Database Info

[WARNING-Update:Solved] Xfinity Mobile (Comcast) exposes password in system log

This post is regarding the Xfinity Mobile app: https://market.android.com/details?id=net.comcast.ottclient
My system log shows <userName>[email protected]</userName> and <password>MYPASSWORD</password> on a line that starts with "D/HTTPManager". I read the log using aLogcat (app available in the market). Open aLogcat, press menu and filter for "password". After I clear my log (using aLogcat) that line reappears even when I haven't used the Xfinity app. I don't use my comcast credentials in any other app.
To try and resolve this I cleared data and cache for the Xfinity app, then cleared the system log in aLogcat, and restarted the phone for good measure. I opened the Xfinity app, logged in without checking "remember me" and unfortunately my username and password immediately reappeared in the system log.
I posted this issue here: http://forums.comcast.net/t5/Mobile-Apps-and-Web/Password-revealed-in-android-system-log/td-p/872295. A Comcast employee responded to say they will investigate this issue and fix it within a few weeks. In the mean time, you may want to uninstall the Xfinity Mobile app and change your Comcast password, or at least do not share your system log with anyone (in bug reports for example) if you have Xfinity Mobile installed.
This may not be the only app that exposes sensitive information in the system log, but this is the only password I have found exposed.
I have a Motorola Droid running stock Android 2.2.
UPDATE - As squiddy20 pointed out, Comcast has updated their app to 2.0.2. They include instructions to clear the app data as part of the upgrade, but that may be unrelated to this issue. In any case, I cleared the app data and installed the update, and my credentials no longer show up in the log. As far as I can tell, they have completely resolved this issue. If the problem persists for anyone else, be sure to post that here and on the Comcast forum.

Wow Comcast.
Thanks for the heads up

I checked this out for myself and the only way I could get it to show up was by logging out and then back in. I then did a reboot, let it sit for well over 5 minutes after it was fully booted, and then tried it and still no entry under "password". I dont get any of the sporadic, random popups you seem to have gotten. Oddly though, I have it set to not login automatically, yet after the reboot, it took me right to my email messages without me actually typing in my login info. That in itself is room for concern, let alone the possibility that login info is contained in the logcat in plain text.
Samsung Moment 2.1 running TiX 1.6 rom.

Interesting I to have the same issue squiddy20. Very concerning not a good thing Comcast

I was not able to see my password
I use an EVO with 2.3 and checked the same on my logs after logging in .. and only saw my username the password was nowhere to be found. I guess it would only happen when you first try to login.

squiddy20 said:
I checked this out for myself and the only way I could get it to show up was by logging out and then back in. I then did a reboot, let it sit for well over 5 minutes after it was fully booted, and then tried it and still no entry under "password". I dont get any of the sporadic, random popups you seem to have gotten. Oddly though, I have it set to not login automatically, yet after the reboot, it took me right to my email messages without me actually typing in my login info. That in itself is room for concern, let alone the possibility that login info is contained in the logcat in plain text.
Samsung Moment 2.1 running TiX 1.6 rom.
Click to expand...
Click to collapse
Now that I have unchecked "remember me" my credentials only show up in my log when I log out and back in. Not sporadic any more.
Check your Xfinity Mobile -> Settings -> Log Out setting. If it is set to "Never", then you wouldn't have to log in again after a reboot. If it is set to "On Exit" then you should have to log in again after exiting the app or after a reboot... but that may be buggy.

Thanks for the tip, but I honestly don't access my email through the app very much. To me, less things logged into and running in the background, means more memory for other things and slightly more battery life.
Also slightly less security problems!

Well, they've updated the app and I assume they've fixed the logcat problem (haven't checked for myself yet). They do have a note: "This Update will require you to log in to the application" plus the usual updates, improvements, and fixes.
Edit: just ran 2 checks with aLogcat and can confirm that the username and password info does not show up when searching for keyword "password". On a slight side note, I've noticed that hitting the home button on my Samsung Moment exits the app, but doesn't sign out. While hitting the back button from the main screen exits the app AND signs out. Settings also seem to be staying the same, even after reboots. Mine would reset occasionally, turning notifications on and other things.

I have had some concerns as well. I have lost most of my channels in the TV listings area. It goes from 2-29 and then 75-99 but that is it. I have uninstalled and reinstalled the app several times, cleared data in applications, etc. As I reinstall the app, it is going right into my system without asking for a password which I find a bit alarming.
I assume that the program has reverted to a selection that is not the full digital programming which shows up when you first do an initial install. I cannot find a way to get back to that area to reset my configuration and add all my channels back. I have emailed Comcast and those idiots responded that they do not have an app that works with Android yet, only iPads and iPhones. Quite comical.
Any help would be greatly appreciated.

I have tried all of the methods mentioned above and when I log in using username and password, and filter alogcat only my username appears in the log. Also tried brief and long settings in alogcat preferences.
Edit: This is using the 2.0.2 version.

Hi Squiddy ,
Pressing the backbutton will exit the app and pressing the home screen actually puts the app in the background so that at later point of time we can launch the app from the page where we left .
I dont think this is an Issue.

Hi Dawgman25,
There is a settings for the program area where you can change the zipcode of yours and select the proper digital option.
After logging in tap on the settings on the lower right corner.
There will be an option program area under TV Listings.
There you can enter your zipcode and give the correct Headend (Digital) option
I think the forums.comcast.net will respond quicker and properly .
you can also directly send mail to [email protected] to get lightning response !!
I tried this and he responded immediately

[Q] Antivirus s/w detected malware in my settings

Hi Everyone,
OK, I am completely new to using tablets and android (and XDA! ) but I recently bought an Android tablet and although I put AV s/w on it I seem to have caught a bug. The problem is that, apparently, my settings app is now malware and it seems the only option to resolve it is to uninstall my settings application. Understandably I don;t want to forge ahead and do this because then I cannot manage my device. Anyone got any suggestions or can point me somewhere that could help? I have trawled the internet for an answer but haven't found anywhere reporting the same thing, so far. I am flummoxed and getting very frustrated. Also, any recommendations for malware prevention apps? Ta.
Thanks for taking time to read this. Sorry if it's in the wrong place!

You do know you should provide more details like which phone, which firmware, what antivirus app, etc.
But the simplest answer you would get is to stop using antivirus apps. Because most of them are hoaxes or give false results. There is nothing wrong with your settings app. I suggest you uninstall the AV app first.

immortalneo said:
You do know you should provide more details like which phone, which firmware, what antivirus app, etc.
But the simplest answer you would get is to stop using antivirus apps. Because most of them are hoaxes or give false results. There is nothing wrong with your settings app. I suggest you uninstall the AV app first.
Click to expand...
Click to collapse
It's not a phone, it's just a no-mark tablet (Tabtronics, if that makes any difference).
Seeing as the last several days (maybe a week now) it has had serious performance issues -- crashing, rebooting itself without my initiating it, not turning on for long periods, notification messeges telling me apps don't work when I have never tried to use them -- I'd say this is not a false result. And the AV (Avast) is the same brand I've been using on my desktop for years and has always been fiine, and I've had no problems with it until the last week.
Seems odd that the assumption here is that there isn't a problem, when there are a shed load of articles online stating how vulnerable Android is to malware. Unfortunately I can't find any that tell you where to go/ what to do in order to get rid of the bug. :crying:
Anyway, thanks for the reply.

BlankScreen said:
It's not a phone, it's just a no-mark tablet (Tabtronics, if that makes any difference).
Seeing as the last several days (maybe a week now) it has had serious performance issues -- crashing, rebooting itself without my initiating it, not turning on for long periods, notification messeges telling me apps don't work when I have never tried to use them -- I'd say this is not a false result. And the AV (Avast) is the same brand I've been using on my desktop for years and has always been fiine, and I've had no problems with it until the last week.
Seems odd that the assumption here is that there isn't a problem, when there are a shed load of articles online stating how vulnerable Android is to malware. Unfortunately I can't find any that tell you where to go/ what to do in order to get rid of the bug. :crying:
Anyway, thanks for the reply.
Click to expand...
Click to collapse
Here's a good discussion that might interest you:
http://forum.xda-developers.com/showthread.php?t=2186782
As for the issues you have, I would attribute it to either a rogue app or low memory. Try uninstalling any apps you recently installed. Also, try clearing app caches, freeing memory etc. See if that helps.

Snapdragon Battery Guru Admin access settings

Hello,
I am new to this form so please excuse me if i leave out some details but i own a oneplus one black 64gb running the latest ota cm11 update and one day I decided to explore a new app called "snapdragon battery guru." (it was new to me atleast) The app worked great for a week or 2 but then i noticed that my service was being messed up by the app(this isnt the issue) so i looked up some reviews and i saw many other people with the same problem so I decided to uninstall the app... (This is where the problem starts)
After uninstalling the app my phone constantly has messages on common things that i use most importantly the "disable lock screen" when on the home profiles so that i dont have to type in my password at home all the time. However, after uninstaling the app, that option in the profile settings is grayed out and says that it is "disabled by administrator, encryption policy, or credential storage"... again i looked it up on google and found that clearing my credential storage seems to be a temporary fix that last about 2 hours and then the option ends up graying out again. (which can get really really annoying because my vpns are constantly cleared out every time)
Can anyone please help me with this problem!
Thanks
Jiggy

Have you tried a factory reset? That's your best option.
Transmitted via Bacon

Settings, security, device administrator, what do you have enabled there

[Material][4.0.3+][Captive Portal Helper] Wifi Auto Login

Have you ever been to a place where you have to go enter your credentials to log into via a wifi captive portal?
Those things are present everywhere now from Guest Wifi networks at hotels to corporate Wifi networks. I was annoyed at having to enter my credentials again and again every day so I made this app to automate that task. You just have to record your login steps only ONCE and WiFi Auto Login replays them when ever required without any manual interaction from you. This app works fine for Android versions from Ice Cream Sandwich to Marshmallow. Let me know if you guys find any issues in using my app.
Without further Ado, Here is the app .
XDA:DevDB Information
Wifi Auto Login, App for all devices (see above for details)
Contributors
anantharam
Version Information
Status: Beta
Current Beta Version: 1.0
Beta Release Date: 2016-03-12
Created 2016-03-12
Last Updated 2016-03-12

Any tutorial?

dr.patron99 said:
Any tutorial?
Click to expand...
Click to collapse
When you come up against any captive portal, my app will automatically pop up and ask for your credentials to log into that portal, let me know if you find that non-intuitive I will look into adding a info screen on first install of the app.

anantharam said:
When you come up against any captive portal, my app will automatically pop up and ask for your credentials to log into that portal, let me know if you find that non-intuitive I will look into adding a info screen on first install of the app.
Click to expand...
Click to collapse
Just to check that out, I have tried to logged out 3 times, but nothing happens. In fact I have set Automate authentication ON but no help.
To my knowledge, I had to submit credential in order to logged back IN.

dr.patron99 said:
Just to check that out, I have tried to logged out 3 times, but nothing happens. In fact I have set Automate authentication ON but no help.
To my knowledge, I had to submit credential in order to logged back IN.
Click to expand...
Click to collapse
When the Wifi Sign In is requested, it might open up a browser automatically, make sure you are entering your credentials inside my app and not in the browser. And make sure you tick on "Store Password" and also "Automate this for this site everytime" when you enter the credentials.
And finally, if you do not mind, can you tell me the credentials requested by your captive portal?
Weather username, email and password or does it require anything more custom?

dr.patron99 said:
Just to check that out, I have tried to logged out 3 times, but nothing happens. In fact I have set Automate authentication ON but no help.
To my knowledge, I had to submit credential in order to logged back IN.
Click to expand...
Click to collapse
anantharam said:
When the Wifi Sign In is requested, it might open up a browser automatically, make sure you are entering your credentials inside my app and not in the browser. And make sure you tick on "Store Password" and also "Automate this for this site everytime" when you enter the credentials.
And finally, if you do not mind, can you tell me the credentials requested by your captive portal?
Weather username, email and password or does it require anything more custom?
Click to expand...
Click to collapse
Hey any updates?
Let me know if it worked and if it is automatically logging in for you now correctly.
I am looking for feedback if it worked, or I might have to tweak my algo a bit to search for more custom values in credentials..

anantharam said:
Hey any updates?
Let me know if it worked and if it is automatically logging in for you now correctly.
I am looking for feedback if it worked, or I might have to tweak my algo a bit to search for more custom values in credentials..
Click to expand...
Click to collapse
Nope, not exactly how you're describing.
After several attempts only once it showed a pop up to login but that to for browser only there wasn't anything inside your app.
I am guessing may be my method could be wrong in order to do it correctly. Also I have tried uninstalling and reinstalling it., But every time it shows some test.portal site? Is it by default?
IMO some more tweaking may require and Authetication duration is quite long, It should be once and Boom! But it takes 2-3 attempts just to get login page, and that happened only twice which links to browser for login and not into your app.

dr.patron99 said:
Nope, not exactly how you're describing.
After several attempts only once it showed a pop up to login but that to for browser only there wasn't anything inside your app.
I am guessing may be my method could be wrong in order to do it correctly. Also I have tried uninstalling and reinstalling it., But every time it shows some test.portal site? Is it by default?
IMO some more tweaking may require and Authetication duration is quite long, It should be once and Boom! But it takes 2-3 attempts just to get login page, and that happened only twice which links to browser for login and not into your app.
Click to expand...
Click to collapse
If you do not mind, can you tell me the credentials requested by your captive portal?
Weather username, email and password or anything else?
And here is a short tutorial till I can incorporate a tutorial into my app :
1) You can just ignore the test.portal or you can press the checkbox next to it and press the delete button at the bottom to delete it. That will not affect anything else, I will remove it in the next iteration of the app.
2) Notice the very big button called "checking.." at the bottom of the app after you open it? Please wait for a few seconds and if it detects that you are connected to a Wifi network but not connected to internet, it will turn to "Authenticate". Once that button is enabled, you just click that button and it should take you to another screen in my app with blue background saying "I see you are having troubles logging into this WiFi Automatically. I can help you automate it." and ask for your username and password or email and password or whatever it is that your portal requires. (Note that this entire step is optional since when you turn off your wifi and turn it on and internet is not connected my app should automatically pop up and ask for your username and password but for some reason this doesn't seem to be happening in your case).
3) And make sure you tick on "Store Password" and also "Automate this for this site everytime" when you enter the credentials.
4) Make sure the big button next to "Background authentication is" has ON and that's it, my app will fire up everytime you are connected to Wifi but not connected to internet and it will automatically enter that credentials you entered to my app.

anantharam said:
If you do not mind, can you tell me the credentials requested by your captive portal?
Weather username, email and password or anything else?
And here is a short tutorial till I can incorporate a tutorial into my app :
1) You can just ignore the test.portal or you can press the checkbox next to it and press the delete button at the bottom to delete it. That will not affect anything else, I will remove it in the next iteration of the app.
2) Notice the very big button called "checking.." at the bottom of the app after you open it? Please wait for a few seconds and if it detects that you are connected to a Wifi network but not connected to internet, it will turn to "Authenticate". Once that button is enabled, you just click that button and it should take you to another screen in my app with blue background saying "I see you are having troubles logging into this WiFi Automatically. I can help you automate it." and ask for your username and password or email and password or whatever it is that your portal requires. (Note that this entire step is optional since when you turn off your wifi and turn it on and internet is not connected my app should automatically pop up and ask for your username and password but for some reason this doesn't seem to be happening in your case).
3) And make sure you tick on "Store Password" and also "Automate this for this site everytime" when you enter the credentials.
4) Make sure the big button next to "Background authentication is" has ON and that's it, my app will fire up everytime you are connected to Wifi but not connected to internet and it will automatically enter that credentials you entered to my app.
Click to expand...
Click to collapse
Sorry for delay in response actually.,
1,3,4 Steps I have done correctly
2 Step is where all problem lies, as you assumed I am not receiving any pop ups as you've mentioned here. After hitting Authenticate, it started to search something but after a while it comes back to Authenticate option again. After few attempts it lead me to link to browser where I suppose not to enter the credentials. Since you told me not to enter those into browser I've tried looking for an option inside your app. But no luck.

dr.patron99 said:
Sorry for delay in response actually.,
1,3,4 Steps I have done correctly
2 Step is where all problem lies, as you assumed I am not receiving any pop ups as you've mentioned here. After hitting Authenticate, it started to search something but after a while it comes back to Authenticate option again. After few attempts it lead me to link to browser where I suppose not to enter the credentials. Since you told me not to enter those into browser I've tried looking for an option inside your app. But no luck.
Click to expand...
Click to collapse
Weird, when you press the Authenticate button it shouldn't search anything at all, it should immediately move you to the credentials screen.
Can you please try one more thing to see if that works?
Manually turn off and after a few seconds turn on your wifi when you are logged out of the captive portal. That should trigger the WifiReader to re-read the info again.

anantharam said:
Weird, when you press the Authenticate button it shouldn't search anything at all, it should immediately move you to the credentials screen.
Can you please try one more thing to see if that works?
Manually turn off and after a few seconds turn on your wifi when you are logged out of the captive portal. That should trigger the WifiReader to re-read the info again.
Click to expand...
Click to collapse
I'm sorry to say, But that way also not working. In fact I've tried several different ways to get into it. So far only once it shows to enter credentials and that to with Browser link to open. There's nowhere i could be able to look for an option to enter credentials.
Something is missing for sure. :fingers-crossed:

dr.patron99 said:
I'm sorry to say, But that way also not working. In fact I've tried several different ways to get into it. So far only once it shows to enter credentials and that to with Browser link to open. There's nowhere i could be able to look for an option to enter credentials.
Something is missing for sure. :fingers-crossed:
Click to expand...
Click to collapse
Sorry to hear that, but anyways thank you very much for your feedback.
I really appreciate that.
I will try to add an option to send debug logs to me before production release to handle these kind of situations.

This app works fine. Thanks for making my life simpler. There are more than 15 access points for the guest wifi, when I go to a different floor or to a washroom, wifi gets disconnected. Thanks for making this app, it saved a lot of time and frustration. It is very easy on the battery and does its job in milliseconds.
Just put your name and contact in the app, I had to search entire XDA to find this post to say "Thanks!"

There are a couple of different Public WiFi that use Captive Portal and request a form fill to let users in.
However none of them seems to work.
Willing to test and provide useful info to help in developing...

@anantharam, are you still working on this? I just tried it out on my Pixel 2 running Android 9 and it shows that it's online when the networks are still asking for sign-in and the sign-in notification is still showing.
My city recently installed free wifi downtown, which is awesome, but I have to keep jumping through these pages to use it. Your app would be a godsend!

@MMcCubbing Thanks for your interest in this.
Unfortunately the app is currently taken down from the play store for some licencing reasons, I am trying to work with Google to try to bring back the app.
As for your particular question, if my app shows it is online, then it means my app is able to talk to the internet. At that point if you go to your browser and try to go to google.com do you get any error or are you getting connected correctly?
My app is mainly intended for usecases where you are not connected to the internet without giving a user name and password in a captive portal.

Support

Here's a new one experts I went to the Support tab under settings and first thing I see is an Application problem which says "Phone services has reported problems. Would you like to resolve them? two choices are given Dismiss or Show. When I hit Show it takes me to the Phone APP with no further instructions beside Force Stop. Between this and my Not being able to MMS I'm having a bad day with this Phone.

I replied to your MMS issue in that thread.
As for the other problems...it could be related to an unhappy third party app you installed yourself. The only way to determine this is to run the phone in safe mode to see if the problem remains...if it goes away then you know it is a third party app and you will have to uninstall them one-by-one until you figure out which one is causing the problem.
If there are no third party apps causing the problem then it would be best to do a software repair using the Xperia Companion from your PC. This will completely reset the phone requiring you to set it up from scratch. Sorry...but this will also install a fresh copy of the software which is better than doing a basic factory reset from the phone itself.

Hey jaseman can you give me step by step instructions on first getting into safe mode and next doing the pc companion on my computer. I'm almost looking forward to resetting just to see if I can clear this issue and the messaging issue. Thanks for your quick response.

Instead of spelling all out ...again....here is the forum you need to get answers to all your questions.
Please use it!
https://talk.sonymobile.com/t5/Xperia-XZ-Premium/bd-p/xperia-xz-premium