust me)
Stay safe
How to verify?
Graciasz
Muchos gracias ?

VPN and Tor curiosity/security

Hello everyone, I am a new networking and sys admin grad so would love to know if my thinking is incorrect or I am missing anything.
I am cursed with no high speed access where I live rurally so...I use work/coffee shops to do some downloading on my S10.
I use Tor and AirVPN, forced UDP protocol 443.
I have checked multiple times and cannot find DNS or WebRTC leaks with Air (happy with their service overall)
With a popular port for traffic, checking these leaks, and using Tor/VPN (with killswitch on) my question is:
How secure is my activity? Essentially...since I have no access at home I download shows and movies with the Flud client.
On top of a torrent client would it also be secure to grab it from MEGA/Tezfiles? I see maybe a higher WebRTC risk but am I correct in thinking for what activities I am doing I am pretty much safe? Since activity is piracy and not like dark web or anything for them to truly deep dive.
Thanks for the feedback!!

Categories

Resources