[Android General] Fnorder:
Version 710 out. Dolphin now phones home via SSL to https://tracken.dolphin-browser.com, which means it was a PITA to determine the traffic to be ultimately tame, though obnoxious.

The stupid rating popup is still there.

[root@phone]~# ws mgeek -o d710.log

Matching uid 10136 (shared mgeek.dolphin.browser: mobi.mgeek.TunnyBrowser)

Logging to d710.log

-q', '-R', '-W', 'single', '-M', '-l', '-P', '', '.', 'tcp

(sh:mgeek.dolphin.browser:10136) [G] www.dolphin-browser.com:80/features

(sh:mgeek.dolphin.browser:10136) [G] www.dolphin-browser.com:80/wp-content/themes/MoboTap/sub.css

(snip: normal page load traffic to www.dolphin-browser.com)

(sh:mgeek.dolphin.browser:10136) [G] www.dolphin-browser.com:80/favicon.ico

(sh:mgeek.dolphin.browser:10136) CAP: T 10.23.1.220:56392 -> 50.16.168.119:443 [AP] !!!!!!!!!!!,!NM!!a<f52e!!!X!!NX!RUS!! !!!!!>!j!S!!Q!<!!!!Sd!!?!@!gV!!m2t;\!!!!!!!!!!e!!!*!!9!)!h!!!!!!!5!!!!!!!?!!K!!#+!!!VA!!X!!!!!!!!!=!&!!!!!!!!!!0!!!:!!)!!!!!R!!!}!!!C!!!!!fK!!!V!!!g!!!!z!!!!!!!

(sh:mgeek.dolphin.browser:10136) CAP: T 10.23.1.220:56392 -> 50.16.168.119:443 [AP] !!!!P!?!;!\X!'8!!!<!A!!!'!&)!!!_!)!!!!!!!!`!!!!!B!!!!!!!!)!!0!!!!!!!!!!!S^!M!!!!r!!!!!!J!!!!!!8!!wF<&!!!2!!!!!!jsh6t!!!!!r!C}"DRBG!!!G=!!!D]!~!!GDh;!!!!X!!!!]0a!!!!B!!7-!6!!!i!!!! q!k'!(!\!!!Z!W!!!!y!!!/znj!!T/!E!O!!!!!!!!!!*}!!!!!!!!%!#!!l!!!!!!!!!!z!!>!!!._!&8!!!o!!!*c!!_4!Eg!!!!LOfc3!!![!!!!!g!2}!xX"!,f!!0!!T!\!!h!!!!h!!!!!!!!I_7!-!!N!3!&8!R!!e!P!j!!c!B!!!Y!&!t!!o!D!!!!!!!!.y!a!#!i!!!mv!eQ'!!G!g!!E!!!6g!@!>!`!!!!!!!!7!!!!!!!!!pQA!!!!!!u!K!!!!kW"!!!B!!!!M!<|!!!!bl!!a!!!T!!!!!m!!!!!!!!{!!!!NY!!!!!!!!!!!!p!!!!p!`!"!!!!!!!L!!-!!!!Q!!!`!!!T|#!!e!!!!4!5!!+;!!!,!,!!!3!!ES0[!!!3v!!!\@!!!A6nZj!!!

(sh:mgeek.dolphin.browser:10136) CAP: T 10.23.1.220:58934 -> 50.16.168.119:443 [AP] !!!!!!!!!#j!k!!!!!!!E!!u!$zs!5!!!!y!H!F!!E(!!!!!y!3!!:!P!,!! !*!Hs!$!,!^3!!!!W!!?R%!!!+!S:}!!!!H3!!!!!!!F1!!~*!!zg!w!pq!!Hm!Wak!~a!!!(M!!r!!!2!vZ!t/!!yx!B!!!9!!!!!!!!?{!!dR!;!!lQ!D]!R!m!!!!!!!!!f!]!!~_+!!O!!J!?4!~PpA!!x^#!A!!!sqW[X!!r$!!!!$t!{!\

(sh:mgeek.dolphin.browser:10136) CAP: T 10.23.1.220:58934 -> 50.16.168.119:443 [AP] !!!!!!!!!k!!!!!!!S!{!!!:V!!l!!!!z/f!3!Mk!!!!!!$!!:v!!! !!&LR!!!!!!!!!*9SqA;6!!/!f2l!!6!!!!!P!xK!#!!!!_!!!}!!W!p!!!!J!p!O#!!!!!z!W!!!!!!!!!H!!u!6!!!!!t!!!@!a!=!!!:uP!!!!!!R!!`8a!!!!!4!v!G!!C!!!!2!!s!!7!j!!-'!!;!!J!>!!!*R!5I!ic!!@u!!7!!*!!!!BQ!!!!!7!!!!!!!!>!!!!!J!!!X!!!!!~!!Q!Ef|!!!!6k!OL!h!!^!_!!!!VU!!!!!!!B!!!5!!!!!?!^!!!!]!!!U~!!\!!!!3R!!t!!#?L!2!8!!!!!!7!!,!!>MB!ZL!!6!*C!!!P!!!!!!!!!Uf!g!z!!!!!(c!F!

* After modifying via apktool to replace all instances of tracken.dolphin-browser.com with an internal IP has revealed:

Decoded traffic: Frequently sends carrier / phone specs / android_id to /track.dv.gif via https GET. Query string remains the same except for timestamp. Uses keep-alive, so enjoy your battery life!:

censored-string1: your unique ANDROID_ID

censored-string2: shared pref 'client_guid'; unique string generated via java/util/UUID;->randomUUID in com/dolphin/update/l.smali

(sh:mgeek.dolphin.browser:10136) [G] 10.23.1.1:80/track/dv.gif?car=310120&mo=SPH-D700&did=[censored-string1]&l=en_US&pnt=6&cou=us&br=sprint&h=480&w=800&bo=SPH-D700&t=1321264055174&ve=2.2.1&pro=SPH-D700&pt=2&vn=108&pn=mobi.mgeek.TunnyBrowser&avn=7.1.0&inu=1&cg=[censored-string2]

(sh:mgeek.dolphin.browser:10136) [G] 10.23.1.1:80/track/dv.gif?car=310120&mo=SPH-D700&did=[censored-string1]&l=en_US&pnt=6&cou=us&br=sprint&h=480&w=800&bo=SPH-D700&t=1321264991593&ve=2.2.1&pro=SPH-D700&pt=2&vn=108&pn=mobi.mgeek.TunnyBrowser&avn=7.1.0&inu=1&cg=[censored-string2]

* Then there's the POSTs to /track/pvs.gif, which is apparently app analytics in gzipped form:

(sh:mgeek.dolphin.browser:10136) [P] 10.23.1.1:80/track/pvs.gif

(sh:mgeek.dolphin.browser:10136) CAP: (10.23.1.1:80/track/pvs.gif) T 10.23.1.220:48416 -> 10.23.1.1:80 [AP] !!!!!!!!!!!!MO! !!!!!!Cn6<!!!!!!!!dz6@!]J!!/[!!!f!s!!!jz!!!!!!!!R!1A!!h!@B!!%!(2k!A!!Pd!!!!x!!!C!!u!T!!!R!!!!!!$k]5v!T!!!!!P!!!!!v!%A!!!yA!!!!Z!!!!!!r,o\!]X!!!!!I!!!!W!!!F!Li!!!!!!!!o!!W&!!!!!!!!!!!!!!!9\!t!f!!]!!!<1!!!!!!!!!!!.!!!!!!!1!!XW!6/!n!!R>S!!!!!!!!!jW|!2!!e4!T!#!!!!!!T!j.I~!!!!!!i!!!!A!s!)!0!!!!!!0!!c!!!!!!i!!g!l!m!!2m!}!!!E!!n!!Gq!P!!]'?Z!@6!!aB{!F`!!!!!!s!!a!!!

[0:1][root@fnord:pts/1]/w/track> ls -ld pvs.gif

-rwxr-xr-x 1 www www 277 Nov 14 06:02 pvs.gif*

[0:1][root@fnord:pts/1]/w/track> zcat log.30818|sed "s,$IDSTR,[censored-string1],"

w=800&val=1&v=7.1.0&u=[censored-string1]&cat=home&t=1321267504102&p=mobi.mgeek.TunnyBrowser&l=en_US&label=1&m=SPH-D700&act=clickedbtn&h=480

w=800&val=1&v=7.1.0&u=[censored-string1]&cat=home&t=1321267539373&p=mobi.mgeek.TunnyBrowser&l=en_US&label=speeddial&m=SPH-D700&act=swipe&h=480

w=800&val=1&v=7.1.0&u=[censored-string1]&cat=home&t=1321267539397&p=mobi.mgeek.TunnyBrowser&l=en_US&label=0&m=SPH-D700&act=clickedbtn&h=480

w=800&val=5&v=7.1.0&u=[censored-string1]&cat=speed%20dial&t=1321267539531&p=mobi.mgeek.TunnyBrowser&l=en_US&label=usedspeeddialcount&m=SPH-D700&act=launch&h=480

w=800&val=1&v=7.1.0&u=[censored-string1]&cat=home&t=1321267543737&p=mobi.mgeek.TunnyBrowser&l=en_US&label=0&m=SPH-D700&act=clickedbtn&h=480