yashsingh1/xdaforums huggingface dataset:
[Security Discussion] pulser_g2:
Responsible Disclosure is a term often used in security, but what is it?

In essence, responsible disclosure is the process of making the vendor or OEM of the vulnerable software or system aware of the problem before disclosing details of the vulnerability to the public. The idea here is that the vendor will promptly solve the issue, and release a fix to users of the software, and accredit the finding of the issue to the researcher, who then discloses the vulnerability in full, now the software has been patched.

Responsible disclosure is named as such, as vendors feel it's the most responsible way to go about handling a security issue you have found. It's often the best strategy to try if you do find an issue - look for a security contact for the company, and give them a shout.

Unfortunately, some companies are rather poor at dealing with security issues, and either don't respond, or don't issue a patch or inform users of a mitigation strategy. Or in severe cases, might not even inform users of there being an issue whatsoever, and appear to ignore the vulnerability. Do bear in mind though when dealing with mobile devices that many carriers add significant delays to software releases (where on the desktop, a fix may be available the next day, the OEM might take a week or more to make a patch available on unbranded firmware, since devices and firmwares often must be approved by regulators before release, and carriers will then want further changes applied to these firmwares before their own testing).

Often if a vendor acts like this, the only solution is Full Disclosure, a process where the full details of the vulnerability are publicly released, in order to raise awareness of the vendor's insecurity and inaction (particularly if efforts were already made to contact them). Full disclosure permits the end user to be made aware of the extent and details of the security issue, and attempt to mitigate or resolve it themselves (for example, by removing an affected plugin, deleting an APK, or using a firewall to prevent access to a vulnerable service until a fix is produced).

If you are new to security, and are unsure, responsible disclosure is usually the best way forwards, but there are plenty of people around who can give good advise about this. This may well change, in light of recent practices by some companies pertaining to how they handle security vulnerabilities which are responsibly disclosed (see https://www.openrightsgroup.org/blog/2013/nsa-affects-responsible-disclosure)
[Security Discussion] Grand Guignol:
Good writeup, thanks!

Is full disclosure really an effective way of handling things though? I can understand that the intention is to make the vulnerability so well known that vendor has no choice but to fix it, but during that lead time there's going to be a vulnerability going around that people could really capitalize on. I don't have figures, but I would imagine that even if a user-made solution is found, the number of people that would actually adopt it has got to be a tiny fraction of a percent. If you're going full-disclosure, aren't you essentially ensuring the worst-case scenario? Security through obscurity is weak, but isn't it still better to sit on your hands and just hope that the vendor will get around to fixing it eventually?
[Security Discussion] J_M_V_S:
True, but also depends on the type of vulnerability. Is not the same finding a vulnerability where you need physical access to the device (ie a way of unlocking without PIN) than finding a vulnerabilty that allows remote access to sensite data without user action. I suppose that some sort of waiting can be defined. Like waiting for a week for the first type of vulnerabity and 3 months for the other....just my 2 cents.

Great writeup BTW!
[Security Discussion] SecUpwN:
For the security enthusiasts here: The Full DIsclosure Mailing List has been reopened. ENJOY! ;)
[Security Discussion] Jooztk:
Talking about responsible disclosure, I have the following question for you guys:

I found a vulnerability that can be exploited to drain the battery of a device. I informed the application vendor and they reacted that they agree with my finding and will fix it soon. I send my vulnerability and PoC 24th of February and they responded 3 weeks after. Now I am waiting for the vulnerability to be fixed.

I found this bug when writing my thesis and I really want to include it in my paper which should be published on the 31th of May. Does that fit responsible disclosure? Should I send them an e-mail stating that I will publish the details at the end of May?
[Security Discussion] Kohelet:
It can't hurt to let them know youre doing it.
[Security Discussion] rakoczy12:
Is full disclosure really an effective way of handling things though?
[Security Discussion] Kohelet:
If the end result of the disclousre is that the users can protect themselves, then yes. As the OP pointed out:
[Security Discussion] boborone:
How did I just now see this forum? Pulser I was talking to you about such an area for many many moons ago.

[MENTION=2178960]pulser_g2[/MENTION]

I have a question about posting things I find that script kiddies would love. Like today, I opened up an apk that was supposed to be an icon pack. Instead, it has [MENTION=1335872]Stericson[/MENTION] 's RootTools package in it and someone else's libpush work. So it starts out as a script kiddies dream, cause that's all it is. But it would be good for people to learn from.

When I came here, before I installed [MENTION=721210]DaveShaw[/MENTION] 's power menu .cab, I first learned what a cab was, what it did, how it worked, and what all the little bits and pieces did inside of it. You just can never be too safe. Which is probably why I don't go jumping on a new ROM, or app someone just released. I'll mull it over and let some other people be the testers. How could I post something like without giving away how it works, but showing what's inside. So as to let people know to be careful? Teach them how to open it up, the different parts of an apk, how to read it and such. That's the kind of thing I was meaning way back when I was asking you about making this kind of area. But you had the same concerns as me. It not turning into a scriptkiddy funhouse.

Are we going to be able to disclose threats among ourselves? You can't make everyone wear a white hat. Lord knows we didn't all wear one back in compsci. I see it like teaching firemen how to put out a fire. Yea they are going to learn what makes a really big fire that's hard to stop. But if you don't teach them how to build the fire, just put it out, then they have to go through just that extra bit of effort to do bad.
[Security Discussion] swampii:
Maybe some parts of this thread belongs here. http://xdaforums.com/general/security/security-threat-middle-attack-umts-t3374626
[Security Discussion] peterparkers:
It is Awesome
[Security Discussion] shin-urd:
wow
[Sony Ericsson Xperia Neo, Pro] AdiKOV:
i rooted my xperia neo and installed cwm, then i installed ultimate HD 3.0.2 succesfully, but when i rebooted my phone it got stuck on sony logo, it won't even show xperia screen. i can't enter recovery mode, can't open cwm. i tried connecting to pc for repairs but it can't install drivers because it just restarts again. help me please...

http://www.androidgadgematic.com/2012/06/how-to-fix-bricked-sony-xperia-android.html
[Sony Ericsson Xperia Neo, Pro] vishal_android freak:
Why guys don't read the stickies? Or atlest read the OP of the ROM properly..:mad::banghead: everyday same questions same unnecessary threads.. Come on man.. Spoonfeeding "NO".. Search ok and if you didn't find, search again..:rolleyes:
[One (M7) Q&A, Help & Troubleshooting] leeh41:
Excuse me if the question is dumb. My last droid was the Evo. Trying to pick everything up again.

I know when you lock/unlock the bootloader, the phone will be wiped, but will it wipe when you flash a 3rd party rom?

Does it always get wiped? I know bootloader and RUU will clean it, but what about flashing roms?

Can the internal storage be treated as an SD card so my contents dont get wiped?

also, is this what i read about the virtual SD that started in honeycomb? is that located in /media?
[One (M7) Q&A, Help & Troubleshooting] BenPope:
It's /data/media or /data/media/0 on 4.2.2 and the recoveries understand it, so it doesn't have to be wiped.

Always take a backup though.
[One (M7) Q&A, Help & Troubleshooting] leeh41:
So anything prior to 4.2.2 will still wipe the phone?
[One (M7) Q&A, Help & Troubleshooting] Matt:
Hi, flashing ROMs doesn't wipe your internal storage, and neither your apps.

(on any base 4.1.2 / 4.2.2)
[One (M7) Q&A, Help & Troubleshooting] leeh41:
thanks.

should i be seeing an /sdcard in my file structure?

I've seen it mentioned in other posts, but it doesnt appear when i'm browsing the phone.

http://xdaforums.com/showpost.php?p=42740368&postcount=597
[One (M7) Q&A, Help & Troubleshooting] Matt:
No, your sdcard is /data/media/
[JAM, MDA Compact, S100 General] patjer05:
Is there a way I can change the sensitivity of the micro for making calls? People I call find my voice volume is rather low... Btw, does it change automatically when I change the phone speaker volume (so lowering the speaker volume also lowers the microphone sensitivity)?
[Android General] e-motion:
Pronounced "say candy", the goal of SecAndy is to come up with as secure and private of an OS as possible. So as not to reinvent the wheel, we'll base this initiative on our open source code of choice (Android or maybe other developers' choice).

I am not a developer myself but I can without a doubt, because of former professional experiences, organize a project and gather the right people together as a community in order to make sure that project sees the light of day after it has acquired a life of its own if needed, which I think we will agree is something that this kind of project requires because of the scrutiny it will quickly attract.

I am officially calling upon this post all interested developers that could help us fork Android or other open source OS.

Let's get a kickstarter funded and let the party begin. I will update you later today on the advancement of such.
[Android General] e-motion:
This thread welcomes constructive ideas and developer participation, but here are beginning requirements we'll need to fulfill eventually to privatize and secure android :

- default browser allowing custom search engines such as https://ixquick.com or duckduckgo

- default system search pointing to those custom engines for online component

- control of gps at firmware level to allow full disability

- peer to peer file exchange (think BitTorrent sync) with 1024 to 2048 bit encryption

- implementation of secure sms and mms exchange (think textsecure)

- implementation of encrypted voice channels (think redphone or SIP with end-to-end encryption)

- root vpn for all online access

- systemwide warning of insecure solutions (example : wanting to use gmail or regular email)

- PGP transparent email solution

- Tor option for root vpn (subject to mitm attacks but more on that later)

- peerguardian type auto-updated database to identify suspicious IP address ranges

- systematic in-out firewall control auto updated with peerguardian database and community based rules database

- hardened malware protection and app permissions with automatic permission audit based on application type

- full device encryption and lockup (in case of unauthorized user)

- full remote wipe out and bricking with auto IMEI reporting (in case of theft, might have to be amended because of attack vector)

- full remote location capability with real time tracking (that one might have to be scratched, high security risk because of attack vector)

This obviously doesn't cover all the bases but would be a good start... I know a lot of these options can be implemented with a mismatch of apps and custom Roms but having it all at an OS level AOKP style would greatly help in building an android by the people for the people community that could eventually loosen the stranglehold of less than transparent corporations.
[Android General] e-motion:
60 views in 24 hours and not one comment. Obviously I'm approaching this the wrong way. More news at 11.
[Android General] polobunny:
I don't want to be insulting, but no programming work has been done on your part, and you're just asking for people to dive in this project to get managed by someone they never heard of. It's not really surprising no one has commented yet.
[Android General] e-motion:
I understand what you're saying but any comment, even if only just to show interest in such a project, will be key to drive developers to it.

I might not have started any development but I have clear understanding of how to design secure solutions. I can't go into details of why that is, however you can clearly see with my 2nd post that some research has been done. If I wanted a solution for me alone, I could just go on with my own little pudding of custom ROM and security apps.

However, because of the recent news events that SHOULD have awaken this population, I thought now might finally be the right time to try to get such a project off the ground. But without anyone even showing any interest, why would any developer be drawn to it ? If people would rather focus more on content consumerism than on what might happen under an umbrella of spooks that they're paying for with their taxes, then they have learned nothing from history and deserve what's coming to them, simple as that.

This is NOT a development thread in case you haven't noticed, so telling me I haven't developed anything yet is not even relevant.
[Android General] e-motion:
In case anyone cares, this will be moved shortly in the t-mobile Note 2 Android development thread as a Touchwiz proof of concept ROM. Little steps, little steps...
[Android General] gammachi:
mobile sec

While I am not a developer I would be interested in this project. I've been thinking about this a bit lately given recent events. I think a useful privacy preserving security related app and phone combo might have these features:

-some way to separate the baseband processor (radio) from the OS. It seems most phones share memory with the radio and this fact can and has been exploited. Own the bb processor and you own the phone. Perhaps a 3g dongle plugged into an android phone in host mode would work. Some of these usb "data only" radios can be unlocked for voice too. I believe a rooted phone with IP tables/firewall running would be much more secure than a conventional mobile phone.

-an anonymising network for connecting to servers/peers. I think the i2p network is well suited for this purpose. Rather than connect to services that are not designed with your anonymity/privacy in mind, connect to hidden/darknet servers that make it extremely difficult to ascertain your real IP and location. Perhaps an i2p router running on your home computer relaying i2p traffic while also maintaining a long lived encrypted connection to your mobile in order to "push" data to it. In this way the user benefits from the anonymising network, contributes to the network, but doesn't have the battery drain of relaying packets from the phone (if this is even possible).

-end-to-end encryption. Perhaps OTR messaging for texting and perhaps openPGP for transferring binary files as I don't believe file transfer in OTR is available at this time.

-an app that uses the above network that is capable of sending/receiving encrypted text, audio, video, gps location etc and does not leak any personal information that you don't want leaked. XMPP might be a good choice (with perhaps out-of-band binary transfers for efficiency). Giving your unique identifier to another person that is using the same app would allow you to communicate with them while not revealing your phone number, imei, imsi, etc. There would be some latency in the communication especially with binary transfers but I would gladly accept that for the added security.

anyway, just wanted to add this to the conversation and hope to see this project take shape as we definitely need more security enabled os's and apps.
[HTC Sensation] sibozzy1811:
Has anyone got a link for the sidebar widget that works on the inspiration Rom.. thanks in advance
[HTC Sensation] AndroidSupporter318:
Sidebar app you mean? The pro version or the lite version?

Sent from my Ouya
[HTC Sensation] sibozzy1811:
Either please mate
[HTC Sensation] AndroidSupporter318:
It's on the play store

Sent from my Ouya
[Galaxy Note GT-N7000 Q&A, Help & Troubleshooting] Ankur_:
Hi,

I broke the screen of my samsung note a while back. The glass is okay, it is the inner screen which is showing a little crack when looked at from an angle. The day it broke i was able to see the screen but after 1 day the screen has become completely black. I am not in my home country and hence can not get the screen repaired, and need some of the files from phone really badly. The trouble is I can not unlock the phone, as i am not sure of what is happening on screen.

I tried to recover data but the phone is locked. If i can either turn on the wifi or 3G of my device by some way ( then I can excess the samsungdive application and unlock my phone) or if I can bypass the pattern somehow or can enter it via pc ( like in know there exist some screen monitoring applications for android 2.0 and below) i can enter inside the phone. I have been trying a lot of stuff and I dnt want to blindly reset my phone ( i think if i reset it I should be able to unlock it). Is there any other option anyone can suggest me.

Thanks in advance.
[Galaxy Note GT-N7000 Q&A, Help & Troubleshooting] treacherous_hawk:
you can unlock via samsung dive for sure, dont you see anything when you plug your phone to via USB?
[Galaxy Note GT-N7000 Q&A, Help & Troubleshooting] Ankur_:
Hi,

I do not think you can unlock via samsungdive if your phone is not connected to internet. Since my phone is not connected to internet i can not do that via samsungdive.

Thanks

Ankur
[Galaxy Note GT-N7000 Q&A, Help & Troubleshooting] treacherous_hawk:
again:- what happens when you connect your phone to pc via USB.
[Galaxy Note GT-N7000 Q&A, Help & Troubleshooting] Ankur_:
Sorry for not giving full information in last post.

When I connect the phone via usb. It comes as a media device in pc. But when i try to import files or anything it shows nothing available. Also in Samsung kies it comes up as connected but locked. It tells to unlock the device.
[Galaxy Note GT-N7000 Q&A, Help & Troubleshooting] treacherous_hawk:
which rom and which kernel were you on?
[Galaxy Note GT-N7000 Q&A, Help & Troubleshooting] Ankur_:
I just had the jelly bean update on note. So I am running the default Rom and Kernel ( which should be there after official update). Though I am not that aware about this information.
[Galaxy Note GT-N7000 Q&A, Help & Troubleshooting] treacherous_hawk:
wasnt your data (2G or 3G) already on? if the data was already on and if you restart the computer it still remains on, moreover there is no harm in trying to unlock from samsungdive. i have lot of ideas coming to my mind but dont know if they would make any sense or may be there is a simple way to do it but i cant think of it.
[General Questions and Answers] khoatatle:
Hi,

I just want to write a background process that can intercept drivers. I wonder it can be done without using custom ROM because I'm having an LG device and full unlocking requires a unlocked bootloader and there is no available support in terms of ROMs.

I searched all over the WP7 development forum but could not find any information regarding this problem. I greatly appreciate any help.

Thanks in advance,
[Android Q&A, Help & Troubleshooting] androidulek:
Hi it if I wrote about it in the wrong place please move and here's my problem:

I wanted to deal with my colleagues in the school play in CS portable wifi teather turned and colleagues started the game but I can not play with them because my phone sees the other end of the IP address if it is possible to force my phone to connect to the IP where my friends are playing?

In MinecraftPocketEdition could do that I used and I entered the IP PocketTool colleagues but here I do not know how to do it please help.

Sorry for my bad english
[Android Q&A, Help & Troubleshooting] e-motion:
Pronounced "say candy", the goal of SecAndy is to come up with as secure and private of an OS as possible. So as not to reinvent the wheel, we'll base this initiative on our open source code of choice (Android or maybe other developers' choice).

I am not a developer myself but I can without a doubt, because of former professional experiences, organize a project and gather the right people together as a community in order to make sure that project sees the light of day after it has acquired a life of its own if needed, which I think we will agree is something that this kind of project requires because of the scrutiny it will quickly attract.

I am officially calling upon this post all interested developers that could help us fork Android or other open source OS.

Let's get a kickstarter funded and let the party begin. I will update you later today on the advancement of such.
[Android Q&A, Help & Troubleshooting] e-motion:
This thread welcomes constructive ideas and developer participation, but here are beginning requirements we'll need to fulfill eventually to privatize and secure android :

- default browser allowing custom search engines such as https://ixquick.com or duckduckgo

- default system search pointing to those custom engines for online component

- control of gps at firmware level to allow full disability

- peer to peer file exchange (think BitTorrent sync) with 1024 to 2048 bit encryption

- implementation of secure sms and mms exchange (think textsecure)

- implementation of encrypted voice channels (think redphone or SIP with end-to-end encryption)

- root vpn for all online access

- systemwide warning of insecure solutions (example : wanting to use gmail or regular email)

- PGP transparent email solution

- Tor option for root vpn (subject to mitm attacks but more on that later)

- peerguardian type auto-updated database to identify suspicious IP address ranges

- systematic in-out firewall control auto updated with peerguardian database and community based rules database

- hardened malware protection and app permissions with automatic permission audit based on application type

- full device encryption and lockup (in case of unauthorized user)

- full remote wipe out and bricking with auto IMEI reporting (in case of theft, might have to be amended because of attack vector)

- full remote location capability with real time tracking (that one might have to be scratched, high security risk because of attack vector)

This obviously doesn't cover all the bases but would be a good start... I know a lot of these options can be implemented with a mismatch of apps and custom Roms but having it all at an OS level AOKP style would greatly help in building an android by the people for the people community that could eventually loosen the stranglehold of less than transparent corporations.
[Android Q&A, Help & Troubleshooting] e-motion:
100 views total between both threads in 24 hours and not one comment. Obviously I'm approaching this the wrong way. More news at 11.
[Android Q&A, Help & Troubleshooting] DJ_Zero:
Hi all! My phone is Star N9500. And when I want update it to 4.2.2, it bricked, because it update preload.

Erorr is:

BROM ERROR: S_FT_ENABLE_DRAM_FAIL (4032)

Please help me!
[Android Q&A, Help & Troubleshooting] Nibiru2012:
I went to the NeedRom website and downloaded the latest ROM that was not customized and followed the instructions there to unbrick my Star N9500.

Some of these ROM's and in particular the instructions are very lacking in how to do the flash process. To be honest it sucks.

Someone needs to do a complete, concise and thorough tutorial on how to do these ROM flashes. Plus there are two or three methods on how to do them. Some use an outside tool application installed on Windows others use an internal Android app like MobileUncle and then flash from an SD Card.

Again... IMHO most instructions are lacking and somewhat confusing. :confused: