yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy A32 5G] DrRoxxo:
Hey all, Update.

I just got off the phone with a Cisco certified level 2 tech from my provider, T-mobile. They verified what was going on was indeed a sophisticated attack. The database_uuid files point to not just stealing data, but logging all activities. They are attempting a honeypot on the back end to attempt to catch the individual. They have begun monitoring the network for suspicious activity (for whatever it's worth). The technician verified that this sounds like a remote code execution taking place at the text entry field of "setup a new account" after factory reset.

Edit one of the fixes provided was a full Reroute. Data now comes as if I'm in a different location. I don't know how much of a difference it'll make but to note some of the oddities I've faced:

When browsing a random word, results display fine. When browsing search terms related to my issues, I get a "malicious traffic has been detected on this network" error from Chrome, brave, and Firefox. Clearing data on those browsers sometimes works to resolve it, other times it persists.

When attempting to stream a searched title in any streaming service, the title fails to play, yet when choosing a random stream it plays fine.

When attempting to play any chosen online game, I get internet errors; the hotspot shows internet but no connectivity. When choosing a random game, it plays fine.

When signing up for Facebook, even with a newly created email for this purpose, I get a text verification code immediately from what seems to be official FB shortcode but appended at the bottom of the text is a signature: Laz.nx.carlw

Searching this signature shows hundreds of other users whose accounts where pwnd by the same method.

Since the issue seems to be at the account creation screen after a factory reset, I've tried creating new Google accounts to setup the device with, however almost immediately, passwords are changed.

APN settings where grayed out and as a T-MOBILE customer using a strictly tmobile device purchased and provided by the provider, there is yet, a com.vzw.apnlib package or service, running in the background. Attempting to locate this service or package in every manner fails.

Banking apps have had passwords changed and purchases have been "denied by card", an error of which I've never seen before.

Amazon orders have been "canceled by the buyer" with no input or action on my end relentlessly.

While on VPN, windscribe and Lion vpn, the same happens. It rarely happens without vpn on, but does still occur. I would assume this is to encourage unencrypted traffic that has already been had due to the exploite.

I am aware that windscribe was recently exploited and pwnd. However, it doesn't seem to make a difference because the activity I'm witnessing seems to be that of a dirt box.

Could anybody weigh in on a potential fix or solution?
[Samsung Galaxy A32 5G] DrRoxxo:
New update all.

So after calling again to the provider I was told that there was no way for them to monitor everything on the backend and potentially catch them. The rep I spoke to this time assured me he'd been working tech support for the provider 12 years and they've never been capable of doing so.

He also informed me that as far as getting support from the provider, the best they are going to be able to do even in level 2 tech support is verify whether the device is receiving a proper connection from the tower, and if it is and the issue still persists basic troubleshooting (which I've already done ten fold) would be the next course of action. He informed me that had those troubleshooting options not worked the next usual step taken would be to advise to speak with the manufacturer as they would have the ability to remote in and or replace the device in the event of a failure to fix the issue. However, as explained to the rep at the provider, I've already had replacements sent to me. This issue has persisted through 3 provider changes, 4 new cell phones, and multiple network changes in new Sim, new number, data rerouting etc.

My last call with the manufacture resulted in a Cisco certified level 2 remoting into the device with smart tutor and his entire fix applied was a mere opening of my Eset security app and a scan initialized. And suggesting I purchase premium eset.

That was the course of the whole fix provided by the manufacturer prior to a replacement being provided.
[Samsung Galaxy A32 5G] financeledger:
Sounds like a StingRay IMSI
[Samsung Galaxy A32 5G] financeledger:
APN settings where grayed out and as a T-MOBILE customer using a strictly tmobile device purchased and provided by the provider, there is yet, a com.vzw.apnlib package or service, running in the background.

This is normal.

Banking apps have had passwords changed and purchases have been "denied by card", an error of which I've never seen before.

Amazon orders have been "canceled by the buyer" with no input or action on my end relentlessly.

Probably because orders where placed whilst running ****ty VPN.

have you flashed Stock firmware tru Odin ?
[Samsung Galaxy A32 5G] financeledger:
Is the hidden "database_uuid" supposed to be there?

Yes its part of android system.

? Is this just a new function of the file system I am unaware of?

Probably, Android 11 has big changes and so will Android 12
[Samsung Galaxy A32 5G] DrRoxxo:
I did try flashing through odin 😀 luckily all went well, however the flaw and some of the suspicious activity continued. I managed to flash stock on 3 of the 4 phones affected and it persisted sadly. However, u are correct about the VPN, turns out, windscribe had recently been exploited.
[Samsung Galaxy A32 5G] DrRoxxo:
I am certainly not trying to be argumentative but I did want to note for the sake of those that may have the same concern, my provider and a few level 2 tech support individuals where able to confirm the database_uuid files are not supposed to be there and are evidence of logging activity.
[Samsung Galaxy A32 5G] DrRoxxo:
I would have to agree. However a stingray would only route traffic through their IMSI catcher. Like a false tower. It's surely a possibility, but it wouldn't account for the suspicious behavior consistent with that of pta malware. This truly seems like a custom exploit someone created. It certainly isn't a Metasploit module.
[Samsung Galaxy A32 5G] blackhawk:
You are loading infected firmware, sotfware, files, or compromised accounts. That's all there is.

Regardless I highly suspect the root cause is staring at you in the mirror.

In over 10 years of operating Androids most of the time with outdated OS's and security patches, I never did a forced factory reset due to malware.

There was one reset years ago that may have be malware but never comfirmed... it was an old load anyway.

My advice, don't drink and nicotine helps. There's no bottom to the rabbit hole.
[Samsung Galaxy A32 5G] DrRoxxo:
I don't have an alcohol problem, I've been doing malware removal on a novice level for 7 years, usually via CMD or other manual means. I have been learning the ropes and taken the courses. I am not being paranoid here. I have folks that also work in the cybersecurity field who have confirmed my concerns time and again. I came here, hoping someone had a solution, rather than a boilerplate response.

But all I seem to be finding is folks whom refuse to believe it could be possible

I've had sinespace, Linden Lab, and Facebook security data flow through these devices during contracts.

I'd say that's reason enough for ANY individual to be targeted with a real exploit.

As far as the potential for loading infected onto the devices, it's a Great possibility. Whatever this is, hopped from device to device, destroying TEN computers thus far and FIVE phones. I mean on a level that they can't even have BIOS reflashed and boot clean. They refuse to post now.

Therefore the admin PC I'd normally use, had already been owned. However the only network applicable to provide a fix, is through hotspot, on you guessed it, the infected phones.
[Samsung Galaxy A32 5G] blackhawk:
I listed the possible causes. This isn't rocket science. There's one other, an embedded hardware backdoor... back to those rabbit holes and Alice, huh?

Any device or database I every had an infection issue with I either found/deleted or wipe the whole device. Simple observation, logic and deduction. WYSIWYG... yes, well.

Isolate the cause, delete*.

*zero fill the whole bloody disk if need be.
[Samsung Galaxy A32 5G] DrRoxxo:
This seems to be an embedded flaw and as sad as it makes me to admit, I simply don't have the know how to fix such a problem. I've gone as far as using hirens boot disc to NSA style and low level wipe both the ssd and HD. Sadly, it persisted. So I naturally assumed it was embedded elsewhere. What ended up happening is somehow the exploit or malware ruined my hirens boot disc and enabled a live boot function from a hidden partition it created. (Not the live boot function of hirens, this was something else altogether) When I run a scan with gmer it bluescreens on i/o scan portion. What's bugging me is no matter the solution I've tried, it seems to persist. I've literally nuked it from orbit and somehow, someway, this thing has found a way to survive. The issue I have currently is I can't get all the devices at once. A few of them are now without service and hence I'd have to use one of the infected phones to connect via hotspot. The smart move would likely be to factory restore all devices and keep them airgapped until the network has been sorted out as well. Thus far I've managed to repair one PC at a repair shop and keep it offline.

Thanks for your advice and time.

Sorry if I seem overly concerned or argumentative on the topic, it's just something I've been dealing with for around 9 months or so. After this long of this kind of activity it's liable to have anyone on edge.

It's like a slap to the face because I consider myself to be the local repair guy but can't repair my own stuff. Just goes to show one can never stop learning in this field.
[Samsung Galaxy A32 5G] blackhawk:
Forget scans except to try to salvage databases.

Full zero fills especially the boot sector. Low level formats on flash devices.

Is it a jpeg with malicious script? I've encountered them on PC and Android. Simply downloading it and opening it... boom.

Some of the worst will not show up on scans or has compromised the antivirus app if on the same device. Cross platform infections are almost unheard of.

Any infected drive can infect the same platform if connected. Use a different platform to conduct scans.

I suppose if the NSA, DOD, Mossad, etc was hating you could have one of their finest package(s) running. Don't forget flashdrives...

Did tainted firmware get flashed to a hdd controller chipset, the PC bios, the router, hell what about the smart devices, the fridge, the car, etc?

I limit the number of smart devices that have internet access for a reason... security.
[Samsung Galaxy A32 5G] DrRoxxo:
I believe at one time I may have made enemies with a few good programmers. (Creative differences) I'll say that much. However on the topic of if anything was flashed, yes at one point my BIOS was flashed by what seemed to be remote payload of some kind. It wasn't malware like, it was too smart. Countering every move. I've seen almost sentient code in sandbox environments back when I'd pick apart malware, but nothing like this. This, is persistent, smart enough to counter any attempt at crippling or removal even on a system level, and further capable of moving itself from sector to sector creating hollow processes and hidden partitions on HD ssd. I will try the fixes mentioned and report back if that's okay.

At this rate I feel like I've scoured the internet for every possible solution and attempted each one to no avail.
[Samsung Galaxy A32 5G] financeledger:
So its infecting your computer or the phone ?
[Samsung Galaxy A32 5G] blackhawk:
At the worst you have a rootkit unless someone had physically access. Regardless the solution is the same.

Change phone number.

No gods at play here, only mere mortals...

Delete google account on the devices.

On a clean device log into your Google account.

Changed the password, use a secure one and write it down.

Have infected devices reflashed or reloaded by a local shop.

Enter the new passworded Google account or create a new one if really paranoid. Monitor it for unauthorized usage. Done.

Your database is another story though and if compromised maybe difficult to clean.

Avoid touching it with a cleaned device for now.

Have a 3rd party IT service scan it and dig through it perhaps. Jpeg can contain malicious scripts so trust nothing on that data base. Keep it (hdds or flash drives) physically and electronically isolated from everything until proven clean!!!

Use only Gmail for emails and download nothing, delete anything suspicious without opening or clicking links.

Secure clean devices by not allowing automatic downloads or installs from unknown sources.

Be careful what you download and police the download folder daily for unknown downloads.

Use Brave browser.

Load only trusted apps. Avoid FB, WhatsApp, LinkedIn, Instagram, and load no similar apps on the devices.

Report breaches to your carrier and police. File a complaint with the FBI. You better be a straight shooter or doing the above will bite you.

Otherwise just change your number and get a rock dumb flip phone... problem solved.
[Samsung Galaxy A32 5G] helena.wilson:
I have read your story, and what strikes me is that you have had several phones infected. You might ask yourself what they have in common (connection to a computer, wifi, same google account, same sim card ) ? Even in case of a StingRay attack, I guess one needs to identify the target unless they decide to infect all phones in the neighborhood (may be you should check whether your neighbors have been also infected)
[Samsung Galaxy A32 5G] :
Everyone thinks being paranoid is too much until the paranoid one turns out to be right.
[Samsung Galaxy A32 5G] xdashailesh:
Hey

Been almost a year... any updates?
[Samsung Galaxy A32 5G] blackhawk:
The OP is living somewhere off the grid, owns a pack mule, is very happy... and under surveillance.
[Samsung Galaxy A32 5G] Fiftyshadesoflight:
View attachment 5671507

Good evening everyone.glad to be here. I have doubts on my iPhone XR security, every time I m having a whatsappp call before the name of caller appear, I see # Whats app call # as u can see on the screenshot attached. I feel like someone hacking me, is that possible on iPhone?
[Samsung Galaxy A32 5G] blackhawk:
Take it to a Samsung Experience center at Best Buy. Have them Dx it and reflash the whole thing if needed. Then watch what you load and download... keep trash social media apps off the phone.
[Samsung Galaxy A32 5G] blackhawk:
iPhones aren't immuned at all to attacks and malware. Factory reset and don't load... What's that app's name? You know.
[Samsung Galaxy A32 5G] Fiftyshadesoflight:
Thank you for helping. This is WhatsApp. I did a factory reset but still having it. I probably gonna flash the phone and reinstall the iOS. Thanks a lot
[Samsung Galaxy A32 5G] Fiftyshadesoflight:
Thanks for the help. I m going to reflash the whole thing as u said and going to reinstall the iOS. Hoping they won’t be ni damages on my datas
[Samsung Galaxy A32 5G] blackhawk:
I know what it is. Keep all social media apps off the phone. This is why...

No sure on that OS if any rootkit can worm its way out of the user partition. In Android 9 and higher that hole was plugged. Depending on that or if you physically lost control of the phone a full reflash may not be needed.
[Samsung Galaxy A32 5G] nwmann:
It is red alpha Chinese hacking group. They use stingrays. The military or at least police seem to be working with them from what I observe. I reported to a massive backdoor and data mining campaign being run on Facebook the group I was in having 40k potential members and their friends and family compromised. I reported to fbi/ic3 and other local agencies as well and not so much as a response. They used usa front companies and played a black Friday sale like they had a server outage but the seemingly constant load bar was due to massive amounts of code loading. One part of the code I suspect uses gallium aluminum arsenide composite leds as a close range high quality scanner of whatever is in front of it. I suspect military because the cars that I have seen at the house attacking me are all grey and similarly I've seen these same cars at locations seeming to be involved in weather manipulation via clouds. I may sound effing crazy but I assure you I only am a little bit and caused by the attackers. They work for red 1 realty which I already suspected and recently read a report about red alpha from mit stating they often use similar tactics and ips. They use front companies and contractors often and it is said their work is crude but effective. I have been harassed in many ways and attacked by ultrasound. If you are familiar with the wide variety of things that can be done with ultrasound you will understand. It's happening seemingly across the country... look at many of the various attacks individuals are doing across the country. They are being driven to insanity. Sometimes they make it sound like like daughters are talking when they are sound asleep. Again I know I sound crazy but I have been looking into various attacks on our country from China and most of the time our government seems complacent or aids them or ignores any report regarding the subject such as Havana syndrome... it is my suspicion it is China at an antipodal location using pressure waves through the earth which take roughly 30 minutes to travel to the other side. They have antipodal presence to 2 of the attacks and the other major one I've read about isn't quite antipodal but could be due to geological deformities. Please beware. Something very fishy is going on. There are either stingrays all over my town or I'm being followed by them. I have logs to prove it. If anyone has any questions hit me up. 5hits getting dense and thick. The harassment has died down for me lately but wouldn't be surprised after this if it's right back to normal.
[Samsung Galaxy A32 5G] nwmann:
Also Samsung has a slew of apps you can't Uninstall or disable permissions for and it's pretty much free reign on your system.
[Samsung Galaxy A32 5G] psklf:
Just google it, https://www.google.com.hk/search?q=.database_uuid

​

What is a DATABASE_UUID file?​

DATABASE_UUID is a hidden file stored in some Android devices' .THUMBNAILS folders. It contains a universally unique identifier (UUID) that Android uses to identify stale thumbnail collections. The UUIDs that DATABASE_UUID files contain are 32 characters long and written in the format 90f51180-158b-11eb-adc1-0242ac120003.
[Samsung Galaxy A32 5G] msashleye728:
Anything to stop that from happening again?
[Samsung Galaxy A32 5G] msashleye728:
I just want to know how to get the list extra crap off my phone and I am very unexpirenced
[Samsung Galaxy A32 5G] Tomatcree:
Dr Roxxo should try an LTE discovery tool with root and pinpoint the cell "tower" to see if it is infected. If you ask that CISCO helper he can tell you if the coordinates to the cell tower are correct.
[Samsung Galaxy A32 5G] Tomatcree:
"I've seen these same cars at locations seeming to be involved in weather manipulation via clouds."

What the actual **** 😂

Im sorry im not making fun of you but what are you saying "weather manipulation"? What metaphor is this? Are you making fun of DR ROxxo?
[Samsung Galaxy A32 5G] blackhawk:
Apparently it would rain whenever said cars were washed. I have the same issue🤣
[Samsung Galaxy A32 5G] Tomatcree:
WTFFF LMFAO 🤣 🤣
[Samsung Galaxy A32 5G] singingsand:
I don't know if I can swallow all that but I do know for a year and a half my files are modified, pictures go blank. I find things such as a name with my name under it listed as "experiment". Its on all 12, jues 12 phones. I was trying to stop it. 3 routers now. My friends think I'm crazy so I stopped talking about it. What is going on?
[Samsung Galaxy A32 5G] blackhawk:
Welcome to XDA

The account(s) are compromised, the master database is "infected" with a scripted file(s), router bios(s) is infected, all the devices have been compromised or a combination of the above.

As soon as a problem presents itself you need to chase it down. If malware is suspected you need to isolate it and erraticate it asap.

Some how you caused this. It could be an install, a downloaded jpeg or png, physical access to the devices to the perp including an infected OTG flashstick, improper configuration(s), lousy password management, nailed by phishing scam or a combination.

So start thinking of when, how, and why this happened. Develope a plan. Take the device to a specialist to evaluate it if you can't work things out. You need to raise your level of wherewithal and above all, NEVER continue to use a compromised device, accounts or database*!

Use NextDNS to weed out blacklisted sites.

*it must be completely purged of the malware files. Some may not show up readily in scans.

If you open it and things go nuts, that's a good indication you found one🤣 You may need to fine tooth comb through all downloaded files. This is one reason why all downloads go into the download folder and no where else until vetted. At the very least open them there first and look for odd behavior in that folder before transferring them.
[Samsung Galaxy A32 5G] niveZz:
these are normal hidden files

i have those too
[Samsung Galaxy A32 5G] singingsand:
It is an ex. He was taking my sim and SD cards checking them out and downloading spyware. Malware explains the majority but not all. I've a new phone he has no access to but my old phones (I just realized malware 2 weeks ago)

Ok. Geek squad it is. Thanks for confirming what I thought and giving ,me a direction to go in. Take care
[Samsung Galaxy A32 5G] blackhawk:
Go to the police detectives, bring the effected devices. This is illegal and maybe be stalking.

Police first.
[Samsung Galaxy A32 5G] RevX155:
I kinda deleted the database_uuid........
[Samsung Galaxy A32 5G] hellproof2024:
I bought a brand new phone from Verizon. Made a new Gmail account when I set it up. Only put the password in 1 time. Didn't even think twice. I now have lost 4 computers and 2 tablets and 5 phones 3tvs. And every device that has Bluetooth. All my apps are developer versions and my phone is running androidx on a vm. I didn't do it... my phone has never been out of my sight and never connected to wifi or Bluetooth. Only plugged in to my charger. This is a real thing... police said until they take money... they can't do anything. Everyone's phones and computers that I know that live around me are all infected. And they think I'm crazy and tell me it is impossible.... you can see in the logs all the stuff they did. Also apps download from play store and then the permissions change. There are 3 or 4 different mdm apps installed. Even if I get my devices reflashed the people around me that think I'm crazy are not even worried about it. They complain about battery draining fast or devices being slow... and I show them the apps and they say it's always been that way... something is happening abs from everything I've found in my searching. It wide spread and they only seen to mess with one or 2 people at a time. Make them feel crazy and everyone around them things the same.... they can keep spreading the virus around to others. It turns Bluetooth and wifi and nfc all on. Turns my Hotspot on used uwb and groupshare air command. Music share. Printer. Uses aura. And also dex. It transfers to android and ios and windows for sure. Killed my ruku tvs and my android TV. Anti virus sometimes tries to alert you but they disable it and the permissions change on that as well.
[Samsung Galaxy A32 5G] blackhawk:
I know a guy that screws up every car he works on, even ones that were running well before he touched them.

Guess what? The cars aren't the problem.