[Security Discussion] dedetok:
Ops, blocking via /system/etc/hosts did very effective. I still got the "malware" dropped in my device with name "App UI" (Screen shoot)

The easiest way is to use NoRoot Firewall created by Grey Shirts.

In Home Screen there is option to checked "Auto start on boot"

You need to enable VPN, NoRoot Firewall will create local VPN on your phone to filter any application connected to internet.

in Apps, you need to set which application allow or not to connect to internet

For my device I blocked (sign with red X)

1. 360 security

2. Aging Test, Android SYstem, BT Tool,......

3. Anti-Theft

4. CaptivePortalLogin

5. com.mediatek.ims, ....

6. ConfigCenter

7. ConfigUpdater

8. Initiator

9. Intent Filter Verification Service

10. Market Feedback Agent

11. Power Master

12. System

13. System-UI

14. Work profile setup

May be the list is to much.... LOL.... but you won't get "App UI" dropped into your phone anymore....

The other way is to use /system/bin/iptables......

These are backgroud connections capture in NoRoot Firewall by Grey Shirts

Anti Theft

ip 36.110.234.87 port 80 whois: CHINANET-BJ 36.110.0.0 - 36.110.255.255 CIDR 36.110.0.0/16

ip 104.192.109.67 port 5227 whois: CHINANET-LAX-IDC-2014 104.192.108.0 - 104.192.111.255 CIDR 104.192.108.0/22

ip 211.151.195.194 port 80 whois: CHINA-21VIANET 211.151.0.0 - 211.151.255.255 CIDR 211.151.0.0/16

com.android.sc

ip 47.90.110.234 port 80 whois: AL-3 47.88.0.0 - 47.91.255.255 CIDR 47.88.0.0/14

ip 104.192.110.206 port 80 whois: CHINANET-LAX-IDC-2014 104.192.108.0 - 104.192.111.255 CIDR 104.192.108.0/22

ip 104.192.110.243 port 80 whois: CHINANET-LAX-IDC-2014 104.192.108.0 - 104.192.111.255 CIDR 104.192.108.0/22

ip 124.156.123.59 port 443 whois: ACEVILLEPTELTD-SG 124.156.96.0 - 124.156.191.255 CIDR 124.156.96.0/19 124.156.128.0/18

ip 180.163.251.181 port 80 whois:CHINANET-SH 180.160.0.0 - 180.175.255.255 CIDR 180.160.0.0/12

Config Center

ip 104.182.110.205 port 443 whois: SIS-80-7-29-2014 104.176.0.0 - 104.191.255.255 CIDR 104.176.0.0/12

Initiator

ip 101.198.192.187 port 80 whois: QIHOO 101.198.196.0 - 101.198.199.255 CIDR 101.198.196.0/22

ip 101.198.192.189 port 80 whois: QIHOO 101.198.196.0 - 101.198.199.255 CIDR 101.198.196.0/22

Create script s50_iptables.sh

#!/bin/sh

echo "Inserting iptables"

if [ "$(/system/bin/iptables -S INPUT | grep -ce '36.110.0.0/16 -j DROP')" != 0 ]

then

echo "Skiped 36.110.0.0/16 -j DROP"

else

/system/bin/iptables -I INPUT -s 36.110.0.0/16 -j DROP

echo "Added 36.110.0.0/16 -j DROP"

fi

if [ "$(/system/bin/iptables -S INPUT | grep -ce '104.192.108.0/22 -j DROP')" != 0 ]

then

echo "Skiped 104.192.108.0/22 -j DROP"

else

/system/bin/iptables -I INPUT -s 104.192.108.0/22 -j DROP

echo "Added 104.192.108.0/22 -j DROP"

fi

if [ "$(/system/bin/iptables -S INPUT | grep -ce '211.151.0.0/16 -j DROP')" != 0 ]

then

echo "Skiped 211.151.0.0/16 -j DROP"

else

/system/bin/iptables -I INPUT -s 211.151.0.0/16 -j DROP

echo "Added 211.151.0.0/16 -j DROP"

fi

if [ "$(/system/bin/iptables -S INPUT | grep -ce '47.88.0.0/14 -j DROP')" != 0 ]

then

echo "Skiped 47.88.0.0/14 -j DROP"

else

/system/bin/iptables -I INPUT -s 47.88.0.0/14 -j DROP

echo "Added 47.88.0.0/14 -j DROP"

fi

if [ "$(/system/bin/iptables -S INPUT | grep -ce '124.156.96.0/19 -j DROP')" != 0 ]

then

echo "Skiped 124.156.96.0/19 -j DROP"

else

/system/bin/iptables -I INPUT -s 124.156.96.0/19 -j DROP

echo "Added 124.156.96.0/19 -j DROP"

fi

if [ "$(/system/bin/iptables -S INPUT | grep -ce '124.156.128.0/18 -j DROP')" != 0 ]

then

echo "Skiped 124.156.128.0/18 -j DROP"

else

/system/bin/iptables -I INPUT -s 124.156.128.0/18 -j DROP

echo "Added 124.156.128.0/18 -j DROP"

fi

if [ "$(/system/bin/iptables -S INPUT | grep -ce '180.160.0.0/12 -j DROP')" != 0 ]

then

echo "Skiped 180.160.0.0/12 -j DROP"

else

/system/bin/iptables -I INPUT -s 180.160.0.0/12 -j DROP

echo "Added 180.160.0.0/12 -j DROP"

fi

if [ "$(/system/bin/iptables -S INPUT | grep -ce '104.176.0.0/12 -j DROP')" != 0 ]

then

echo "Skiped 104.176.0.0/12 -j DROP"

else

/system/bin/iptables -I INPUT -s 104.176.0.0/12 -j DROP

echo "Added 104.176.0.0/12 -j DROP"

fi

if [ "$(/system/bin/iptables -S INPUT | grep -ce '101.198.196.0/22 -j DROP')" != 0 ]

then

echo "Skiped 101.198.196.0/22 -j DROP"

else

/system/bin/iptables -I INPUT -s 101.198.196.0/22 -j DROP

echo "Added 101.198.196.0/22 -j DROP"

fi

echo "Done"

To run the script, open Termux and run mtk-su to gain root

Download the script

# wget http://garasiku.my.id/folder/s50_iptables.sh.txt

Rename and change permission

# mv ./s50_iptables.sh.txt ./s50_iptables.sh

# chmod 744 ./s50_iptables.sh

Run it

# ./s50_iptables.sh

To check it run

# /system/bin/iptables-save | grep INPUT

Or

# /system/bin/iptables -S INPUT

Known Problem: After restarting or boot the device, the firewall rules will be flush! In the future, I will fix to to put it in /system/etc/init and run it when the device finish booting.

To run on ADB, replace #!/bin/sh to #!/system/bin/sh.

Credit:

MTK-SU by Diplomatic

NoRoot Firewall by Grey Shirts

Application Inspector by UBQSoft

I put my work on garasiku.my.id