Hi All,
Has anyone gotten any details of Android bug 8219321 being discussed in the media? That's the Android master key talk coming up at Black Hat. AOSP bugs reporter is not showing any information (http://code.google.com/p/android/issues/list).
I'm wondering if the platform builders are using the default keys. Marko Gargenta discusses the four default keys briefly in http://www.youtube.com/watch?v=NS46492qyJ8. (Excellent video, btw).
Are there any controls we can place to mitigate the possible threats (assuming they are threats)?
Jeff
noloader said:
Hi All,
Has anyone gotten any details of Android bug 8219321 being discussed in the media? That's the Android master key talk coming up at Black Hat. AOSP bugs reporter is not showing any information (http://code.google.com/p/android/issues/list).
I'm wondering if the platform builders are using the default keys. Marko Gargenta discusses the four default keys briefly in http://www.youtube.com/watch?v=NS46492qyJ8. (Excellent video, btw).
Are there any controls we can place to mitigate the possible threats (assuming they are threats)?
Jeff
Click to expand...
Click to collapse
From everything I have read, this 'bug' won't really affect anyone unless somebody manages to get malicious code onto your Android device. Therefore, the best way to limit the risk is to only install reputable apps from the Play Store - don't use other dubious sites or .apk copies, don't install brand new, unproven apps etc.
SimonTS said:
From everything I have read, this 'bug' won't really affect anyone unless somebody manages to get malicious code onto your Android device. Therefore, the best way to limit the risk is to only install reputable apps from the Play Store - don't use other dubious sites or .apk copies, don't install brand new, unproven apps etc.
Click to expand...
Click to collapse
Thanks, I've been reading that stuff too. From http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/:
Device owners should be extra cautious in identifying the publisher of the app they want to download.
Enterprises with BYOD implementations should use this news to prompt all users to update their devices, and to highlight the importance of keeping their devices updated.
IT should see this vulnerability as another driver to move beyond just device management to focus on deep device integrity checking and securing corporate data.
This advice is useless. For example, "device owners should be extra cautious in identifying the publishers [sic]." The code signing model using self signed certificates does not lend itself to identifying anyone. The relationship that exists is between Google and the publisher; and does not extend to the user. The only thing self-signed certificates ensures is that an app can only be updated by the same author. Even Apple or Microsoft's PKI and code signing model do not make those guarantees (read their CPS'es some time).
Below is from Nikolay Elenkov in an off-list reply. Nikolay does excellent work with Android security (http://nelenkov.blogspot.com/), and can be often found hanging out on Android Security Discussions (https://groups.google.com/forum/#!forum/android-security-discuss).
They are using the 'master key' phrase to hype this up, but this has nothing to do with keys. This is related to the way Android verifies APK (JAR) signatures. A specially crafted APK can be repackaged without invalidating the original signature....
Click to expand...
Click to collapse
Jeff
Hi.
I recently came across some chinese / asian websites which kang / modify and release a diversity of roms.
I'm not specifying sources / which roms are, this is a general announcement to be careful with what we download & flash into our devices, and why ?
I flashed in order to test some of these roms (not the sense 5 kang tho), since I work in network security, I had noticed on our firewall logs when my mobile connected through the wifi, a bunch of UDP requests / DNS queries to russian websites. This can be used to botnets, DoS, even malware / spam propagation (a diversity of not cool stuff, basically).
A colegue of mine which also has a 'droid had once an app which sent repeatedly ICMP requests in "not random" but specific hours / intervals, he asked me to test his rom which he downloaded and flashed from "another" website, and I confirmed the suspicious behavior. There was established connections to foreigner addresses through a diversity of protocols, data being sent / received and at times, a udp flood directed to specific addresses. This is bad, my friends.
We don't know what these roms have inside, what's their mechanism besides the standard transparent operations which most of us are familiar with, and they could be very well used to do illegal things which I guaranty we don't want to be part of.
Flashing a rom, connecting through 3G or Wifi, and then our mobile is now part of a botnet which participates without our knowledge on such illegal operations is just one of the things that could happen. Phishing is also very possible - in other hand, a lot of things are possible without our knowledge and consent. We don't want this do we ?
The last Rom which I have experienced this, the link was removed and is no longer online. So i'm not pointing URL's / Rom names because this is something that each one of us has to be careful about.
Fortunately we have ways to detect / avoid / remove and make sure our device is used only for us and does only what we "tell" it to do.
We can use this thread to report such roms (since they're not published on xda, we can only warn each other and be aware) and applications that have malicious content.
I'll also be updating this thread with methods, applications for android to detect malware / suspicious activities (I'm not going into depth like using a sniffer or protocol / packet analyzer (although we can) I'll try to keep as simple as possible.
Suggestions, reports are very welcome and should be reported here. We can use this thread to protect our droids and help each other making our devices secure.
This post has the intention of protecting ourselfs, but privacy tips / applications are also welcome. Be careful tho, would be ironic to suggest an app to protect user privacy and in the end the app itself sends private data to GodKnowsWhere.
To be continued / Updated Soon.
List of Applications to monitor / analyze traffic:
Netstat Professional - Allows you to see what connections your android has established. Allows whois info, Real time IP / Port and status information (pretty much like netstat -an), and what service is running / port information.
Wi.cap. Network Sniffer - Much like a network protocol analyzer / network sniffer. This neat app allows you to see what connections are estabilished / protocol / status / analyze packets. If there's a connection estabilished - it will be listed. [Root needed]
Shark for Root - Traffic sniffer for 3G & Wifi (supports FroYo tethered mode too). Records traffic which later you can open with WireShark. To preview you can use Shark Reader.
List of Applications fo scan for malware.
Coming Soon...
Procedures to discover / analyze / report malware / suspicious behaviours and such.
Coming Soon...
Post reserved for procedures which will include:
- Common Sense
- How a malware works (the term malware is used to include viruses, trojans, custom scripts and apps.
- What to look for / suspicious behavior which you should pay attention to (also included in Common Sense).
- Basic tools to detect / analyze / remove malware.
More to come.
Sent from my HTC Z710e using xda premium
Generally, i suggest to use ROMs from XDA only, except for CM/MIUI official website. The risk is real! Thanks to @MidnightDevil for his help and his time
I suggest to read this thread to all the users!
XxXPachaXxX said:
Generally, i suggest to use ROMs from XDA only, except for CM/MIUI official website. The risk is real! Thanks to @MidnightDevil for his help and his time
I suggest to read this thread to all the users!
Click to expand...
Click to collapse
Thank you for your support
If anyone has suggestions / knowledge about this sort of matter please share
There's a LOT of info that I tend to post on this thread in a way to educate / share knowledge with everyone.
Trusting the developers and sources is the first step for prevention. Be careful with dodgy websites and roms which you don't know about.
Scanning the rom zip file with a virus scanner is useless in this matter.
Unknown Rom
The threat is over when a secure rom is installed (after using a none xda rom) ??
MidnightDevil said:
Thank you for your support
If anyone has suggestions / knowledge about this sort of matter please share
There's a LOT of info that I tend to post on this thread in a way to educate / share knowledge with everyone.
Trusting the developers and sources is the first step for prevention. Be careful with dodgy websites and roms which you don't know about.
Scanning the rom zip file with a virus scanner is useless in this matter.
Click to expand...
Click to collapse
phearell said:
The threat is over when a secure rom is installed (after using a none xda rom) ??
Click to expand...
Click to collapse
So far there isn't malware which persists after full wipe. Can't speak of the contents of the sdcard tho. But usually yes. But then you have the apk's which can contain malicious code and so forth...
Those apps are usually banned from the PlayStore, but there's a short window between published / report / removed from Store which users can download it.
Unless I didn't understood your post
MidnightDevil said:
So far there isn't malware which persists after full wipe. Can't speak of the contents of the sdcard tho. But usually yes. But then you have the apk's which can contain malicious code and so forth...
Those apps are usually banned from the PlayStore, but there's a short window between published / report / removed from Store which users can download it.
Unless I didn't understood your post
Click to expand...
Click to collapse
AFAIK google also scan apps installed on the device. When installing a 3rd party app (not via Google Play), you get a prompt to allow google to scan it anyway for malicious content.
Also, there are a couple of anti-virus apps available from well known companies such Avast for android, and also from AVG.
I never really tried those, but they might help protecting your device. However I doubt if they scan system apps/services, for in most cases they are supposed to be safe (from the OEM itself).
It is well known that the biggest security hole is the user. So the best thing to do is to keep away from unknown ROMs/sources.
astar26 said:
AFAIK google also scan apps installed on the device. When installing a 3rd party app (not via Google Play), you get a prompt to allow google to scan it anyway for malicious content.
Also, there are a couple of anti-virus apps available from well known companies such Avast for android, and also from AVG.
I never really tried those, but they might help protecting your device. However I doubt if they scan system apps/services, for in most cases they are supposed to be safe (from the OEM itself).
It is well known that the biggest security hole is the user. So the best thing to do is to keep away from unknown ROMs/sources.
Click to expand...
Click to collapse
No doubt the biggest flaw usually comes from the end user.
But answering your statemente about anti viruses.
Usually anti viruses (specially in portable devices) act base upon a database of known signatures and suspicious behavior. They provide no protection against a custom developed script or code with a work-around for this behavior. Basically - avoids behaving like a malware.
A code is considered malicious when acts upon suspicious behavior (for example, on windows - when an app registers itself on registry autorun / startup folders / tries to load a file on temp directory / temporary internet files, hooks itself into a process / uses a windows process to deliver it's payload faking a signature, etc etc). Knowing this, any custom app / script that avoids suspicious behavior / does not have a present signature on a AV database and a few more details - all doors are "open" and is a highway to hell.
Google scan engine uses the same mechanism, in fact, I'm not even sure if it has any sort of protection against suspicious behavior as it only executes upon apk install.
Believe me, the biggest flaw is the user as the best protection is also a well educated user. It's a matter of knowing what can do and what should avoid. Fear or suspicion is an important thing these days, as they prevent us from making mistakes as installing an app from a dodgy site. We should know better.
MidnightDevil said:
No doubt the biggest flaw usually comes from the end user.
But answering your statemente about anti viruses.
Usually anti viruses (specially in portable devices) act base upon a database of known signatures and suspicious behavior. They provide no protection against a custom developed script or code with a work-around for this behavior. Basically - avoids behaving like a malware.
A code is considered malicious when acts upon suspicious behavior (for example, on windows - when an app registers itself on registry autorun / startup folders / tries to load a file on temp directory / temporary internet files, hooks itself into a process / uses a windows process to deliver it's payload faking a signature, etc etc). Knowing this, any custom app / script that avoids suspicious behavior / does not have a present signature on a AV database and a few more details - all doors are "open" and is a highway to hell.
Google scan engine uses the same mechanism, in fact, I'm not even sure if it has any sort of protection against suspicious behavior as it only executes upon apk install.
Believe me, the biggest flaw is the user as the best protection is also a well educated user. It's a matter of knowing what can do and what should avoid. Fear or suspicion is an important thing these days, as they prevent us from making mistakes as installing an app from a dodgy site. We should know better.
Click to expand...
Click to collapse
I just remembered of an app called "Who is tracking" (was featured on the portal a while ago), that also scans system files (bloatware) and tells you which app tracks you. tried using it a while ago, but didn'y really try to understand it, and it seems to have changed since. will try it myself.
Agreed with Patcha, unless you 100% trust the source (CM/MIUI are well known and if they did something untrustworthy a massive ****storm would ensue) then I would stick to ROM's posted on XDA (though frankly I avoid MIUI out of moral principle #SouceCodeMuch?). Anything untrustworthy that is posted on XDA is picked up very quickly and dealt with effectively.
More to come from me on this, I need to organize what I want to say so it doesn't sound like a mad persons ramblings
Edit: A thing to look out for in google play store is the permissions, READ THEM, read what they mean, read what permissions the app requests and if you don't know why an app needs that permission or if it looks dodgy (like the permission to send sms messages without the user knowing) then for God's sake don't use the app util you've found out what the app needs that permission for (quick google search or email to the developer). Don't just blindly agree to all the permissions without reading them.
These permissions are declared by the developer in the Android_manifest.xml file and pulled from there when publishing the app on play store. As far as I am aware, there is no way to fool this system - you can't edit the visible permissions through the developer panel of play store, only by editing the manifest - I have a developer account on play store so this I am 100% sure on.
Yup, very true. Something I forgot to mention earlier and is VERY important.
Always check the permissions and what for the permissions are used. Some good developers write what for they need the permissions. Some things are obvious, others not so quite.
Also reading the comments of an app helps as well. More experienced users tend to write a more complete review and sometimes they draw the attention to things that sometimes other users miss. About permissions or anything else.
Any user can write a review, so if you find something important, you can also write in the review. Just make sure you don't underrate an app because of a doubt
Usually developers also have their contact email in case of doubts, it can be used to to bring some things to light.
Moderator Announcement:
THREAD CLOSED on request of OP. Please refer to this cross-device thread in future:
https://forum.xda-developers.com/nokia-6-1-plus/how-to/root-nokia-debloater-t4005895
*******************************************************************
Here is an universal script that should work on every Nokia device right from the first gen devices upto Nokia 9 Pureview.
Exert from my Github readme.md -
Nokia-Debloater
A simple noob-friendly script that debloats your phone from the evenwell apps and soon, Google Apps.
What is evenwell and why should I care?
Evenwell/FiH is chinese company. Specifically, They are a subsidary of the massive Foxxconn group that manufactures consumer electronics for sale around the world. This Evewell group were a business partner of Nokia/HMD and they were responsible for manufacturing and building the software on these phones. We all know the second generation devices from Nokia i.e Nokia 6.1, Nokia 6.1 Plus, Nokia 7 Plus etc are android one devices which are supposed to come with clean software and no bloat. On the surface, These devices have no bloat, But when you go digging deeper into settings and the system, You will encounter them evenwell apps.
What do these apps do?
These apps are supposedly to maintain system stability and protect battery among various other services/features. There are also telemetry apps that send data to the chinese. This is the reason I've decided to create this script.
Nokia has supposedly stopped using the evenwell services/apps, Why would you uninstall them?
Simple, Because
1. I do not want any dead app that previously had an history of snooping in my system.
2. They are not supposed to be there in the first place.
Convinced yet? Get the script from here and you can start.
Enable usb debugging and connect to PC, Put the .bat file in the same folder as your ADB and run the script. Profit.
More info - Nokia Debloater Github
For Discussions please point to this thread - Nokia Debloater, Universal thread
For Changelogs/Release, Head over to - Nokia Debloater changelogs/Releases
Moderator Announcement:
THREAD CLOSED on request of OP. Please refer to this cross-device thread in future:
https://forum.xda-developers.com/nokia-6-1-plus/how-to/root-nokia-debloater-t4005895
*******************************************************************
Moderator Announcement:
THREAD CLOSED on request of OP. Please refer to this cross-device thread in future:
https://forum.xda-developers.com/nokia-6-1-plus/how-to/root-nokia-debloater-t4005895
*******************************************************************
Here is an universal script that should work on every Nokia device right from the first gen devices upto Nokia 9 Pureview.
Exert from my Github readme.md -
Nokia-Debloater
A simple noob-friendly script that debloats your phone from the evenwell apps and soon, Google Apps.
What is evenwell and why should I care?
Evenwell/FiH is chinese company. Specifically, They are a subsidary of the massive Foxxconn group that manufactures consumer electronics for sale around the world. This Evewell group were a business partner of Nokia/HMD and they were responsible for manufacturing and building the software on these phones. We all know the second generation devices from Nokia i.e Nokia 6.1, Nokia 6.1 Plus, Nokia 7 Plus etc are android one devices which are supposed to come with clean software and no bloat. On the surface, These devices have no bloat, But when you go digging deeper into settings and the system, You will encounter them evenwell apps.
What do these apps do?
These apps are supposedly to maintain system stability and protect battery among various other services/features. There are also telemetry apps that send data to the chinese. This is the reason I've decided to create this script.
Nokia has supposedly stopped using the evenwell services/apps, Why would you uninstall them?
Simple, Because
1. I do not want any dead app that previously had an history of snooping in my system.
2. They are not supposed to be there in the first place.
Convinced yet? Get the script from here and you can start.
Enable usb debugging and connect to PC, Put the .bat file in the same folder as your ADB and run the script. Profit.
More info - Nokia Debloater Github
For Discussions please point to this thread - Nokia Debloater, Universal thread
For Changelogs/Release, Head over to - Nokia Debloater changelogs/Releases
Moderator Announcement:
THREAD CLOSED on request of OP. Please refer to this cross-device thread in future:
https://forum.xda-developers.com/nokia-6-1-plus/how-to/root-nokia-debloater-t4005895
*******************************************************************
What are the security ramifications of changing your GSFID to foil fingerprinting?
After much googling and multiple failures, I have finally managed to change my supposedly permanent GSF ID (Google services framework ID) without needing to be rooted (and without having to factory reset the phone) specifically so that my phone is less vulnerable to malicious fingerprinting.
Given I realize almost nobody knows how to change the GSF-ID (it took me hours to figure it out but only minutes to perform), and even easier to display the results... hence I would like to ask the experts in this Security Discussion forum what the ramifications are.
Specifically what I don't know is why this unique ID (which uniquely identifies your phone!) isn't supposed to be changed, nor do I know what any given apps are doing with it - but I do know that it's super freaking important to Android (I can give gory details what happens if/when you change it for example).
It seems only "some" apps (those linked with GSF API's perhaps?) use this supposedly permanent personal tracking ID to watch your activities; but maybe they all do for all I know (do YOU know?).
I'd like to ask for MORE INFORMATION about how the GSF ID (and perhaps the Android ID too) are used by Android & by apps, but there's almost nothing out there on the Internet about them (ask me how I know this).
Give it's clearly a fingerprinting issue... can someone here give me more information about the ramifications of keeping/changing/deleting the GSF ID?
Thanks!
Given a unique Android11 to Android12 migration screwup:
Did Google screw up on your upgrade of Android 11 to Android 12?
As a possibly directly-related datapoint, I found this revealing sentence in this thread:
Sentence: "Changing your Android ID is akin to doing a factory reset (at least as far as Google Play is concerned. It has no effect on your
downloads)."
Click to expand...
Click to collapse
Thread:
[APP] Raccoon v4.12 - An apk downloader for Google Play
The question I need to ask (find out) is whether or not any apps have an Android ID permanently (or temporarily) associated with them.
Do they?
GalaxyA325G said:
Given a unique Android11 to Android12 migration screwup:
Did Google screw up on your upgrade of Android 11 to Android 12?
Question I need to ask (find out) is whether or not any apps have an Android ID permanently (or temporarily) associated with them.
Do they?
Click to expand...
Click to collapse
I think starting from Android 10, each app installed has a unique permanent Android id generated on installation which I think change after uninstalling the app and reinstall. Correct me if I'm wrong.
GalaxyA325G said:
Given a unique Android11 to Android12 migration screwup:
Did Google screw up on your upgrade of Android 11 to Android 12?
As a possibly directly-related datapoint, I found this revealing sentence in this thread:
Thread:
[APP] Raccoon v4.12 - An apk downloader for Google Play
The question I need to ask (find out) is whether or not any apps have an Android ID permanently (or temporarily) associated with them.
Do they?
Click to expand...
Click to collapse
Not sure, but I know you can use AppCloner to report a different Android ID to the cloned app (ih also changes the hardware s/n.
Also using the AppCloner app you can change the GSF ID (requires extra premium subscription). It also offers a bunch of other identity options depending on what you pay for etc 1 click new identity.
App Cloner - Official Home Page
Welcome to the official home page of App Cloner. App Cloner lets you create & install multiple copies of Android apps. App Cloner is the only multi-account app that creates true, independent, installable clones. Follow @AppCloner on Twitter (https://twitter.com/AppCloner) or...
appcloner.app