[Security Discussion] unclefab:
Posts can't be more than 30000 words long, and since both post #1 and post #2 have reached that limit I have to put the last updates to OP here.

Sorry for the mess:silly:.

(Continued from the end of 'Safe To remove Apps" in Chapter I)

Before to proceed copy your system/etc/permissions, system/framework and system/lib somewhere safe, make sure you have aroma file manager ready at hand, and that you have a backup of your system.

Safe to remove jars in system/framework :​

access.control.jar

allshare.jar

allshareJmDNS.jar

android.test.runner.jar

bmgr.jar (backup manager)

browsermanagement.jar

bu.jar

cneapiclient.jar

com.android.future.usb.accessory.jar

com.android.location.provider.jar (if you remove this jar then FusedLocation.apk will force close when the phone boots, greenify once the apk and click on the "hibernate all" widget everytime after booting to get rid of the annoyance)

com.android.nfc_extras.jar

com.broadcom.bt.jar

com.broadcom.nfc.jar

com.dropboxpartner.jar

com.google.android.maps.jar

com.google.android.media.effects.jar

com.google.widevine.software.drm.jar

com.quicinc.jar

com.samsung.android.sdk.bt.jar

com.samsung.device.jar

content.jar

CustFeature.jar

GlobalConfig.jar

ime.jar (stock keyboard)

javax.obex.jar

kies_feature.jar

libvtmanagerjar.jar

mmappframeworklib.lib.jar

mms-common.jar

monkey.jar

org.codeaurora.Performance.jar

org.simalliance.openmobileapi.jar

qcmmediaplayer.jar

requestsync.jar

sc.jar

scrollpause.jar

sec_feature.jar

sec_platform_library.jar

seccamera.jar

sechardware.jar

secmediarecorder.jar

secosp.jar

services-ext.jar

settings.jar

smartfaceservice.jar

smartfaceserviceapi.jar

smatlib.jar

stayrotation.jar

svc.jar

svi.jar

sws.jar

uiautomator.jar

videowall.jar

After you're done don't forget to wipe the dalvik-cache.

Bear in mind that it works for me cuz I removed nearly all the stock apps, but depending on your phone configuration you may have to keep more jars.

For example, the stock keyboard would probably not work anymore if ime.jar is gone, same story with the stock camera if seccamera.jar has been deleted.

The same applies to other apps and functionalities, but the good news is that most jars are self explanatory.

Safe to remove xmls in system/etc/permissions :​

access.control.xml

allshare_library.xml

allshareJmDNS_library.xml

android.hardware.nfc.xml

android.hardware.wifi.direct.xml

android.software.live_wallpaper.xml

android.software.sip.voip.xml

com.android.location.provider.xml (warning, to remove this xml you'll need to mod FusedLocation.apk in order to force it not to need the xml anymore)

com.android.nfc_extras.xml

com.broadcom.nfc.xml

com.google.android.media.effects.xml

com.google.widevine.software.drm.xml

com.samsung.android.sdk.bt.xml

com.samsung.device.xml

com.sec.feature.hovering_ui (accelorometer sensor)

com.sec.feature.irda_service.xml

com.sec.feature.yosemite.xml (accelorometer sensor)

kies_feature_library.xml

mmappframeworklib_library.xml

org.simalliance.openmobileapi.xml

sec_feature.xml (may break the stock FM radio, dunno about third part radios like Spirit)

sec_mdm.xml

seccamera.xml

secmediarecorder.xml (may break the stock FM radio, dunno about third part radios like Spirit)

smartfaceservice.xml

smat_library.xml

svi_library.xml

sws.xml

usb_print2.xml

videowall_library.xml

vtmanager_library.xml

Bear in mind that it works for me cuz I removed nearly all the stock apps, but depending on your phone configuration you may have to keep more xml.

For example, the nfc would probably not work anymore if one of the xmls that have "nfc" in the title is gone, same story for stock camera if seccamera.xml has been deleted (but some third part cameras will still work).

The same applies to other functions, but fear not since most xmls are self explanatory.

Safe to remove files in system/lib :​

the whole drm folder

all files that have "google" in it

More files can be removed (about 60 that I tested up to now), but risks to break this or that functionality increase, and since I don't think that many people use such a barebone phone like me I'll pass for now.

If you want to know which libs just tell me and I'll add them.

Miscellaneous :​

- The system/etc/cmds folder.

- The system/etc/secure_storage folder.

- The system/etc/videotelephony folder.

- The system/tts folder (unless you use text to speech features).

- The system/usr/srec/en_US folder (unless you use google now's english offline typing features).

- The system/voicebargeindata folder.

- The system/wakeupdata folder

Special cases​

​

Am.jar (Activity Manager)​

It can be removed, and then something interesting happens:

newly installed root apps can't get super user rights, but root apps that had previously been installed and are in the super su list work as usual.

I'm not 100 % sure, but that could prevent privilege escalation by malicious apps or processes.

Still, be careful and test it only with root apps that you know for sure are safe.

Actually this am.jar works as an activity manager that can be used remotely to start an activity or an app, force stop apps, kill processes, debug, broadcast an intent and more, through adb or directly from within your phone by using a terminal app.

To get an idea about what it can do type in your terminal:

su

am

and see by yourself.

If you are not into playing with such activities and if you don't use adb you won't feel any difference once you disabled am.jar, not to mention that preventing adb operations is one more step towards better security.

There's another am file in system/bin and it works as a trigger to activate am.jar, so disabling/chmoding 000 that system/bin/am prevents am.jar from starting/working without the need to remove am.jar.

Still, I rather take care of both, just to be on the safe side.

I made two scripts.

One to erase/disable the am functionalities (but before to proceed, copy system/framework/am.jar somewhere safe):

#!/system/bin/sh

mount -o remount,rw /system

rm /system/framework/am.jar

chmod 000 /system/bin/am

rm /data/dalvik-cache/system@framework@am.jar@classes.dex

One to restore/enable am (make a folder called scripts in your sd, and put am.jar inside):

#!/system/bin/sh

mount -o remount,rw /system

cp /sdcard/scripts/am.jar /system/framework

chmod 0644 /system/framework/am.jar

chmod 0755 /system/bin/am

Pm.jar (Package Manager)​

Pm.jar can be removed too, and just like am.jar it has a triggering file located in system/bin. Disabling them will disable the package manager.

This package manager enables apps to be installed/uninstalled, apps' data to be cleared, apps' components to be enabled /disabled, apps' permissions to be granted/revoked and more, through adb or with an Android terminal app.

To know what it can do type :

su

pm

and see by yourself if you think it's worth keeping it or not.

If you don't use adb you won't feel any difference after you disabled pm.jar (you will still be able to install, uninstall and clear data manually) not to mention that preventing adb operations and specially remote installation/uninstallation of apps is pretty important security wise.

Still, you have to bear in mind that apps like Titanium backup, Rom Toolbox or App Settings use pm to freeze apps or disable apps' components and permissions, and for example when pm is desactivated it prevents me from disabling apps receivers/components (like start on boot, factory reset, etc.) with Rom Toolbox.

Not a big deal cuz pm can easily be enabled and disabled, but I report the issue nevertheless in case it happens to somebody else....

In theory, removing pm could enable one to install unsigned apps, which can be useful in some situations (particularly when one needs to edit the android manifest on system apps).

Remember that doing so is dangerous, since any dodggy app could be installed, so be cautious and test it only with system apps and/or apps that you trust.

As said above there's another pm file in system/bin and it works as a trigger to activate pm.jar, so disabling/chmoding 000 that system/bin/pm prevents pm.jar from starting/working without the need to remove pm.jar.

Still, I rather take care of both, just to be on the safe side.

Now, two scripts.

One to erase/disable pm (but before to proceed, copy system/framework/pm.jar somewhere safe):

#!/system/bin/sh

mount -o remount,rw /system

rm /system/framework/pm.jar

chmod 000 /system/bin/pm

rm /data/dalvik-cache/system@framework@pm.jar@classes.dex

One to restore/enable pm (make a folder called scripts in your sd, and put pm.jar inside):

#!/system/bin/sh

busybox mount -o remount,rw /system

cp /sdcard/scripts/pm.jar /system/framework

chmod 0644 /system/framework/pm.jar

chmod 0755 /system/bin/pm

Disabling adb

This should do the trick :

#!/system/bin/sh

mount -o rw,remount -t rootfs rootfs /

chmod 000 /sbin/adbd

mount -o ro,remount -t rootfs rootfs /

If it doesn't work try this :

#!/system/bin/sh

mount -o remount,rw /system

chmod 000 /system/bin/adb

Safe to remove applets​

Applets are like small programms or commands that can be performed by the system, sometimes with root permissions. They are located in system/bin and system/xbin, and this is where the heart of your root beats (su and sh). Some came preinstalled on your phone, others are installed along busybox (those ones are usually symlinked, and bear a different installation date than the stock applets).

We all have different interests and different needs, so here's some documentation in order to help you decide which applets you want to keep and which applets you want to remove (don't forget to make a backup) :

http://busybox.net/downloads/BusyBox.html

To start, you can delete the ones that are nothing but a trigger for framework jars (like am or pm they bear the same name than their framework counterpart, and they are very light, like 100-200 b, since all what's inside is a short command to trigger the jar).

Then, watch out for the ones that have internet access.

I will write more about it, and give some examples, in a few days when I have time...;)

Disable NFC and Bluetooth​

#!/system/bin/sh

mount -o rw,remount -t rootfs rootfs /

chown 0.0 /dev/bcm2079x

chmod 000 /dev/bcm2079x

mount -o ro,remount -t rootfs rootfs /

That will disable NFC (it has to be ran as an init.d script cuz files recreate at each boot), but before to run this script bear in mind that it may be different on your phone. So, go to the /dev folder, see which files have nfc as owner, and edit the script accordingly.

The same applies to the following init.d script that disables bluetooth :

#!/system/bin/sh

mount -o rw,remount -t rootfs rootfs /

chown 0.0 /dev/smd2

chmod 000 /dev/smd2

chown 0.0 /dev/smd3

chmod 000 /dev/smd3

chown 0.0 /dev/smd7

chmod 000 /dev/smd7

chown 0.0 /dev/ttyHS0

chmod 000 /dev/ttyHS0

chown 0.0 /dev/uhid

chmod 000 /dev/uhid

chown 0.0 /dev/uinput

chmod 000 /dev/uinput

rm -r dev/socket/qmux_bluetooth

rm -f persist/.bt_nv.bin

mount -o ro,remount -t rootfs rootfs /

Alternatively, you can run the following once (but again, check that your files match the script and edit if needed):

mount -o remount,rw /system

chmod 000 /system/app/Bluetooth.apk

chmod 000 /system/app/BluetoothTest.apk

chmod 000 /system/etc/bluetooth

chmod 000 /system/etc/bluetooth/audio.conf

chmod 000 /system/etc/bluetooth/auto_pair_devlist.conf

chmod 000 /system/etc/bluetooth/auto_pairing.conf

chmod 000 /system/etc/bluetooth/blacklist.conf

chmod 000 /system/etc/bluetooth/bt_did.conf

chmod 000 /system/etc/bluetooth/bt_secure_manager_app_pub_key

chmod 000 /system/etc/bluetooth/bt_stack.conf

chmod 000 /system/etc/bluetooth/input.conf

chmod 000 /system/etc/bluetooth/iop_bt.db

chmod 000 /system/etc/bluetooth/main.conf

chmod 000 /system/etc/bluetooth/network.conf

chmod 000 /system/etc/permissions/com.samsung.android.sdk.bt.xml

chmod 000 /system/framework/com.broadcom.bt.jar

chmod 000 /system/framework/com.samsung.android.sdk.bt.jar

chmod 000 /system/framework/sec_feature.jar

chmod 000 /system/lib/libbluetooth_jni.so

rm /data/dalvik-cache/system@app@Bluetooth.apk@classes.dex

rm /data/dalvik-cache/system@app@BluetoothTest.apk@classes.dex

rm /data/dalvik-cache/system@framework@com.broadcom.bt.jar@classes.dex

rm /data/dalvik-cache/system@framework@com.samsung.android.sdk.bt.jar@classes.dex

rm /data/dalvik-cache/system@framework@sec_feature.jar@classes.dex

rm -r /data/data/com.android.bluetooth

rm -r /data/data/com.sec.android.app.bluetoothtest

mount -o remount,ro /system

Disable auto start on boot and receivers​

Edit as per your needs:

#!/system/bin/sh

/system/bin/pm disable android/com.android.server.BootReceiver

/system/bin/pm disable android/com.android.server.DRMEventReceiver

/system/bin/pm disable android/com.android.server.TimaServiceEventReceiver

/system/bin/pm disable android/android.accounts.ChooseAccountActivity

/system/bin/pm disable android/android.accounts.ChooseAccountTypeActivity

/system/bin/pm disable android/android.accounts.ChooseTypeAndAccountActivity

/system/bin/pm disable android/android.accounts.GrantCredentialsPermissionActivity

/system/bin/pm disable android/android.content.SyncActivityTooManyDeletes

/system/bin/pm disable android/com.android.internal.app.ChooserActivity

/system/bin/pm disable android/com.android.internal.app.DisableCarModeActivity

/system/bin/pm disable android/com.android.internal.app.HeavyWeightSwitcherActivity

/system/bin/pm disable android/com.android.internal.app.NetInitiatedActivity

/system/bin/pm disable android/com.android.internal.app.PlatLogoActivity

/system/bin/pm disable android/com.android.internal.app.ResolverGuideActivity

/system/bin/pm disable android/com.android.internal.os.storage.ExternalStorageFormatter

/system/bin/pm disable android/com.android.server.DrmEventService

/system/bin/pm disable android/com.android.server.MasterClearReceiver

/system/bin/pm disable android/com.android.server.ShutdownActivity

/system/bin/pm disable android/com.android.server.TimaService

/system/bin/pm disable android/com.android.server.updates.CertPinInstallReceiver

/system/bin/pm disable android/com.android.server.updates.SmsShortCodesInstallReceiver

/system/bin/pm disable android/com.android.server.wifi_offload.AppRunnOverWifiDialog

/system/bin/pm disable android/com.carrieriq.iqagent.service.IQService

/system/bin/pm disable android/com.carrieriq.iqagent.service.receivers.EnableToggleImpl

/system/bin/pm disable android/com.carrieriq.iqagent.service.ui.ShowMessage

/system/bin/pm disable android/com.carrieriq.iqagent.service.ui.UserPage

/system/bin/pm disable android/com.carrieriq.iqagent.stdmetrics.survey.android.QuestionnaireActivity

/system/bin/pm disable android/com.carrieriq.iqagent.stdmetrics.survey.android.QuestionnaireLaunchActivity

/system/bin/pm disable ccc71.at.free/ccc71.at.receivers.phone.at_boot_receiver

/system/bin/pm disable ccc71.at.free/ccc71.at.receivers.phone.at_boot_script_receiver

/system/bin/pm disable ccc71.at.free/ccc71.at.receivers.phone.at_sd_link_receiver

/system/bin/pm disable ccc71.at.free/ccc71.at.receivers.phone.at_battery_plug_receiver

/system/bin/pm disable ccc71.at.free/ccc71.at.receivers.phone.at_battery_unplug_receiver

/system/bin/pm disable ccc71.at.free/ccc71.at.receivers.phone.at_media_receiver

/system/bin/pm disable de.esoco.android.clipboard/de.esoco.android.clipboard.ClipNoteBroadcastReceiver

/system/bin/pm disable com.jb.mms/com.jb.mms.transaction.MmsSystemEventReceiver

/system/bin/pm disable com.jb.mms/com.jb.mms.transaction.SmsReceiver

/system/bin/pm disable com.jb.mms/com.jb.mms.transaction.MmsSystemEventReceiver

/system/bin/pm disable com.jb.mms/com.jb.mms.ui.security.StartSecurityReceiver

/system/bin/pm disable com.ceco.gm2.gravitybox/com.ceco.gm2.gravitybox.BootCompletedReceiver

/system/bin/pm disable com.oasisfeng.greenify/com.oasisfeng.greenify.Startup

/system/bin/pm disable android/com.carrieriq.iqagent.service.receivers.BootCompletedReceiver

/system/bin/pm disable com.lostnet.fw.free/com.lostnet.fw.AutostartReceiver

/system/bin/pm disable com.googlecode.networklog/com.googlecode.networklog.BootCompletedReceiver

/system/bin/pm disable org.torproject.android/org.torproject.android.OnBootReceiver

/system/bin/pm disable org.palemoon.mobile/org.mozilla.gecko.background.announcements.AnnouncementsBroadcastReceiver

/system/bin/pm disable org.palemoon.mobile/org.mozilla.gecko.background.healthreport.upload.HealthReportBroadcastReceiver

/system/bin/pm disable eu.chainfire.pryfi/eu.chainfire.pryfi.BackgroundServiceReceiver

/system/bin/pm disable com.android.settings/com.android.settings.accounts.AccountReceiver

/system/bin/pm disable com.android.settings/com.android.settings.accounts.AddAccountSettings

/system/bin/pm disable com.android.settings/com.android.settings.accounts.ChooseAccountActivity

/system/bin/pm disable com.android.settings/com.android.settings.accounts.SyncSettingsActivity

/system/bin/pm disable com.android.settings/com.android.settings.wifi.WifiStatusReceiver

/system/bin/pm disable com.android.settings/com.android.settings.nearby.MountReceiver

/system/bin/pm disable com.android.settings/com.android.settings.SettingsIntentReceiver

/system/bin/pm disable com.android.settings/com.android.settings.powersavingmode.PowerNotiReceiver

/system/bin/pm disable com.android.settings/com.android.settings.nfc.SBeamStateReceiver

/system/bin/pm disable com.android.settings/com.android.settings.dormantmode.DormantModeNotiReceiver

/system/bin/pm disable com.android.settings/com.android.settings.ethernet.EthernetConfigure

/system/bin/pm disable com.android.settings/com.android.settings.ethernet.EthernetEnabler

/system/bin/pm disable com.android.settings/com.android.settings.EthernetSettings

/system/bin/pm disable com.android.settings/com.android.settings.FactoryResetBroadcastReceiver

/system/bin/pm disable com.android.settings/com.android.settings.FactoryResetDialog

/system/bin/pm disable com.android.settings/com.android.settings.KiesLocationReceiver

/system/bin/pm disable com.android.settings/com.android.settings.MasterClearModemReset

/system/bin/pm disable com.android.settings/com.android.settings.MediaFormat

/system/bin/pm disable com.android.settings/com.android.settings.MediaFormatSd

/system/bin/pm disable com.android.settings/com.android.settings.nearby.NearbySettings

/system/bin/pm disable com.android.settings/com.android.settings.nfc.NfcGateReceiver

/system/bin/pm disable com.android.settings/com.android.settings.UsageStats

/system/bin/pm disable com.android.settings/com.android.settings.UsbSettings

/system/bin/pm disable com.android.settings/com.android.settings.UserDictionarySettings

/system/bin/pm disable com.android.settings/com.android.settings.XmlBackup

/system/bin/pm disable com.android.settings/com.samsung.wfd.WFDSourceService

/system/bin/pm disable com.sec.android.app.controlpanel/com.sec.android.app.controlpanel.PackageIntentReceiver

/system/bin/pm disable com.keramidas.TitaniumBackup/com.keramidas.TitaniumBackup.schedules.BootReceiver

/system/bin/pm disable com.vipercn.viper4android_v2/com.vipercn.viper4android_v2.receiver.BootCompletedReceiver

/system/bin/pm disable com.vipercn.viper4android.xhifi/com.vipercn.viper4android.xhifi.receiver.BootCompletedReceiver

Upgrading to later Android versions?​

Some people say that later Android versions are "safer" cuz vulnerabilities have been patched?

Nice one, that's what google and his friends want you to believe.

Like this you will jump on new versions as soon as you can, and they will tighten the knot.

Most vulnerabilities (except one or two) only work if one has installed a doddgy app, or has had a nasty app installed remotely hence the importance to disable pm, or opened a nasty sms through WAP push (WAP is anyway uninstalled if one has followed OP).

If you are the type of guy that installs apps from shaddy sources, and that clicks on any link on any sms that promises to increase your d...k's size to 25 inches then I agree, you should stick to later Android versions.

But as for me I'm not that type of guy, and anyway, what are those bad apps using those vulnerabilities we are talking about?

They are a few nasty bits, flooded amongst millions of Android apps on board over one billion Android devices, and those nasty bits account for something like 0.01% (even less if you only installs from trusted sources and don't click on 25 inches offer sms').

OTOH, google's tracking on Android is on 100 % of newly bought smartphones and wifi tablets, and its tracking becomes more and more sophisticated and harder and harder to remove as the Android version rises (it started with 4.2 and got much worse with 4.4).

Now think a bit, what kind of risk are you willy to take with your phone?

Still undecise? I don't have too much time to search the net about it, but since I'm a good uncle here's a link to start with:

http://www.greenbot.com/article/214...-is-on-android-but-good-luck-catching-it.html

ADDITIONAL LINKS​

Wanna read more? Here are two interesting projects you may like (thanks [MENTION=5979475]Froschohnenamen[/MENTION] for reminding me of those).

Pri-Fy from [MENTION=631273]Chainfire[/MENTION], the great master of root:

http://xdaforums.com/showthread.php?t=2631512

NOGAPPS, or how to replace google proprietary stuff with some open source equivalents:

http://xdaforums.com/showthread.php?t=1715375

WIP:

- safe to remove system/framework jars (done),

- safe to remove system/etc/permissions xmls (done),

- safe to remove system/libs (done),

- safe to remove stuff in system/bin and system/xbin (done),

- annihilate bluethooth and nfc (done),

- search the baseband/modem for privacy leaks (started, but still a long way to go). That one will be a hard task, I'm new in that field and most of it is closed. Any help will be very much appreciated, thanks in advance!!!

- 2-3 things more;)