yashsingh1/xdaforums huggingface dataset:
[Security Discussion] iunlock:
Hello all...let's keep the fire going in this thread. What's new?
[Security Discussion] unclefab:
There's not much I will add here, I think I put enough infos and when I see how the so called "specialists" ignored this thread I don't feel like putting all my little secrets, I think you understand.

While I'm here I answer the questions you asked last time (sorry for the delay but I don't come here very often anymore):

Use the AF+ built-in iptables, the system iptables leak data.

It doesn't matter.

If you had a backup from some rules you previously made with Droidwall it could save you the hassle to manually configure AF+ the first time you use it, but I have never tried that option.

Enable logs.

If you are on a pre 4.4 rom disable internet via net.d in the DNS Proxy section (from 4.4 you can't since it will most likely prevent all internet connections).

Tick Roaming and VPN control if needed.

Tick IPV6 support (if you phone has IPV6 support).
[Security Discussion] iunlock:
Thanks for the response. I completely understand where you are coming from as I feel the same too. The lack of response from the so called experts just comes to show how rare the ones who truly take this stuff seriously are.

This is such a great thread and I can't believe that it's been so stagnant all this time.

People like you are rare...including myself along with the very few others who have contributed to this thread. What we need is a private forum lol.

Thanks for your input and cheers to taking the time to help folks like me out. I'll PM you...have some interesting things to share.
[Security Discussion] optimumpro:
To keep the fire going

I have recently run a logcat during boot and found a curious output indicating that mobile data is set to route through the following IP address: 26.147.196.122. Interestingly, unlike some other curious IPs (which I posted in this thread earlier), this one is NOT in Android code, which leads me to believe that it comes from the modem. Since modems are proprietary, the only workaround to prevent this evildoing is the following: to create a userinit.sh script and put it in /data/local/ (root required). This directory is read by System on early boot, so no additional enabling is required. The script denies any output to the above IP address.

The file is attached. Unzip and put it into your /data/local/ and set permissions to at least 755. Keep in mind that IP address in your phone may be different, to find out, run adb logcat (enable adb access on the phone first), let the phone boot, disconnect the usb cable and check your terminal output. If the ip address is different, edit the script. Cheers...
[Security Discussion] unclefab:
Nice finding, I ll chek on my phone.

One small thing, I think you should edit the script and put 26.0.0.0/8 instead of 26.147.196.122/30 since the whole 26.0.0.0-26.255.255.255 range belongs to DoD...
[Security Discussion] optimumpro:
That's true, but I have a better solution, which I have already successfully tested. If you are compiling your rom from sources, you can put an entry into init.rc that will run your script as service before init.d or any userinit script. The script should address iptables and iptables6, as opposed to afwall, because the latter is not running yet. So, the script, which you can put in /system/etc/ (not init.d, because it also is not running yet) should drop all connections. That state continues until afwall starts, resets everything and runs its own iptables.

My boot log is clean now, not a mention of any internet connection. Also, I tried to boot with disabled firewall and indeed I have no internet access until afwall is started...

So, a simple entry in init.rc should be like this:

# Deny all input/output during boot

service whatevername /system/etc/whatevername.sh

oneshot

The whatevername.sh should contain something like this:

#!/system/bin/sh

# Necessary at the beginning of each script!

IP6TABLES=/system/bin/ip6tables

IPTABLES=/system/bin/iptables

# Deny all internet connections on boot

$IPTABLES -P INPUT DROP

$IPTABLES -P OUTPUT DROP

$IP6TABLES -P INPUT DROP

$IP6TABLES -P OUTPUT DROP
[Security Discussion] iunlock:
Thank you so much. This is fantastic. Would you be able to create a flashable zip of this for T-Mobile USA? That'd be fantastic.

I really appreciate all your knowledge and input. Great find.
[Security Discussion] optimumpro:
You can't do it on already compiled rom, but you can use the solution in post #234. You have to be rooted, have a file manager that has root access, download the file attached in #234, unzip it and put in your /data/local/ and set permissions as described. Reboot and you should be all set....
[Security Discussion] iunlock:
Thanks! Is there another method to obtain the addresses other than the method mentioned in the earlier post? If so, would you be so kind to share how...
[Security Discussion] optimumpro:
If you are in the US, that's probably it, but you will never know for sure, unless you run adb logcat from your computer. You may have a slightly different address and the solution will not work for you.

Edit: to run adb logcat should be relatively straight forward if you are on Linux (just install adb through your package manager). On Windows, you will need to install some drivers and there are detailed guides on XDA. When you run a logcat, you will have a humongous output on your computer's terminal screen. The trick is to disconnect the phone once it is fully booted, then copy the terminal entries and paste then in a text editor. Then do a search for "route". Any addresses such as 192.168.xxx are fine. They are for your local router. 0.0.0.0 is also fine. Look for "rmnet" near the "route" term: that's your mobile data. This is where you may find the curious address. Especially, if it shows your mobile carrier's IP, then 0.0.0.0, then the culprit address, that's the route through that server, meaning that all your mobile data traffic is routed through that server. If you have no rmnet entries, then you are OK, but you will only have that as an indicator that the solution works (after you put the file in /data/local/. If you see a similar routing next to wlan (which I don't have), that would indicate that your wifi traffic is also routed through some third party server. But because this routing comes from the modem, it is unlikely that you will have wlan involved (provided that Android code has been cleaned, but again, you can't do it on the compiled rom). So, if you see the wifi routing, you will need to edit the userinit script to add the other address...
[Security Discussion] smartymcfly:
I am about through reading all the posts in this thread, and before I forget I wanted to share a couple apps that I use in addition the apps you have listed that I think are helpful.

MyAndroidTools - I can't find a version not on Google play but the developer's email address is wangqi060934@gmail.com if you want to ask him if he will provide a copy, it is a free app so I can't see why not.

This app allows you to go through activities, service, broadcast receiver, and content provider to disable them.

https://play.google.com/store/apps/details?id=cn.wq.myandroidtools&hl=en

And DNSQache which is the only way I can change my DNS without T-Mobile somehow reverting the change and forcing me to use their DNS unless I am connected through a VPN which drains a phone battery quickly.

http://xdaforums.com/showthread.php?t=2575894
[Security Discussion] unclefab:
So why did you mention the data/local solution if this one is better?;)

Anyway, I had never thought about it, because I allways turn off all my connections when I send the phone to sleep, but it's a very good and easy to implement idea.:good:

I don't follow you on that one.

Init.rc is easily accessible on a compiled ROM.

Here's a little how-to for anyone interested:

Extract the boot.img by using the following commands (you can do it directly from your phone if you have an Android Terminal, otherwise you can do it through ADB):

su

dd if=/dev/block/mmcblk0p10 of=/sdcard/boot.img

(this is assuming that your boot.img is in mmcblk0p10. Most likely it isn't so you will have to change 10 with whatever value boot.img has on your phone, check in dev/block/platform/nameofyoursoc/by-name).

Now, a file called boot.img has been created in your sdcard, transfer it to your computer (you can of course change the output location to have it created directly on your computer).

Unpack the boot.img with Linux (or Cygwin if you are on Windows).

In the resulting folder open the ramdisk folder and look for the init.rc.

Edit, repack and flash with the following commands:

su

dd if=/sdcard/boot.img of=/dev/block/mmcblk0p10

(same remark as above about mmcblk0p10).

Done!
[Security Discussion] optimumpro:
It depends on the phone. If you, for example, have Sony starting from 2013 and later, while you can unpack the boot.img and replace already assembled ramdisk, you can't make any changes in whatever is there, because the phone won't boot.

Edit: it has to do with the way cpios are signed. You can replace the whole cpio inside the boot.img, but you can't touch the contents of that cpio. New kernels have it and it is a good security/integrity measure...

The first solution is for someone who does not work with sources and can't change the contents of the ramdisk on already compiled kernel. The second one is for those who compile their own roms...
[Security Discussion] Primokorn:
Quick tip if you need to change your MAC address:

At each boot, thanks to this patch (kernel), Android will use the MAC address mentioned in this file /efs/wifi/.mac.info

If the MAC address is missing or invalid then the factory MAC address will be used

With root access you can create and modify this file. You can use the following command to change it:

# echo -n "00:11:22:33:44:55\n" > /efs/wifi/.mac.info

Convenient tip for WiFi tracking.
[Security Discussion] Cookie Ninja:
The only.light at the end of the tunnel is a freight train barrelling down at you as you.plunge headlong into the android upgrade maze...

That said, I'm actually looking forward to developers taking a step backwards, developing AOSP ROMs for current/futurt devices, based on CM11/CM12. With unlocked bootloader, selinux under control and stagefright patched....

Dead Cookies leave no trails...
[Security Discussion] shojoe:
This is probably one of the greatest threads ever

posted on XDA forums. How do I know this? Because

most of the clueless gui-esthetic rabble seem to

be unaware of it.

Seriously, I love all the NFO that's been gathered here,

esp kudos to the original poster, unclefab.

I was wondering if you could go a bit further for me.

Where are all the locations relating to WiFi located?

I want to clean my phone of all WiFi functionality (its

security related). As was shown with the Bluetooth

removing, how do I do this with WiFi?

Thanks!
[Security Discussion] mulle_87:
a gem

thank you !!!!
[Security Discussion] digitman xxx:
Subscribed!
[Security Discussion] iunlock:
Anyone want to take a crack at post #245?

Powered by: Samsung Octa-Core Exynos
[Security Discussion] iunlock:
Anyone alive?

Keyboard wise, which one would you say is the most secure?

I've been questioning the stock one because I'm not able to control anything like I can with setting the restrictions with other ones with xprivacy.

Is jelly bean keyboard a good one? I've blocked all permissions / restrictions with xprivacy.

Powered by: Samsung Octa-Core Exynos
[Security Discussion] nussbaum:
https://f-droid.org/repository/browse/?fdid=org.pocketworkstation.pckeyboard

Small, full featurered, FOSS, lean permissions.
[Security Discussion] HeathenMan:
Ok guys this is scary. Ive logged in/out dns network activity and found these entrys for the cyanogenmod phone app

These are subdomains from googles 1e100.net domain

Heres what the google support says about

is a Google-owned domain name used to identify the servers in our network.
[...]
to identify our servers across all Google products, rather than use different product domains
[...]
to proactively improve security by protecting against potential threats such as cross-site scripting attacks.

Source:

https://support.google.com/faqs/answer/174717?hl=en

Ive also found these inside the kernel app and some other sytem components- please check yourself with the Network Log app on f-droid.

Maybe i will include all entries inside bphf (hosts file)
[Security Discussion] iunlock:
Wow...crazy stuff...great find..

I'll check it out. Thanks.

Powered by: Octa Core Exynos

---------- Post added at 06:15 AM ---------- Previous post was at 06:15 AM ----------

Thanks. I'll give it a shot.

Powered by: Octa Core Exynos
[Security Discussion] HeathenMan:
ok heres the screen, xda app hadnt attached it for some reason
[Security Discussion] iunlock:
Here's all the permissions the stock Samsung keyboard wants....WTH right?

I converted the stock keyboard from a system app to an user app via Titanium. However, I didn't have any luck trying to restrict anything with xprivacy. ...it wouldn't let me select the boxes....

* I really like the stock keyboard and want to keep using it...but the permissions all tied into the system has me nervous...

Any ideas???

Powered by: Octa Core Exynos
[Security Discussion] HeathenMan:
Ive used pek (privacy enhanced keyboard) for a long time but switched back to system default cause pek had problems on correct copy/paste actions.

Have u tried other firewalls/ permission manager? Im with xprivacy , the cyanogen inbuilt and moboclean .
[Security Discussion] iunlock:
Haven't tried pek yet....I really like the stock keyboard. I had a firewall app, but haven't messed with it much.

Any pointers on how I can use xprivacy to restrict permissions for the stock keyboard?

I've already converted it to an user app and have the secure keyboard module enabled in xposed.

With a 3rd party keyboard app, since we're able to restrict everything via xprivacy, would it be technically safer than the stock built in Samsung keyboard???

Powered by: Octa Core Exynos
[Security Discussion] HeathenMan:
Do you have any results for the 1e100 risk yet?

I dont handle permissions itself, my xprivacy just generates random data and some protection layers. The moboclean thing changed it, seems a lot easier for me to handle nearly 200 apps and maybe the converted one will work.

Isnt xprivacy blocking system apps after the option is set ? If not, an 3rd party would be my choice (as you want stay with xprivacy). The other side of the medal are hidden app rights which can be checked by privacyblocker- i had uploaded some fixed ones at aptoide (heathenmen.aptoide.com) but privacyblockers process is eating time/battery as hell and an update will force the same procedure again.
[Security Discussion] -HamburgerStar-:
Thanks!!
[Security Discussion] HeathenMan:
Host resolve is wanted ;)

Network log is my alternative to blockit for hostname research. All results with statistic / ad or spy-behaviour will get their way into my merged host file project. Thanks for your suggestions
[Security Discussion] digitman xxx:
@unclefab

What about your project UNA ROM for grand 2 7102 running 4.4.2 ? i need it really if it possibl

i am really believe in you and your idea about privacy. so NEVER GIVE UP even no one hearing you are awesome.!

your project UNA ROM was amazing but all about 4.3 not 4.4 as most of grand 2 users.

wish you share the next phone model as um planning to get anew one but still not decided.
[Security Discussion] iunlock:
That's fantastic. Please keep us updated.

Powered by: Octa Core Exynos
[Security Discussion] iunlock:
Security and Privacy wise:

Note 4 (Kitkat 4.4)

+ VPN

+ xprivacy

+ Afwall+

...be the same as...

LG v10 (Lollipop 5.1.1)

+ VPN

+ xprivacy

+ Afwall+

???????????????????????

Note: I'm not looking for, "aluminum tin foil hat," for this set up, which is my second line. Not primary.

I'm just curious, if that's all the level of security / privacy I'm looking for, would both set ups be the same on LP vs KK?

I know LP is a lot more intrusive with all the SELINUX crap etc...that's why I'm asking.

Thanks

Powered by: Octa Core Exynos
[Security Discussion] iunlock:
Update: I had remembered seeing this somewhere..sure enough answer found on post #177. Thanks again Optimumpro.

For Afwall+, which settings should it be set to for both iptables and busybox?

Also are there any other pointers / must do's for Afwall+?

Thanks!

Powered by: Octa Core Exynos
[Security Discussion] falanca:
whoaa thanx, great post
[Security Discussion] Chokinfo:
Thanks for that !!!

Now I andersand better what security means...
[Security Discussion] einitest:
Thanks! Its helpful to me.
[Security Discussion] iunlock:
Please see attached.

Should I be worried about any security concerns? Data leaks? Xprivacy not working properly?

I've went into settings -> security -> phone admin, and checked the box for Xprivacy.

I hope this was the only cause for the pop up and fixed it.
[Security Discussion] HeathenMan:
done including it into latest update ,

or visit the xda thread
[Security Discussion] Primokorn:
This app is getting on my nerves!!! I saw fake comments on a french blog (same IP with glorious comments)... All around the web, we can see spammers like you who promote the app and sponsored articles (AP). That's pathetic and I'll never ever use it.
[Security Discussion] mrrocketdog:
anyone know if this works on all browsers ?

or just try and see ?

great thread. thanks for any input/suggestions.

"all i can really do is stay out of my own way and let the will of heaven be done"
[Security Discussion] onlineemails:
Update your Andoriod to the latest version look out for stage fright

امنیت شبکه
[Security Discussion] Masikj:
Thanks for the time for writing all that !! Its helpful , I hope my phone is more secured now !! :)
[Security Discussion] niubboxp:
I dont understand why an aosp rom as cm isnt safe for privacy, anyone could explain me?

I guessed with an aosp rom and no apps the privacy was secure in android without all this stuff, if i setup for example only firefox to have the internet acces with afwall, other apps and system and even the apps with SU access should be not able to use the network right? or i miss something?
[Security Discussion] zelendel:
Well first off CM is as far from AOSP as Touchwiz or Sense now.

As for secure that all comes down to there really is almost no promise that any of the code has even been looked (well known for CM to merge untested code) at so they could put anything in there. Also alot of the "features" roms use require root which is a security hole.
[Security Discussion] niubboxp:
thank you for the reply i've just now edited my message asking something more

"if i setup for example only firefox to have the internet acces with afwall, other apps and system and even the apps with SU access should be not able to use the network right? or i miss something? "
[Security Discussion] zelendel:
In theory that is the way it would work. But also in theory with root a bad app could bypass it all. There is no complete security to be honest. It is also over played. The average person posts soo much info on social networks that breaking into ones phone is almost pointless. Unless you do something really dumb then you are really at no more risk then someone with a non rooted, OEM device.
[Security Discussion] niubboxp:
so an app with root permission could be able to byepass the firewall? thats mean also the system modules is able to do it too? this is really scary

edit: now i'm also asking to myself wich android rom is safe to be used for a good privacy, i guessed CM was the answer, but i was wrong
[Security Discussion] mrrocketdog:
to my understanding , and i could certainly be wrong ; but the more 'pure' AOSP you can get then the better.

but as i say ; i could be wrong.

[tp_noparse]W2NlbnRlcl1baW1nXWH0dHBzOi8vZGwuZHJvcGJveHVzZXJjb25OZW50LmNvbS91LzlzNjl3OTl3L0ltYWdlcy9TaWduYXR1cmVzL3ZhcmlvdXMvcmRiLmdpZlsvaW1nXVsvY2VudGVyXQ==[/tp_noparse]
[Security Discussion] zelendel:
Depends on what privacy you are talking about. There is a version that removes just about anything Google. The best secure rom to be honest is stock with a locked bootloader and no root. Anything with root "can" be exploited. This is why there are warnings in every thread stating you know what you are doing.
[Security Discussion] HeathenMan:
Yes until we have some kind of sandbox like firejail on linux.
[Security Discussion] niubboxp:
privacy i'm talking about is from system/app spyware, not local hacking, i'd like to use my device securely when i write sms, make a call or browse the web, if u see just normal torch app downloaded in play store ask you a permission to watch what is inside your brain, while for do his job he need nothing.

i'm not 007, but i'd like to "be sure" i have no strange activity on my devices, i'd like to have my personal data just for me, and not hijacked by government, corporation, or CM spyware

i've tryed to achive this using a CM and afwall allowing just firefox to have the internet access through the firewall, and install just few apps, i was guessing i was safe, but i've read somewhere in this forum, CM have some kind of spyware inside and no all open source code

so now what i'd like to really understand is how the iptable works in android, if rooted apps and system can bypass him, should be nice if someone who is able to write a code, will make a try doing an app with root access who send packets somewhere but not allowed to do that with afwall, and see if he can do it or if afwall have "more power" and can block it

i'd like to know if there is some kind of alternatives, i really like to be able to use linux, but we have no linux in mobile devices, except ubuntu phone, but it seems to have same kind of issue, i never tryed myself, but as i saw there is the same permission system as android
[Security Discussion] Primokorn:
You can use Arch Linux but it won't replace Android. But I do recommend you to try Linux on a computer.
[Security Discussion] niubboxp:
I already use linux on my pc, problem is for phone and tablet
[Security Discussion] zelendel:
A root app could get around it. As with Root permissions there is really nothing it cant do. In theory it could just just down the firewall while it ran.

There are a few tut around the site about things like this. I have come to accept one simple truth. They will get some info. What they get is up to me. I dont use my device for any type of banking or anything personal. Just follow a rule of thumb. If you wouldnt put it on FB then dont put it on your phone.
[Security Discussion] optimumpro:
If you make Afwall device administrator, it could be more difficult to shut it down. Also, you can have a script that shuts down the internet when the firewall is off. Or you can have a script run at init.rc level shutting the internet down until AFwall starts. And of course, if you get rid of GAPPS, that would help too...
[Security Discussion] Celestial Fury:
Can you post this script with instructions?
[Security Discussion] optimumpro:
It is in this thread already: http://xdaforums.com/general/security/tuto-how-to-secure-phone-t2960077/post63000225#post63000225

The only thing I would change is this:

# Deny all internet services

exec /system/bin/sh /system/etc/whatever your script name is

This entry should be put in either init.rc or init.qcom.rc in case of Xperia Z1. And of course the script itself should be put in /system/etc/

This script essentially cuts off internet on early boot, before any system app has a chance to connect and before your Afwall runs (AFwall is good, but starts running too late, when all system apps are already active). The internet is off until Afwall starts to run and resets iptables. From that point and on, your firewall is taking care of all internet connections. Also, if afwall is stopped, you go back to square one: no internet.
[Security Discussion] Celestial Fury:
AFWall+ Fix Startup Data Leak option is misleading then? Because it uses init.d? And system apps can run before init.d runs?

init.qcom.rc doesn't exist on my phone. Can I just create it or this only works when the ROM is compiled?