yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] MrT69:
Skygofree - Android infection

I guess you already heard about Skygofree Malware for Android Phones. If not, than I recommend to read this:

https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/

Kaspersky has found a lot of things and I guess we need to say thanks to them.

In addition I have done a research also on all the entire Domains and IP Address. Unfortunatly I was able only to get the last 14 Day's on 4 Servers. I try to get the rest of all Domains until tomorrow evening.

You should urgently update your HOSTS Files because it seems they have forgotten a view URL's. Based on the IP Addresses below I have seen this Domains:

The 127.0.0.1 Edition is HERE

The keweon Edition is HERE

I also recommend to block this IP Addresses on your device:

184.168.221[.]12
184.168.221[.]13
184.168.221[.]21
184.168.221[.]23
184.168.221[.]61
217.194.13[.]133
217.194.3[.]186
50.63.202[.]31
50.63.202[.]4
50.63.202[.]56
52.88.53[.]237
54.67.109[.]199
79.62.228[.]134
80.21.172[.]8

Is it really only Android the only one which is affected?

They are talking about that this kind of Spyware/Malware is active since 2014. If you take a look at the 80.21.172[.]8 IP Address you will see that this server is the "Core Receiver Server". If you take a look where the server is located you will get this informations:

This Server/IP Address belongs to:

If you take a look at the AppStore of Apple you will find this:

It's up to you to decide! I hope Apple will take a deeper investigation on all the entire Apps of them. Let's cross the fingers... And I hope that someone will call Apple to do this because I guess they don't listen to me :D

Please keep in mind that this was only a 4 hours work from me. During the weekend I have had a hard Mindcraft Training session with my girly daughter. It was really not possible to do this earlyer.

All the entire blacklisted Domains are active blocked from tomorrow morning 04:00 GMT +1.

Don't ask for copyright and permissions if you want to share this file. Do it!!. At the moment I can't provide all informations of all domains because more is at the moment not possible. My System and my budget is to small for this.

.
[Android Software/Hacking General [Developers Only]] MrT69:
XING has pushed a update during this night and since the Update the App is not longer working with keweonDNS.

Now it's working again because it was a XING problem.

EDIT:

It wasn't me :D
[Android Software/Hacking General [Developers Only]] problemathic:
bro host file?

---------- Post added at 07:46 PM ---------- Previous post was at 07:41 PM ----------

host file for the keweon certificate bro :/
[Android Software/Hacking General [Developers Only]] MrT69:
Sometimes I need to accept the reality.

If I would have the infrastructure of my choice than I would be able to push updates like this within every 5 minutes without interuption.

But right now it's not possible. That's the problem! ;)

All domains are already processed with keweonDNS.
[Android Software/Hacking General [Developers Only]] Cookie Ninja:
This app is meant for people who are rational, who would like to question and analyse as to what are they paying (up front or hidden deep) for using an app / device / ecosystem, which says "free to use". OTOH, sheeple (obvious analogy), don't matter, coz they are incapable of rational thought....
[Android Software/Hacking General [Developers Only]] surya790:
Calls people sheeple, calls a DNS service an "app".
[Android Software/Hacking General [Developers Only]] O l l i X:
If you think your privacy is irrelevant to you. Then give me a copy of your house key, and send me your login and password for your different accounts. Facebook, XDA and so on.. Ohh, and don't worry, I won't use any of it against you! (unless I can profit of it, and I can!)

If you don't want privacy, why do you close and lock your door and windows when you leave your home..? Why do you shut the curtains closed at night, wear clothes and use your phone in public without the loudspeaker enabled, so anyone can listen to your conversation? Why close the door in the public bathroom, when you need to sink the titanic?!

I mean if you got nothing to hide, you have nothing to fear, right!??

Best regards, göbbels!
[Android Software/Hacking General [Developers Only]] MrT69:
If someone think "I have no problems if they have my data" then I would ask just one question:

Would you give me your credit card including the confirmation PIN?

I don't ask in addition about your Driving License Number or Passport Number, Banking Account, Mail address or your private Address. This would include your Passwords because you have

nothing

you want to hide.

May be also your phone address book might be interesting and of cause the pictures of all the girls but I'm fine if you grant me full access to your Mobile or Tablet then I can search by myself.

If you have an online access to your passport authority and I will have to access to this I can wipe out your life because this data are essential. Try to get a replacement for a driving license or a passport without any authentication. You will have no luck to get this. I have tried this here in Germany. Without your data you can get nothing. Job, House, Money, Banking account - things which are essential for survive.

It might be the next example is now an extreme example but it's a fact. If you have a Family no one needs to send a killer to wipe out everything. Just delete the Data from this persons and it's done. Much more easier and cheaper.

Your Data is your Life. Do you really think there is seriously nothing you want to keep private?
[Android Software/Hacking General [Developers Only]] MrT69:
WORD DOCUMENT VIRUS

DO NOT OPEN DOC FILES FROM YOUR MAILBOX​

Current Virus Infection of RECHNUNG or INVOICE DOC file was already protected via keweonDNS "before" the big outbreak. I have checked a few minutes ago all the containing domains because I have received also this Virus.

The containing IP Addresses are listed within the report below and I strongly recommend to block:

178.134.123.218 (JSC Silknet)

129.89.34.249 (University of Wisconsin - Milwaukee)

This finally mean - my Algorythm is working!! And this shows things can be prevented BEFORE they happens.

Ah sorry... I have forgotten this words from my Investors: "There is no need and no market for this"

But without all the users of keweonDNS this thing would never has been possible.

Million times thanks a lot to each one of you!!!​

Here are a few links about the DOC File:

https://www.vmray.com/analyses/f8de8e542f9d/report/behavior_grouped.html

Full Analysis:

https://www.vmray.com/analyses/f8de8e542f9d/report/overview.html

Function Log:

https://www.vmray.com/analyses/f8de8e542f9d/logs/flog.txt

STIX/CybOX:

https://www.vmray.com/analyses/f8de8e542f9d/logs/stix-report.xml

Summary JSON:

https://www.vmray.com/analyses/f8de8e542f9d/logs/summary.json

Hybrid Analysis:

https://www.hybrid-analysis.com/sam...44fa94a92aa5a0160162c797b175b57fcbfaf402d275b

https://www.hybrid-analysis.com/sam...175b57fcbfaf402d275b/5bfc4c357ca3e16a7a6b8026
[Android Software/Hacking General [Developers Only]] AntonVermeulen:
Well done Torsten. I.hate.ads. I love Keweon
[Android Software/Hacking General [Developers Only]] Timmmmaaahh!:
I'm not saying you're wrong but I'd like to note that I download Linux distros via torrents to lower the load on free distribution of them. Also, just because some site is illegal doesn't make it insecure. Many torrent/pr0n websites use clever clickbait tactics and even more trackers to gain profit but this is no larger threat compared to renown news websites and privacy hell holes like Facebook.

That is actually very much on topic! That's just it, huge companies are not just interested in data; they want to know everything about you so they can get all this data. Sure, it's not likely that a person will open up your data sheet but it is possible and it shouldn't be. I'm running a website myself and I can follow my visitors everywhere. If they contacted me once via the embedded form, a cookie is placed on their computer that remembers their e-mail address and other information; which allows me to personally identify visitors. Even if they visit weeks after contacting me, I can follow their every move and even reach out to them via chat. Cross referencing this with live Analytics; I can even determine their gender, approximate age, location, IP address and more. And we all know what we can do with IP addresses. It gets scary fast when you really dig into it.

I'm actually reading a book on the topic called "You do have something to hide" (Dutch: "Je hebt wél iets te verbergen" by Maurits Martijn & Dimitri Tokmetzis). When someone tells you "I have nothing to hide", a clever reply can be "well okay then, take off all your clothes". It may be funny but it's true, you have more to hide than you realise.

The real problem lies in what we can't see what happens with our data. Incentives like the GDPR are a step in the right direction but it only protects us on a fine visible layer. Underneath that layer you are still very much being abused as a product. Don't assume that this happens in a legal and/or moral manner. Even your government and any store you're a customer at doesn't really know what data is being collected and where it's being shipped off to. There are companies you haven't even heard of that make millions dealing with our data. Try asking any company what data they have on you, how they collected it and who they're sharing it with and they will all fail to give you a (complete) reply.

With projects like keweon, we can take some of that data protection back into our own hands. Imagine you're in a clothing store and a worker there asks about your sexual preferences, ethnic background, religion, etc. Then the worker tells you your measurements, preferences and the time you've spent in the store will be shared with their partners. You would deny all that, right? Well, using keweon is a big "NO" to practices like that. It's an opportunity to get off the grid while still staying on it. So yeah, it's most definitely worth it.
[Android Software/Hacking General [Developers Only]] surya790:
Thanks for the excellent reply!!!
[Android Software/Hacking General [Developers Only]] demonoidmaster:
*redacted nvm*
[Android Software/Hacking General [Developers Only]] MrT69:
keweon Update

If you trust the Certificate and you have installed it then I recommend to use this 2 Servers:

This Servers has special blocklist entires which blocks i.e. graph.facebook.com, pixel.facebook.com, all amazon-adsystem.com domains and all the things which are normaly not possible to block without any impact to Apps, Websites and other things.

Since today I started to add special Domains for YouTube which prevent data transmission to them.

Enjoy it and have fun with this.
[Android Software/Hacking General [Developers Only]] :
Thank you.

Are you able to update the first posts in this thread with this info?

Or do you have all of this information summarized on github or somewhere similar?

XDA makes it somewhat difficult to follow all changes.

I think it would be helpful if you put what permissions to give the certificate somewhere. Unless you already did and I missed it.

The certificate on Android and Chrome OS asks to grant three options: websites, email addresses, and software. I figured that the only access needed is the websites, but I had to research to figure it out.
[Android Software/Hacking General [Developers Only]] MrT69:
I have one more business week and then I'm on holiday until the first week of January.

During my holiday I want to complete rewrite the first postings within XDA and of cause I'm updating them.

More instructions, a few Videos with how to do and so on.

BTW, the certificate is public available. Just go to http://pki.keweon.center and the download will happens automatically.

The Certificate is only for one thing required - JUST FOR WEBSITES. If you keep disable email and software it's an additional security feature for you.

On the other hand is no need for enable Software within the Certificate because there will be NEVER (!) any Software from my side.

That's the reason why you need to setup everything manually. I want to make sure that you know what you are doing there and from my point of view this will finally give more trust into keweon and into the Certificate. Actually it's not mandatory but it's a core invention. Without this keweon would be nothing more then a stupid funny Adblocker but behind this it's much more than this. You only will see the difference just with the Certificate but I want to leave the decision to the users.

I hope that's OK for you ?
[Android Software/Hacking General [Developers Only]] MrT69:
Info:

The Facebook and Messenger App seems not propper working with the "CertDNS Servers".

I have now my own Facebook account to test. Within the Browser it's working but the App causes troubles. That's not a good news but I will take a deeper look at it.

If you need the Facebook App please change the DNS Server.
[Android Software/Hacking General [Developers Only]] :
If us users can be of more assistance to Keweon, please let us know. Personally, I would be willing to help rewrite some of the documentation if you want help.

The certificate and the new servers work wonderfully. I have been able to browse with no blacklists used in Blokada or Ublock Origin and the websites are wonderfully clean and fast loading.

Thanks again for all of your hard work.
[Android Software/Hacking General [Developers Only]] asocialcoder:
Thank you for the great job you are doing
[Android Software/Hacking General [Developers Only]] MrT69:
This would be indeed a big help. I can write real good stories but explain technical things within an easy way this is a nightmare for me.

If you can do this and if you need some additional facts then PM me or ping me at Telegram. I appreciate this offer. Seriously.

I want to say thanks a lot in advance for this offer!!!!
[Android Software/Hacking General [Developers Only]] MrT69:
A good example for "Privacy Protection" which is nothing else then a lie.

Visit the Site:

http://www.cyclingnews.com/news/cavendish-to-have-freedom-to-attack-at-dimension-data/

and you will see at the very first visit they "value your privacy". If you take a look what they do within the background then the word "Privacy" is nothing more than a F-You.

Take a look at the attached picture and this is just ONE example of so many sites.
[Android Software/Hacking General [Developers Only]] Anarconda:
AICP (Android Ice Colde Project) download.

Hi. I'm using this ROM (AICP) in my Nexus 7 (flo) and your magisk module with the DNS changer you recommend. Today (friday) I wanted to update the ROM but was impossible to download anything with the app (AICP Extras) nor access to their website with a browser (Firefox) until I disabled your magisk module.

Am I missing something? Is there some reason to block this address (http://dwnld.aicp-rom.com/)?

Thanks in advance.
[Android Software/Hacking General [Developers Only]] MrT69:
Can you do me a favor and send me the direct link? I can't download this ROM:

http://dwnld.aicp-rom.com/device/mata/WEEKLY/aicp_mata_o-13.1-WEEKLY-20180918.zip

which is "Essential PH-1" ROM. But when I click the HTC ROM it's downloading without problems. Take a look at the left bottom corner.

https://i.imgur.com/AiwTZZt.png

And there you will see that nothing is blocked.

https://i.imgur.com/W0l9kYN.png

Is it on mobile device or on PC? Which Browser you are using? Do you use the Certificate?
[Android Software/Hacking General [Developers Only]] Anarconda:
This link is working in my workstation http://dwnld.aicp-rom.com/device/flo/WEEKLY/aicp_flo_o-13.1-WEEKLY-20181130.zip

The device was a tablet Google Nexus 7 (flo), the browser was Firefox Beta (latest) without certificate and I can NOT even reach the website (blank page)

BUT

after see your screenshot I tried with my phone, with magisk module (no certificate) and is working perfectly (no only showing the webpage but also downloading the file).

Anything I can do to help I'm here.
[Android Software/Hacking General [Developers Only]] MrT69:
For all users of the "CERT DNS SERVER"

(These DNS servers are only 100% reliable if the keweon certificate is installed on the mobile phone / PC)

IPv4: 213.239.207.143 (Hetzner - Germany)

IPv6: 2a01: 4f8: a0: 8487 :: 143 (Hetzner - Germany)

IPv4: 107.191.55.215 (VULTR - USA Dallas)

IPv6: 2001: 19f0: 6401: 175d :: 215 (VULTR - USA Dallas)

Now the Facebook app works on my test server as well as the fb messenger. Something fine tuning and the URL's "pixel.facebook.com" remain blocked on this server.

I appreciate your feedback.

The update will be online and active in about 2 hours.
[Android Software/Hacking General [Developers Only]] Shadow337:
I love Your work,but i have an feedback

After adding your new dns "213.239.207.143" fb is working to load only app, but i cant access to my work group or "comment" section in any post
[Android Software/Hacking General [Developers Only]] MrT69:
I have seen this also this morning. Also on my test server.

graph.facebook.com needs to stay open because this breaks the function to the entire App.

At the moment I'm running Facebook within the Browser and the Messenger App is working. That's what I don't understand.

https://graph.facebook.com/ajax/tracking.php is collecting a lot of informations and it's just one of so many examples.

It's a pain to keep this open but I guess at the end I will have 2 different systems. One for Mobile and one for Desktop PCs.

This Pixel and Graph are connected to so many pages and even within YouTube. Not happy about this but I need to reopen this.

This hurts...
[Android Software/Hacking General [Developers Only]] Shadow337:
If You need any help, just tell
[Android Software/Hacking General [Developers Only]] MrT69:
Need help ;) You have PM
[Android Software/Hacking General [Developers Only]] MrT69:
Today I have had a conversation with a tax consultant about the cowdfunding option here in Germany. Although I have 2 additional meetings with Investors I don't expect any wonder and now I know how to do it.

I guess at end of January or mid february I'm starting a crowdfunding campain. Let's see what will happens.

Think about this, inform your friends. From this point it's up to you to decide what will happens with keweon.

More will comming soon and recommendations about a good Crowdfunding platform is welcome!

Funding goal:

Global:

1. DoT Infrastructure for Android PIE and against Censorship

2. DoH Infrastructure against Censorship

3. DNS Infrastructure for any User without registration or and kind of data collection. Use it an be safe!!!

4. (May be?) Some kind of proxy solution for Websites which do ads and privacy violation by there own. This can't be blocked via DNS. At the moment I know round about 50 to 80 sites which are doing this. Depends on users feedback and it's just an idea.

EMEA:

1. DNS: Base Environment for Business

2. keweon Kidsafe (Public Beta and Release)

What is keweon KidSafe?

keweon KidSafe will become a violence and porn free internet. Of cause, this is not possible without some kind of Proxy based filtering because DNS is very limited within this. This solution is

ONLY

for Kids and Teenagers. The only change you need to do is changing the DNS Server at the end device or add a second WIFI or SOHO Router.

No need for hard instructions to change to a proxy or something like this. Keep in mind that i.e. also on YouTube or Dailymotion you will get very easy this kind of videos. Also this things needs to be removed. And they will be removed.

I'm planing to start the Public Beta with 2 x 10GBit and I already have a offer for a 1.5 TBit (TERA BIT) backend infrastructure which is good enough for EMEA. This can't be released free of charge and I'm planing a price round about 30 to 40 EUR per year. Monthly and yearly subscriptions are possible.

If the Public Beta is done AND there are enough pre-orders outside EMEA it's not a problem to upgrade up to 7.5 TBit connection. To visualize this compare it to the German Datacenter from Hetzner. They have in summary round about 3.6 TBit connection for the entire Datacenter infrastructure.
[Android Software/Hacking General [Developers Only]] totalcmdext:
It is mention for Android PIE (9.0). Do you planning to support other OS?
[Android Software/Hacking General [Developers Only]] MrT69:
Sure, but DoT needs a lot of RAM and CPU because of the encryption.

That's the only problem why I can't do it at the moment.
[Android Software/Hacking General [Developers Only]] MrT69:
keweon Update

The largest update since 2 yrs is now online. I have removed a lot of things and now I hope there are less false positive inside.

Thanks also a lot to ENERGIZED TEAM for this good coopertation. Thanks a lot, Ador!!!

Hope you enjoy this!
[Android Software/Hacking General [Developers Only]] knojap:
Do I have to uses this DNS Adress as first, second or only DNS Config Adress?

What about the other adresses you are given to us?

https://xdaforums.com/android/software-hacking/keweon-privacy-online-security-t3681139#6

Thanks
[Android Software/Hacking General [Developers Only]] marvasten:
I use the cert and I set both as primary and secondary (based on the order list), but instagram is not working [MENTION=304818]MrT69[/MENTION]
[Android Software/Hacking General [Developers Only]] MrT69:
They are located in different location. It's up to you what you want to use. All DNS Server are the same. Except the 2 Server where the Certificate is mandatory. They have harder Blacklists and lots of sites are not working without using the Certifiate.

Hope this helps.
[Android Software/Hacking General [Developers Only]] MrT69:
Will check this... Thanks a lot!!!
[Android Software/Hacking General [Developers Only]] knojap:
So I only have to put in this adress as DNS Server and have to use the certificate and all is working?

What do you mean with only this 2 Servers?

There is 1 IP4 and 1 IP6. These are the two?
[Android Software/Hacking General [Developers Only]] smokeyrider:
Since the latest change to the DNS servers instagram will no longer update. I'm using Australian server as primary and Singapore as secondary set via magisk module. Thanks
[Android Software/Hacking General [Developers Only]] Sk Mohammed Asim:
is it possible to use this app without terminal?? Because I don't know how to use terminal
[Android Software/Hacking General [Developers Only]] smokeyrider:
Sorry after a couple of reboots Instagram now works without problem. Thanks
[Android Software/Hacking General [Developers Only]] GamaShani:
Deleted....
[Android Software/Hacking General [Developers Only]] Edmiri:
Instagram not working.
[Android Software/Hacking General [Developers Only]] Cfibel:
Hey, few apps since last update and some even before update are not working, mostly downloading function.

Microsoft Office - language downloading at the start

XDA Labs - downloading/updating apps

Google Drive - uploading/downloading files

also Instagram as others said before.

Thanks for advance :)
[Android Software/Hacking General [Developers Only]] GamaShani:
After reading, I checked all the issues stated in the posts and all were working fine in my case.. :good:
[Android Software/Hacking General [Developers Only]] Cfibel:
Microsoft Office apps are not working 100%, downloading language at first launch. Maybe others are caused beacuse of bugged downloading in Android.
[Android Software/Hacking General [Developers Only]] GamaShani:
Yup brother, sometime there are some random apps which don't work every now and then..

But kudos to Keweon :good:, it is improving day by day.