[Security Discussion] unclefab:
(Continued From Last Post)

- Fifth

Open Blue Box Security scanner and let it scan for vulerabilities.

Most likely it will find some, patch them with Master Key and Fake ID Fix:

http://repo.xposed.info/module/tungstwenty.xposed.masterkeydualfix

http://repo.xposed.info/module/tungstwenty.xposed.fakeidfix

- Sixth

Get init.d support.

Make a script to disable some folders that are otherwise recreated each time the phone boots.

I give you the following as an example that works on Samsung 4.2.2 but you may have to edit it depending which phone you have and which ROM version you are on:

#!/system/bin/sh

rm -r /data/anr/*

rm -r /data/backup/*

rm -r /data/clipboard/*

rm -r /data/connectivity/*

rm -r /data/local/tmp/*

rm -r /data/log/*

rm -r /data/system/container/*

rm -r /data/system/dropbox/*

rm -r /data/system/netstats/*

rm -r /data/system/shared_prefs/*

rm -r /data/system/usagestats/*

rm -r /data/system/throttle/*

rm -r /data/tombstones/*

if [ -e dev/log ] ; then rm -r dev/log ; fi

busybox chmod 000 /data/anr/

busybox chmod 000 /data/log/

busybox chmod 000 /data/system/dropbox/

busybox chmod 000 /data/system/throttle/

busybox chmod 000 /data/system/usagestats/

busybox chmod 000 /data/tombstones/

If you decide to use this script paste it in a good editor like Note Pad Plus. Then edit it if needed and don't forget to set the EOL conversion (found in the edit menu on the toolbar) to Unix/OSX format.

You want to do it directly from your phone?

Try 920 Text Editor app, it does the job fine (when you save a file set "Convert Line Break" to Unix/Android) :

http://920-text-editor.en.uptodown.com/android

Here's another init.d script, done with Pimp My Rom app (credits [MENTION=4752917]Androguide.fr[/MENTION]), to protect your phone from various MIM (Man In The Middle) attacks :

#!/system/bin/sh

### Pimp my Rom : Block Redirects

busybox sysctl -e -w net.ipv4.conf.all.accept_redirects=0; ###ICMP broadcast

busybox sysctl -e -w net.ipv4.conf.default.accept_redirects=0;

busybox sysctl -e -w net.ipv4.conf.all.secure_redirects=0;

busybox sysctl -e -w net.ipv4.conf.default.secure_redirects=0;

### Pimp my Rom : Block Source-Routing

busybox sysctl -e -w net.ipv4.conf.default.accept_source_route=0; ### ICMP redirects

busybox sysctl -e -w net.ipv4.conf.all.accept_source_route=0;

### Pimp my Rom : IPv4 Tweaks

busybox sysctl -e -w net.ipv4.tcp_timestamps=0;

busybox sysctl -e -w net.ipv4.tcp_sack=1;

busybox sysctl -e -w net.ipv4.tcp_fack=1;

busybox sysctl -e -w net.ipv4.tcp_congestion_control=cubic;

busybox sysctl -e -w net.ipv4.tcp_window_scaling=1;

### Pimp my Rom : Avoid Time-Wait

busybox sysctl -e -w net.ipv4.tcp_tw_recycle=1;

busybox sysctl -e -w net.ipv4.tcp_tw_reuse=1;

### Pimp my Rom : Protection against SYN Attacks

busybox sysctl -e -w net.ipv4.tcp_syncookies=1;

busybox sysctl -e -w net.ipv4.conf.all.rp_filter=1; ###Forwarding traffic

busybox sysctl -e -w net.ipv4.conf.default.rp_filter=1;

busybox sysctl -e -w net.ipv4.tcp_synack_retries=2;

busybox sysctl -e -w net.ipv4.tcp_syn_retries=2;

busybox sysctl -e -w net.ipv4.tcp_max_tw_buckets=16384;

busybox sysctl -e -w net.ipv4.icmp_echo_ignore_all=1;

###Turn on protection for bad icmp error messages

busybox sysctl -e -w net.ipv4.icmp_ignore_bogus_error_responses=1;

busybox sysctl -e -w net.ipv4.tcp_max_syn_backlog=1024;

busybox sysctl -e -w net.ipv4.tcp_no_metrics_save=1;

busybox sysctl -e -w net.ipv4.tcp_fin_timeout=15;

busybox sysctl -e -w net.ipv4.tcp_keepalive_intvl=30;

busybox sysctl -e -w net.ipv4.tcp_keepalive_probes=5;

busybox sysctl -e -w net.ipv4.tcp_keepalive_time=1800;

busybox sysctl -e -w net.ipv4.ip_forward=0;

One more (credits [MENTION=4013522]bazz7[/MENTION]7 – http://xdaforums.com/showthread.php?p=40767777#post40767777 , do visit the thread as you will find infos about how to harden your system) :

###Avoid a smurf attack

sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1;

###ICMP redirects ipv4

busybox sysctl -e -w net.ipv6.conf.all.accept_redirects=0;

###ICMP redirects ipv6

busybox sysctl -e -w net.ipv4.conf.all.send_redirects=0;

### ICMP redirects

busybox sysctl -e -w net.ipv4.conf.all.forwarding=0;

###Forwarding traffic

busybox sysctl -e -w net.ipv4.conf.all.log_martians=1;

###filter martians

busybox sysctl -e -w net.ipv4.tcp_max_syn_backlog=1280;

###TCP syn half-opened

sysctl -w net.ipv4.ip_forward=0;

###Tune IPv6 and disable lol

busybox sysctl -e -w net.ipv6.conf.default.router_solicitations=0;

busybox sysctl -e -w net.ipv6.conf.default.accept_ra_rtr_pref=0;

busybox sysctl -e -w net.ipv6.conf.default.accept_ra_pinfo=0;

busybox sysctl -e -w net.ipv6.conf.default.accept_ra_defrtr=0;

busybox sysctl -e -w net.ipv6.conf.default.autoconf=0;

busybox sysctl -e -w net.ipv6.conf.default.dad_transmits=0;

busybox sysctl -e -w net.ipv6.conf.default.max_addresses=1;

busybox sysctl -e -w net.ipv6.conf.all.disable_ipv6=1;

busybox sysctl -e -w net.ipv6.conf.default.disable_ipv6=1;

busybox sysctl -e -w net.ipv6.conf.lo.disable_ipv6=1;

### Don't act as a router

busybox sysctl -e -w net.ipv4.conf.all.send_redirects=0;

busybox sysctl -e -w net.ipv4.conf.default.send_redirects=0;

- Seventh

Open AF+ and set it for WIFI, data, VPN and roaming.

I think using white list option (allow selected) is better than black list since newly installed apps are blocked by default.

Restrict all apps, including system apps, that don't need to have internet access, and restrict Linux kernel, Linux shell, Internet time servers, DHCP+DNS services, GPS and Media server.

Enable IPV6 support.

Now, make a script to block inbound and outbound unwanted connections, call it whatever you want (but don't forget to end it with the .sh extension, and to give it RWX, RX, RX (755) permissions), and put it in data/local or in data/data/dev.ukanth.ufirewall/app_bin.

Here's an example of such script :

# Necessary at the beginning of each script!

IP6TABLES=/system/bin/ip6tables

IPTABLES=/system/bin/iptables

## Force DNS (in this Case [OpenDNS](http://www.opendns.com/))

$IPTABLES -t nat -D OUTPUT -p tcp --dport 53 -j DNAT --to-destination 208.67.222.222:53 || true

$IPTABLES -t nat -D OUTPUT -p udp --dport 53 -j DNAT --to-destination 208.67.222.222:53 || true

$IPTABLES -t nat -I OUTPUT -p tcp --dport 53 -j DNAT --to-destination 208.67.222.222:53

$IPTABLES -t nat -I OUTPUT -p udp --dport 53 -j DNAT --to-destination 208.67.222.222:53

# Deny IPv6 only connections

$IP6TABLES -P INPUT DROP

$IP6TABLES -P OUTPUT DROP

#

# Google

$IPTABLES -A "afwall" --destination "8.8.8.8/32" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "8.8.4.4/32" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "64.233.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "66.102.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "66.249.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "72.14.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "74.125.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "173.194.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "209.85.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "216.239.0.0/16" -j "afwall-reject" || exit

#

# Others

$IPTABLES -A "afwall" --destination "23.4.92.33/32" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "23.32.0.0/11" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "23.64.0.0/14" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "23.253.56.120/32" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "64.207.128.0/18" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "68.232.32.0/20" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "91.103.140.0/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "104.16.0.0/12" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "104.64.0.0/10" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "116.214.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "118.214.0.0/16" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "198.232.125.88/32" -j "afwall-reject" || exit

#

# Turla

$IPTABLES -A "afwall" --destination "80.248.65.183/32" -j "afwall-reject" || exit

#

# Google

$IPTABLES -I INPUT -s 8.8.8.8/32 -j DROP || exit

$IPTABLES -I INPUT -s 8.8.4.4/32 -j DROP || exit

$IPTABLES -I INPUT -s 64.233.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 66.102.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 66.249.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 72.14.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 74.125.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 173.194.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 209.85.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 216.239.0.0/16 -j DROP || exit

#

# Others

$IPTABLES -I INPUT -s 23.4.92.33/32 -j DROP || exit

$IPTABLES -I INPUT -s 23.32.0.0/11 -j DROP || exit

$IPTABLES -I INPUT -s 23.64.0.0/14 -j DROP || exit

$IPTABLES -I INPUT -s 23.253.56.120/32 -j DROP || exit

$IPTABLES -I INPUT -s 64.207.128.0/18 -j DROP || exit

$IPTABLES -I INPUT -s 68.232.32.0/20 -j DROP || exit

$IPTABLES -I INPUT -s 91.103.140.0/24 -j DROP || exit

$IPTABLES -I INPUT -s 104.16.0.0/12 -j DROP || exit

$IPTABLES -I INPUT -s 104.64.0.0/10 -j DROP || exit

$IPTABLES -I INPUT -s 116.214.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 118.214.0.0/16 -j DROP || exit

$IPTABLES -I INPUT -s 198.232.125.88/32 -j DROP || exit

#

# Turla

$IPTABLES -I INPUT -s 80.248.65.183/32 -j DROP || exit

If you decide to use this script paste it in a good editor like Note Pad Plus. Then add you own values and don't forget to set the EOL conversion (found in the edit menu on the toolbar) to Unix/OSX format.

If you want to do it directly from your device look back at part six, I've put a link to a Text Editor app.

Bear in mind that by using it you will prevent google from accessing your phone, so google related web sites (youtube, blogspot, google search, play store etc.) won't work anymore.

Now it's up to you, if you want google access you'll have to erase the lines under #google (both inbound and outbound).

If you want to check where an IP adress belongs go to :

http://whois.domaintools.com/ (I like this one the most cuz it shows you the IP range to block)

http://www.hcidata.info/host2ip.htm

Want more?

Check here (credits [MENTION=3249429]ukanth[/MENTION] and [MENTION=4415879]CHEF-KOCH[/MENTION] ) :

https://github.com/ukanth/afwall/wiki/CustomScripts

.

While you're at it change the DNS in the system/etc/resolv.config file to Open DNS or whatever you wish (if you don't use Open DNS then edit the beginning of this script accordingly), and do the same for system/etc/dhcpd/dhcpd-hooks/20-dns.conf.

Note to Kit Kat users, credits [MENTION=4958579]Primokorn[/MENTION] :

On Nexus 5 - Kitkat 4.4.4 - I do not have the first file (resolv.config). At the end, I downloaded an app called DNS forwarder by Evan He (read the description for more details especially the information for KitKat users).

OpenDNS has been successfully tested through this URL: https://store.opendns.com/settings/

To check whether you are using Open DNS or not you'll have to enable cookies.

If you still see unwanted connections despite the Firewall check posts #71 and #72, big thanks to [MENTION=5075064]optimumpro[/MENTION] for the tip!

To stop the DNS resolve of, and HTTP request to clients3.google.com on every connection to any Wifi Access Point open your android terminal and type :

su -c "settings put global captive_portal_server 127.0.0.1"

su -c "settings put global captive_portal_detection_enabled 0"

To stop the resolve/request for 2.android.pool.ntp.org on every boot (even with network time disabled) type :

su -c "settings put global ntp_server 127.0.0.1"

(credits https://blog.torproject.org/)

- Eighth

Install a good host file in system/etc, it will block adds and unwanted web sites.

Check this link about MoaAB (Mother of All Ad Blocking), credits to [MENTION=4877037]BSDgeek_Jake[/MENTION] :

http://xdaforums.com/showthread.php?t=1916098

You can add the following web adresses to whatever host file you decide to use, I have hand picked them one by one (but as above, don't forget to set the EOL conversion to Unix/OSX format):

127.0.0.1 localhost

::1 localhost

127.0.0.1 apis.google.com

127.0.0.1 ajax.googleapis.com

127.0.0.1 www.googletagservices.com
127.0.0.1...51-0-107.deploy.static.akamaitechnologies.com

127.0.0.1 a23-51-0-107.deploy.static.akamaitechnologies.com

127.0.0.1 pa-in-f109.1e100.net

127.0.0.1 pd-in-f109.1e100.net

127.0.0.1 sin04s02-in-f30.1e100.net

127.0.0.1 sin04s01-in-f30.1e100.net

127.0.0.1 sin01s14-in-f30.1e100.net

127.0.0.1 sin01s14-in-f1.1e100.net

127.0.0.1 sa-in-f95.1e100.net

127.0.0.1 2.android.pool.ntp.org

127.0.0.1 174.37.231.83-static.reverse.softlayer.com

127.0.0.1 208.43.122.142-static.reverse.softlayer.com

127.0.0.1 50.22.240.168-static.reverse.softlayer.com

127.0.0.1 108.168.180.116-static.reverse.softlayer.com

127.0.0.1 mqtt-shv-10-frc1.facebook.com

127.0.0.1 mqtt-shv-13-prn1.facebook.com

127.0.0.1 mqtt-shv-08-prn2.facebook.com

127.0.0.1 mqtt-shv-06-frc1.facebook.com

127.0.0.1 mqtt-shv-06-ash2.facebook.com

127.0.0.1 mqtt-shv-04-ash3.facebook.com

127.0.0.1 74-82-89-154.rdns.blackberry.net

127.0.0.1 74-82-91-166.rdns.blackberry.net

127.0.0.1 74-82-93-25.rdns.blackberry.net

127.0.0.1 74-82-93-39.rdns.blackberry.net

127.0.0.1 ec2-54-227-243-121.compute-1.amazonaws.com

127.0.0.1 ec2-54-235-74-151.compute-1.amazonaws.com

127.0.0.1 r-199-59-150-46.twttr.com

127.0.0.1 en.mywebzines.com

127.0.0.1 pnsen.dolphin-browser.com

127.0.0.1 tracken.dolphin-browser.com

127.0.0.1 jekyll.ispgateway.de

127.0.0.1 amazonaws.com

127.0.0.1 ads.yahoo.com

127.0.0.1 geo.query.yahoo.com

127.0.0.1 ucs.query.yahoo.com

If you restrict all those adresses you won't be able to connect to facebook, twitter and any google service (including youtube, blogspot, google search, play store) anymore, so filter first and remove the web sites you want to be able to access.

- Ninth

Open Network Log and connect to the internet.

Check all your connections (long press on an IP to know which web site it refers to, or check with the web sites I mentionned in part 7), some are legit, some are not.

Block the unwanted stuff using either the host file, or the firewall script, or both.

There's an apk called Blockit! that can help you find host names for some stubborn web sites that can't be blocked using their IP, and whose host name can't be found otherwise (like apis.google.com, ajax.googleapis.com, www.googletagservices.com, fonts.googleapis.com, google-public-dns-a.google.com, just to name a few that I found thanks to BlockIt!).

About one year ago I found out that my kernel was connecting to some google related IPs and to google's DNS (eventhough I had set the phone to use Open DNS in the resolv.conf file, eventhough I had removed over 150 system apps and eventhough I was already using AF+Firewall, App Settings and Xprivacy), and that my android system was calling home (read "at google's central office in Mountain View, California") everytime I connected (note that my phone had never been linked to any google account whatsoever).

From that day that I started to gather informations about host files and firewall scripts...

- Tenth

Open SQ Editor, and have a look at your apps' databases.

If you find anythig you dislike, erase it (it's located in data/data/yourappname/databases).

Some files, like google analytics or gaClientid, reappear once the app is reopened again, in this case you have to set their perms to 000 and fully erase their content (like this the files are still there and don't get recreated, but they are inactive).

You may have to suppress the write permissions on the folder that contains those files (use you file manager), ie something like rx, rx, x (5, 5, 1).

Some other potentially unwanted files could be in data/data/yourappname/files or in data/data/yourappname/shared_prefs, if that's the case do as above.

III - ADVANCED​

- I'll deliberately stay vague on those matters, only people that know what they are doing should mess with that kind of stuff. -

1- Decompile some of your system apps and some of your jars, and track lines refering to specific websites and DNS.

For a starter have a look at SecSystem.apk, framework.jar and framework2.jar...

2 - Xprivacy is a fantastic tool, but due to android limitations it can't restrict ids for the android system.

Have tou ever heard of android.id, build.serial, ro.boot.serialno, ro.serialno etc.?

And what about the serial_no and the mac in the efs folder? And the cpu info in proc? And the serial_number in sys?

Those are ids specific to your device and of course they identify you, that's what they are meant for!

An example, have a look at the wpa_supplicant.conf localised in data/misc/wifi. You'll see that it has your serial_number which means, and experts please correct me if I am wrong, that everytime you connect on the WIFI your serial_number gets sent.

You want to change it manually?

Yeah sure, edit it directly from the file. Now start you wifi and check again the serial_number, you are back to the original value.:cyclops:

I'm not sure whether, if your firewall script is well done and if Xprivacy has been well configured (read "VERY restrictively configured"), those ids leaks or not, but since I like to have more than one protection layer I've edited all of them.

Some ids are easily changed using the setprop command (with an android terminal) or the setpropex command (I've attached it at the end of this post, unzip it and depending your configuration put it in system/bin or system/xbin, and chmod it rwx, rx, rx or 7, 5, 5. Credits [MENTION=2526007]goroh_kun[/MENTION] -- http://xdaforums.com/showthread.php?t=1201657 ). Then make an init.d script like:

#!/system/bin/sh

/system/xbin/setpropex ro.boot.serialno 1

/system/xbin/setpropex ro.serialno 1

echo 1 > /sys/devices/virtual/android_usb/android0/iSerial

echo 1 > /sys/devices/cpaccess/cpaccess0/cp_rw

echo 00000001 > /sys/devices/platform/wcnss_wlan.0/serial_number

(the last one will take care of the WIFI's serial_number I spoke about few lines above),

some will require editing in the efs folder (potentially dangerous, so back it up first!), and some will require boot.img tweaks, but I won't explain any further since as written above only people knowing what they do should play with that stuff.

IV – BASEBAND ISOLATION​

That's an important subject and here's an interesting link to start with :

https://blog.torproject.org/blog/mis...ty-and-privacy

You can uninstall STK.apk, LogsProvider.apk, CSC.apk, SecContacts.apk, SecContactsProvider.apk, SecPhone.apk and SecTelephonyProvider.apk altogether, problem solved, your phone isn't a phone anymore (obviously) but a WIFI only device.

Or, you can buy a WIFI only device and save some money compared to a GSM device.

As for me I solved the matter by uninstalling STK.apk, LogsProvider.apk, CSC.apk, SecContacts.apk and SecContactsProvider.apk, and by chmoding SecPhone.apk's and SecTelephonyProvider.apk's permissions to 000 in order to completely disables them (which is not the case when one freeze them, or when one uses the pm command, the apps are ineffective in the way that the user can't use them but they are on nevertheless). Then, I made a chmod 644/000 script to enable/disable them, done!

Of course it's not very practical, and if one only uses one's phone to call one's mum or one's girlfriend/boyfriend there's no need to turn to such extreme safety measures.

But if one lives in a rogue country and if one could be put in danger because of one's phone then it's something that one has to consider.

Otherwise, if you don't want anyone to know that you are using that phone then use a public phone, because whatever we do our provider allways knows who we are calling, for how long etc., everytime we use the phone functions, and AFAIK there's no way to prevent that. Except maybe by using those apps that encrypt communications but I can't comment on that since I don't use my phone to call or to text.

Well, the thing is that if security really matters you shouldn't have a GSM device but a WIFi only device, or a GSM device where STK.apk, LogsProvider.apk, CSC.apk, SecContacts.apk, SecContactsProvider.apk, SecPhone.apk and SecTelephonyProvider.apk have been uninstalled, the above link leading to Tor project's blog explains well why.

One more thing, have you ever heard about IMSI catcher AKA fake cell towers? Here's a very interesting project that deals with it :

http://xdaforums.com/showthread.php?t=1422969

Oh yeah, you may like that one too :

http://www.wired.com/2014/10/verizons-perma-cookie/

ANDROID 5.0 (Lollipop)​

Xposed is not yet compatible with ART, so no Xprivacy and no App Settings.

App Settings can be replaced by Permissions Denied Pro (paid), but make sure it's Lollipop compatible :

https://play.google.com/store/apps/details?id=com.stericson.permissions.donate&hl=en

Sorry for the play store link but that's the only non warez site I found about that app. If you want to purchase it you don't need to go through the play store though, just contact its dev and pay him with Pay Pal :

stericdroid@gmail.com

It's a powerfull app so before to start using it read its FAQ (when in the app swipe to the right until you get to it) and remember that you have to unlock permissions before you flash a new OS. Otherwise you may have a powerful bootloop, it happened to me once and believe me it wasn't funny.

You can use the settings examples I put for App Settings (in the second chapter part 4) since Permissions Denied works more or less the same way.

It's a bit more tricky, if doable at all, to replace Xprivacy. Have a look at Donkey Guard, its dev said that he will make it Cydia substrate compatible but I'm not sure he managed :

http://xdaforums.com/xposed/modules/app-donkeyguard-security-management-t2831556

Alternatively, see if Pdroid is Lollipop compatible but AFAIK it isn't.

As for me I'll stay away from Lollipop, at least for now...

A FEW WORDS ABOUT COMMON SENSE
​

Stick to older Android versions, like 4.1 or 4.2.

From 4.2 google has strengthned its grip on Android, and added some very unpleasant stuff.

In 4.2 it added FusedLocation.apk, to know better where you are, basically a spying app eventhough google calls it an “enhancement”.

That apk can neither be uninstalled nor be frozen (or well, it actually can but then the phone doesn't boot), but fortunately its receivers can be desactivated with Rom Toolbox and it can be greenified.

In Kit Kat it got worse, you will understand by yourself when you start uninstalling system apps and/or when you have a look at what's inside the system folder.

As I already said in the first chapter, you have to ask yourself whether you want to compromise your privacy to get the latest gimmick and the latest fancy color (that have anyway been made available on JB with Xposed modules) or whether you want to be safe.

Forget about Kit Kat, I think the game is worth the candle but it's up to you...

Do not trust too much encryption and do not store sensitive data in your phone. If you have sensitive data keep it on an usb stick, or a hard disk, the idea is to have it on a support that is not web connected.

Do not link your phone with any account, and don't use apps like facebook, twitter etc... Access those web sites from your browser , and greenify your browser once done.

Use Tor to secure your IP, your operator will know that you use Tor but it won't know anything else.

Depending what you do, where you live or travel and who you are you may consider to have two phones, a secured one for your sensitive activities, and an insecure one to call mum.

Do not update your apps blindly, not all updates bring improvements. Sometimes they add more permissions and/or adds, sometimes the app got sold to a company and policies have changed, you see what I mean. So before you update make a backup of the current app's version, in case you want to get back to it later.

CREDITS AND THANKS​

[MENTION=4419114]rovo89[/MENTION] for Xposed, respect!

[MENTION=2799345]M66B[/MENTION] for the Xprivacy, respect!

[MENTION=4322181]Tungstwenty[/MENTION] for App Settings, Master Key Dual Fix, Fake ID Fix, respect!

[MENTION=631273]Chainfire[/MENTION] for Super Su, respect!

[MENTION=3249429]ukanth[/MENTION] for AF+Firewall, respect!

[MENTION=4376588]oasisfeng[/MENTION] for Greenify, respect!

[MENTION=600147]THE[/MENTION] Tor Project Team, respect!

[MENTION=3237562]f-droid[/MENTION], respect!

[MENTION=535343]all[/MENTION] the XDA people writing tutorials and sharing their knowledge, respect!

Did I forget anyone? If that's the case be insured that it was absolutely unintentionnal, send me a PM and I'll fix it;)

Last but not least, all those devs and groups have spent days, if not weeks or even months, coding, writing, tweaking, modding, in a word working, for us to enjoy better security on our devices.

They did it for free, in a materialistic, greedy and selfish world where gratuitousness and altruism are an oddity, so the least we can do is to support them.

Please consider sending them a donation, or buying the pro version/license of their app (s), we are talking about a few dollars which is not much compared to what they have given, are giving, and will give to us.

Remember that we are nothing, or let's say not much, without them!!!

Thanks in advance for them...

LINKS​

http://repo.xposed.info/module/de.robv.android.xposed.installer]

https://github.com/M66B/XPrivacy#xprivacy

https://f-droid.org/repository/browse/

https://github.com/ukanth/afwall

http://xdaforums.com/apps/greenify

https://www.torproject.org/

https://blog.torproject.org/

https://guardianproject.info/

https://prism-break.org/en/

CONCLUSION​

That's all what I can remember for now and that's it, my phone works fine...

An additional plus is that while in standby battery decrease is only 1% every 10-12 hours, it doesn't hurt;)

If all of the above has been done I don't think that anyone can get much data out of your phone, but I'm no security expert and I'd like to hear what the big guys on this forum have to say on that matter....

Feel free to add any settings, tips and tricks you have, thanks in advance:good: