yashsingh1/xdaforums huggingface dataset:
[Security Discussion] Applied Protocol:
for better battery power on a VPN use wiregaurd and for a VPN service provider Azirevpn for wiregaurd is free the also do not have any hard drives in their servers. And ranks high on that site (look not all the categories are so relevant to security)
[Security Discussion] Primokorn:
Wireguard is still in its infancy. I don't think it's a good idea for a daily use.

FYI several devs don't want to support it for this reason and it's has been explained during a conference at SSTIC 2018.
[Security Discussion] Applied Protocol:
it has been cryptographically verified and being that it needs kernel support cannot be used on all roms it is a emerging technology but it is accepted in the linux kernel dev circles for some time now
[Security Discussion] iwanttoknow:
Install "NetGuard - no-root firewall" could be a good first step to secure your phone and improve your privacy.
[Security Discussion] bigogofthewest:
Just awesome job! :D Thank you for this. Bookmarked this thread and trust me, I'll put it in good use!
[Security Discussion] saqiB.:
Hello, i am using lineageos 7.1.2 based rom with microG using afwall with built in iptables & also replaced afwall iptable n iptable6 in system/bin i do have kernel pinging to 192.168.2.1 host is not able to block it for some reason and android os is using data continuously in background. This is in idle mode where no apps are being used.

I am using an app called simple system monitor which is showing random network usage in background [ This is in idle mode] but nothing can be found in network log app.

For some reason my device starts lagging after being connected to wifi or mobile data this is the issue i have been facing from a long time and it's running smooth without being connected to any network.
[Security Discussion] iwanttoknow:
It's amazing to see app Simple System Monitor displaying network activity upload in Airplane mode.

I don't understand why.
[Security Discussion] sotoLOTO-:
With WiFi toggled off, several apps have still been connecting to the internet for me.
[Security Discussion] iwanttoknow:
I imagine that several apps you talk about try to connect but they don't go on Internet.

So is it an issue with app Simple System Monitor when displaying network activity in Airplane mode ? If not I don't understand.
[Security Discussion] sotoLOTO-:
Havent used Simple System Monitor
[Security Discussion] saqiB.:
No network activities are being displayed on my device with wifi toggled off.
[Security Discussion] IronRoo:
NetGuard no root firewall should show you what is trying to connect & to where
[Security Discussion] OldNoobOne:
https://xdaforums.com/t/privacy-tech-giants.4337823/#post-85666803

I did'nt even know there was a topic like 'How to Secure your phone' or i would have come here right away but now Android 11 & 12 is here it's the boss i guess, these are spy phones from up to down whole :'-(
[Security Discussion] unclefab:
It's necessary because the firewall uses those two applets to block what has to be blocked. It needs to know where they are, and usually they are in system/bin (provided that one has installed Busybox).

Disabling ipv6 or not is subject to debate. Some say it's a vulnerability, like here:

http://www.theage.com.au/it-pro/security-it/turn-off-ipv6-say-security-experts-20120608-2002h.html

Some say it's ok.

As I already said I'm no security expert and I rather prevent than cure, so I disabled it. And since my device still works fine I keep it disabled.

These are adds or scripts, or let's say unwanted connections that happen without one's intervention. Like you connect to a web page and at the same time there are other connections that occur behind your back.

I didn't write one by one what it was, sorry for that but at first that script was made for personnal use.

If you want to check go to:

http://whois.domaintools.com/

That site shows, amongst others, where IPs belong and which IP range to block.

I have added it to OP...
[Security Discussion] Primokorn:
I'm using a script stored in /data/local/AFscript.sh

Permissions:

• /data 775

• /local and AFscript.sh 755

AFscript.sh (created from my phone so I didn't set any format / UTF-8) / tried with LF Only (Unix/Android):

# Necessary at the beginning of each script!

IP6TABLES=/system/bin/ip6tables

IPTABLES=/system/bin/iptables

## Force DNS (in this Case [OpenDNS](http://www.opendns.com/))

$IPTABLES -t nat -D OUTPUT -p tcp --dport 53 -j DNAT --to-destination 208.67.222.222:53 || true

$IPTABLES -t nat -D OUTPUT -p udp --dport 53 -j DNAT --to-destination 208.67.222.222:53 || true

# Deny IPv6 only connections

$IP6TABLES -P INPUT DROP

$IP6TABLES -P OUTPUT DROP

#

# Others

$IPTABLES -A "afwall" --destination "23.4.92.33/32" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "23.32.0.0/11" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "23.64.0.0/14" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "23.253.56.120/32" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "64.207.128.0/18" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "68.232.32.0/20" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "91.103.140/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "104.16.0.0/12" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "104.64.0.0/10" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "116.214.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "118.214.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "198.232.125.88/32" -j "afwall-reject" || exit

#

# Turla

$IPTABLES -A "afwall" --destination "80.248.65.183/32" -j "afwall-reject" || exit

#

# Others

$IPTABLES -I INPUT -s 23.4.92.33/32 -j DROP || exit

$IPTABLES -I INPUT -s 23.32.0.0/11

-j DROP || exit

$IPTABLES -I INPUT -s 23.64.0.0/14 -j DROP || exit

$IPTABLES -I INPUT -s 23.253.56.120/32 -j DROP || exit

$IPTABLES -I INPUT -s 64.207.128.0/18 -j DROP || exit

$IPTABLES -I INPUT -s 68.232.32.0/20 -j DROP || exit

$IPTABLES -I INPUT -s 91.103.140/24 -j DROP || exit

$IPTABLES -I INPUT -s 104.16.0.0/12 -j DROP || exit

$IPTABLES -I INPUT -s 104.64.0.0/10 -j DROP || exit

$IPTABLES -I INPUT -s 116.214.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 118.214.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 198.232.125.88/32 -j DROP || exit

#

# Turla

$IPTABLES -I INPUT -s 80.248.65.183/32 -j DROP || exit

After entering . /data/local/AFscript.sh as my custom script I have the attached popup. Of course root access are granted by SuperSU.
[Security Discussion] La_Globule:
[MENTION=4703661]unclefab[/MENTION] :

Thanks for this beautiful post about our phone security.

A bit extreme but very useful.

We have to be very cautious with all the risks today.

I'll implement some of your ideas in the future.

Let me show you a mistake on an IP address in the AFWall+ sample custom script you give in OP.

In the Others list (both afwall & INPUT chains), around the middle, there's the IP "91.103.140/24" which is incomplete.

This could probably cause some errors when applying by AF.

[MENTION=4958579]Primokorn[/MENTION] :

This incomplete IP could be the reason for the error you encountered in your script.

FYI, I've done exactly like you (script in /data/local, chmod 755) except for its content (only exclusion for Turla and block IPv6) and it works like a charm.

So try to comment out this line and let us know.
[Security Discussion] unclefab:
Woops, my bad:eek:, I added this IP in the script yesterday and I forgot the last part, I told you that I'm getting old:cyclops:.

OP edited (91.103.140.0/24), and thanks/merci for your help!!!

I have to correct it ASAP on my phone.:silly:

That said it may make an error in AF+ when one applies the rules, but I don't think it would interfere with su (I'm currently using the script with the error and no su problems on my phone).

Or well, I never had such an issue, but let's see how Primokorn managed...
[Security Discussion] Primokorn:
Quick feedback:

The SU error is due to something wrong in the above script. I didn't have time to check all parts but my new custom script works (only 'Deny IPv6 only connections').

I'll check later who is the culprit and report back.
[Security Discussion] silentvisitor:
I envy your level of knowledge guys especially [MENTION=4703661]unclefab[/MENTION] :p

Pretty good pool of information here :good:
[Security Discussion] Celestial Fury:
In your script, those are only a handful of malicious IP addresses to be blocked. Apparently, there are a billion more to go? Won't having a billion lines in custom script crash our device?
[Security Discussion] Primokorn:
[MENTION=4703661]unclefab[/MENTION] here is the error :) I copied/pasted the script without checking the whole syntax but there's a line break here:
[Security Discussion] Primokorn:
Information about DNS & KitKat:

On my Nexus 5 - Kitkat 4.4.4 - I do not have the first file (resolv.config). At the end, I downloaded an app called DNS forwarder by Evan He (read the description for more details especially the information for KitKat users).

OpenDNS has been successfully tested through this URL: https://store.opendns.com/settings/
[Security Discussion] unclefab:
Thanks for the info mate, and since you autorised me through PMs I added it to OP.

Note that to check whether you are using Open DNS or not you'll have to enable cookies on your browser.
[Security Discussion] Primokorn:
Some

suggestions

to add more rules to your init.d script. I found this and I removed what you already have:

###Avoid a smurf attack

sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1; [to disable multicast features]

###ICMP redirects ipv4

busybox sysctl -e -w net.ipv6.conf.all.accept_redirects=0;

###ICMP redirects ipv6

busybox sysctl -e -w net.ipv4.conf.all.send_redirects=0;

### ICMP redirects

busybox sysctl -e -w net.ipv4.conf.all.accept_source_route=0; ###source routing disable

busybox sysctl -e -w net.ipv4.conf.all.forwarding=0;

###Forwarding traffic

busybox sysctl -e -w net.ipv4.conf.all.log_martians=1;

###filter martians

busybox sysctl -e -w net.ipv4.tcp_max_syn_backlog=1280;

###TCP syn half-opened

sysctl -w net.ipv4.ip_forward=0;

###Tune IPv6 and disable lol

busybox sysctl -e -w net.ipv6.conf.default.router_solicitations=0;

busybox sysctl -e -w net.ipv6.conf.default.accept_ra_rtr_pref=0;

busybox sysctl -e -w net.ipv6.conf.default.accept_ra_pinfo=0;

busybox sysctl -e -w net.ipv6.conf.default.accept_ra_defrtr=0;

busybox sysctl -e -w net.ipv6.conf.default.autoconf=0;

busybox sysctl -e -w net.ipv6.conf.default.dad_transmits=0;

busybox sysctl -e -w net.ipv6.conf.default.max_addresses=1;

busybox sysctl -e -w net.ipv6.conf.all.disable_ipv6=1;

busybox sysctl -e -w net.ipv6.conf.default.disable_ipv6=1;

busybox sysctl -e -w net.ipv6.conf.lo.disable_ipv6=1;

### Don't act as a router

busybox sysctl -e -w net.ipv4.conf.all.send_redirects=0;

busybox sysctl -e -w net.ipv4.conf.default.send_redirects=0;

By the way this script modifies /system/etc/sysctl.conf file, right? ("Sysctl.conf is the configuration file at /etc/sysctl.conf for sysctl and is used to configure kernel parameters at boot time") So how come mine is empty (0Kb)? :rolleyes:

This could be helpful in your guide to explain the meanings of -e -w....
[Security Discussion] an0n981:
The only file that needs to be deleted is /data/system/xprivacy/xprivacy.db. This is where XPrivacy stores all restrictions and settings. This way you don't have to re-install XPrivacy and re-import your license file and XPrivacy will already be active on first boot and you can immediately import settings.
[Security Discussion] unclefab:
Yep, that's another way to do it.

But importing the settings take forever, or let's say longer than reinstalling the app, and as for me I never had to reimport my license.

Or maybe one has to do it with the latest Xprivacy versions?

I can't tell for sure, it's been a while since I last got a bootloop and well, I won't complain!:p

Anyway, both methods have pros and cons and it's up to anyone.

Thanks mate!:good:
[Security Discussion] Primokorn:
Yes I know. It was just a 'bbcode comment' lol

Nothing in /system/bin :confused: and I have an empty folder 'sysctl' in /system/xbin.
[Security Discussion] 6hunnid9:
This is completely wrong.

Using OmniROM or CM(+freecyngn) has no built in tracking, unlike a lot of stock manufacturer ROMs which have baked in proprietary tracking software.

You're not doing yourself any good by replacing proprietary apps (google apps) with other proprietary apps (quickpic, greenify, a better camera, mx player).

This is asking to get nailed by a vulnerability.
[Security Discussion] unclefab:
Have you ever had a look at all the permissions cm's stock apps have (on omni I can't tell since I never used one of their roms, and that's why I hadn't mentionned them)? I guess you didn't...

Those perms are outrageaous and uneeded, just like on a stock rom, I know for sure since when I tried cm I blocked them without preventing the rom from working.

Then, regarding tracking, just use network log app and see where your cm stock apps (android system, settings, settings storage, to name a few) connect.

But hey, you are free to believe that by using a custom rom you are safe!

Most, if not all but I didn't try 'em all, google apps don't work if they are not connected, wheras quickpic, greenify, a better camera, mx player don't require any internet connection.

BTW, if I followed you well you know a google app that works like greenify?

That's interesting, you mind telling us which one?

Nope, this is asking for a rom much easier to secure from google and its data mining. Vulnerabilities have been patched by some apps I mention in OP, but I start to wonder whether you read it completely or not...

Anything else?:silly:
[Security Discussion] 6hunnid9:
They don't connect anywhere if you use freecyngn and they're open source, if I wanted to I could audit the code and compile it myself.

They're still proprietary, meaning you cannot analyze the source code. They can do what they want, you don't control the osftware.

http://www.cvedetails.com/version/138252/Google-Android-4.2.html

Do they fix these?
[Security Discussion] setmov:
[MENTION=4703661]unclefab[/MENTION] don't lose your time explaining things to people that don't wanna listen! They don't deserve it!
[Security Discussion] t88:
[MENTION=4703661]unclefab[/MENTION] good stuffs, thank you!

I've learned a lot. :thumbup:
[Security Discussion] E:V:A:
Thanks! Amazing writeup!

I can't overemphasize how important all this is, for people concerned with their privacy. In addition, I'd like to mention that it is worthwhile looking for URLs inside the Baseband FW. I find lots of bad places there, that also goes for the Bluetooth, Wifi, NFC firmwares.

Merry Christmas!
[Security Discussion] unclefab:
Merry Xmas to everybody!!!!

[MENTION=4372730]E:V:A[/MENTION] :

nice to see you here!!!

If I'm not mistaken the Baseband FW you mentioned is located in firmware/images?

I've started digging in, there are 30 fw files but they are encrypted.

I will study the links in your signature, starting with the one about AT commands to tame one's modem, I already had a quick look and I saw that there's a lot to learn there.

Regarding bluethooth and nfc I read here (thanks [MENTION=4958579]Primokorn[/MENTION] for reminding me) :

http://xdaforums.com/showpost.php?p=40767777

about disabling stuff in dev/. So I investigated and I found some nfc and bluethooth related files, and I disabled them with the following script (note that the files may have a different name on somebody else's phone, just check which owner the files have, if it's bluethooth or nfc instead of system or root then you're good), and while I was at it I disabled adb too:

#!/system/bin/sh

mount -o rw,remount -t rootfs rootfs /

chmod 000 /sbin/adbd

mount -o rw,remount /dev

chown 0.0 /dev/bcm2079x

chmod 000 /dev/bcm2079x

chown 0.0 /dev/smd2

chmod 000 /dev/smd2

chown 0.0 /dev/smd3

chmod 000 /dev/smd3

chown 0.0 /dev/smd7

chmod 000 /dev/smd7

chmod 000 /dev/ttyHS0

chown 0.0 /dev/ttyHS0

mount -o ro,remount -t rootfs rootfs /

Some files in the same folder seem to be phone related since the owner is "radio" (like qmi0, qmi1, qmi2), and for sure there's a lot to do there (some other files are camera related and maybe it could deactivate the front camera, others are audio related, etc.).

But one as to proceed with caution, and if one wants to wipe one of those files one has to backup one's modem/radio partition (disabling/chmoding 000 with a script would be less dangerous, but probably less effective).

Right now I'm testing safe to remove applets in system/bin and system/xbin, once it's done I'll concentrate on that modem/radio stuff.

If someone feels like testing, here's some homework, in https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy check the "Removing the Remnants of the Baseband" section...;)

Oh yeah, before I forget, disabing pm.jar (see post #44 above) prevents me from disabling apps receivers (like start on boot etc.) with rom toolbox, I will add that side effect to post #44..
[Security Discussion] sancho_panzer:
I'm curious, can you please tell me where you took your programming course? What are your best coding skills?
[Security Discussion] iunlock:
Excellent Thread! Remember after all this greatness...use a VPN!

What an excellent write up. Good job...

I just wanted to emphasis the importance of using a VPN as well. If anyone has any questions on VPN stuff, feel free to PM me as I've done tons of research in this area....

---------- Post added at 10:43 PM ---------- Previous post was at 10:29 PM ----------

OP, I was looking to see what device you were using and upon reading through your post I saw that you'd mentioned..."On my Nexus 5 - Kitkat 4.4.4...."

Is KK 4.4.4 the last stop for you? ie.... with all the extra security crap being put into the new firmwares, what are your thoughts on where to stop? Right now I too am on 4.4.4 and am getting more and more nervous the closer things are getting to NotSoLollipop 5.0.
[Security Discussion] Tjee:
A vpn is private but not very secure (you're basically giving all your information to a vpn provider). Furthermore if you want anonymity, you could also get Orbot.
[Security Discussion] iunlock:
I use Orbot with my VPN. But, it's slow and inconvenient most of the time.

There are VPN providers who are serious about privacy, off shore, and are liked by many hard core security activists.... This is why one should not use a lot of the ones they advertise and glorify as being the best LOL... we have to see past that, especially if they are in the US... for anyone serious about security, an offshore VPN is a must...without one you're data is exposed. There's no way around it.

Along with everything in the OP, I couldn't see it any other way, but to make sure that your data is tunneled as well.
[Security Discussion] Celestial Fury:
Or you could just start a thread and tell everything you know and we can ask questions in that thread.
[Security Discussion] Tjee:
I've never understood the use of a vpn in a democratic state, aside from trying to get to blocked content. What kind of activity do you want to hide here? That you visit porn sites every 3 hours?
[Security Discussion] Tjee:
Hey don't get me wrong, I'd love to see the VPN topic too, it's interesting reading material. But I'm still convinced a vpn is meant for anonymity, not security. Just like Tor, albeit safer.
[Security Discussion] sancho_panzer:
Not unusual at all, when I need to fix my car I'll give it to a mechanic, not a guy I don't know and who thinks he knows about what he's doing.

You write to much, you aren't coherent on many theories, you criticise and reject valid opinions, you claim your knowledge and in the end I didn't see a single line supported by YOUR expertise. All I'm seeing here is a test and trial thread where you're asking some few "supporters" to delete files you claim to be "evil" and change some build.prop or init.d lines.

I've got nothing against you or your thread, could be useful if you really know what you're talking about, but supporting your theories on all those devs you've mentioned on the OP is wrong for one simple reason, each one of them are really true devs which I'm following for quite some time and not a single one are radical as you. Making a blend from expert codes developed for particular purposes don't makes you a guru and can even be worse for our systems stability and security.

That said your worst claim till now was: "Don't think that installing a custom ROM like AOSP or CM would be any better than your stock ROM privacy wise, custom ROMs don't have OEM bloatware but when it comes to privacy, data mining and outrageous system apps' permissions they are exactly the same than stock ROMs.". What a stupid thing to be said and disrespectful attitude for all the people that made their magic to bring us awesome ROMs and apps when you didn't even know a universe besides Symbian monopoly.

Lastly, the lack of respect you show about CyanogenMod and Steve Kondik only proves you're not qualified enough to talk about it (next time post some impartial links, not the haters stuff) and your little history knowledge isn't enough to make you grateful.

Now go ask for a mod to delete this post, where I wasn't disrespectful to you, where I didn't called you charlatan or anything offensive. All I'm saying here is you didn't prove anything yet to give you the right to trash years of free, joyful, well done and trustful efforts from thousands of competent devs.

And yes, as you've said "showing off my background and my pedigree could improve this thread". Enough said.