yashsingh1/xdaforums huggingface dataset:
[Nexus One General] P00r:
I do respect apple for bringing some great innovation but I am concerned about the lack of quality coverage I see in some blog and online news paper, I mean nobody seem to have asked proof or a second opinion on quite a few recent post (like the 80% of android user would not buy another one story...)

As for the winner or looser, as long as user win I am fine with this war...
[Nexus One General] britoso:
I saw this and it seems like propaganda....they took all the time to write the article but neglected to mention the application name.
[Nexus One General] P00r:
They did publish the name of the app, In fact a LOT of different one since this is simply a program that download wallpaper from various theme. the guy have flooded the market with all of the different theme he offer.

http://www.androidcentral.com/rogue-android app-stealing-data-according-security-firm#comments

If you look at the update they wrote to change a bit the story of what the application does, the developer seem to be a bit lost about this.

Either way if this app is really a malware then they should have contacted google, and they should have published the EXACT description of what they do, instead they talk about their market analysis ...
[Nexus One General] P00r:
Some fact, about time!

http://blog.mylookout.com/2010/07/mobile-application-analysis-blackhat/#more-1380

Here's the developer answer so android central http://www.scribd.com/mobile/documents/35072457

Now let's see if Google has something to say about this WallPaperGate... in the mean time it look like they SUSPENDED all the developer app

Personally I have no problem with those wallpaper app, I do not use lookout tho since I believe it's asking for too much right and I am not convinced it does something at all
[Nexus One General] adambenjamin:
How about "flickey wallpaper" ? I use that one, and it rhymes with the listed application.
[Nexus One General] P00r:
Hey thanks for pointing this program (flikie) it's great!

The right requested by flikie are quite normal so I installed it, I do not use picture as wallpaper usually but I do like to watch them!

Back to the topics, I think the developpers in general should review their apps and make sure they do not ask for undue right!
[Nexus One General] P00r:
Application to protect yourself

I personally use aSpotCat to screen what the application are using as right on my nexus one, it is free and allow you to revise the right of installed app

If you know of other app that can prevent malware from spreading please post them
[Nexus One General] antikryst:
thats how it is in an open system. some people will exploit it.

thats a trade off of the android market.... we will get spyware eventually.
[Nexus One General] amnigo:
I agree with antikryst... this happens on any platform. Don't look like iPhans and deny the truth and deflect the blame. These guys may or may not have an agenda, but they didn't "seem" to make this stuff up.
[Nexus One General] johnp263:
I call partly BS

The wallpaper apps in question cannot access your contact's phone numbers, SMS messages or personal information.

Check out the manifest permissions on the apps in question. It is the last item that is the problem.

!Storage

modify Delete

!Your location

coarse (network-based) location

!Network communication

full Internet access

!Phone calls

read phone state and identity

The permission only allows the app to read the IMEI number of your phone (your hardware's unique identifying number), your phone number, and your currently programmed voice-mail number. If you hard coded your voice-mail password as part of your voice-mail number, then they have that too.

They shouldn't be stealing this info, and Google should separate "read phone state" from "read identity", but the stories on this app stating that your SMS's and contacts being stolen and sent to China just plain wrong.
[Nexus One General] amnigo:
And, unfortunately, that stemmed from the original article written at VentureBeat being incorrect. The presenters never actually said SMS and browser history were compromised. I know that at least Engadget was contacted and informed that the article at VentureBeat was incorrect, and VentureBeat also corrected their article to indicate that SMSs and browser histories were not being compromised. But at the start, it was too late, and from there, it was a game of telephone.

Here is a blog post by one of the presenters to clarify everything.

http://blog.mylookout.com/2010/07/mobile-application-analysis-blackhat/
[Nexus One General] diversificationied:
What a douche bag. The initial commentary about the apps was essentially "It's stealing you babies and your babie's babie's babies".

But I guess actually telling what the app actually does is a little less exciting than what they did.
[Nexus One Q&A, Help & Troubleshooting] ClanLee:
Running FRF91 on AT&T. Rooted, I forget where I got the files but it was from the HTC site.

I get a random reboot about once or every other day. It continues to reboot until I take the battery out, wait a few seconds and insert it back in.

After taking the battery out, I powered it back on and decided to take a look at the logcat file. I know that I won't see anything regarding the random reboot but I just wanted to know what was going on.

I'm getting these error messages, does anyone know what it means:

Line 427: E/ActivityManager( 87): ANR in com.keramidas.TitaniumBackup

Line 429: E/ActivityManager( 87): Reason: Broadcast of Intent { act=android.intent.action.BOOT_COMPLETED cmp=com.keramidas.TitaniumBackup/.schedules.BootReceiver }

Line 1065: E/ActivityManager( 87): ANR in com.keramidas.TitaniumBackup

Line 1067: E/ActivityManager( 87): Reason: Broadcast of Intent { act=android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE flg=0x10000000 cmp=com.keramidas.TitaniumBackup/.schedules.BootReceiver (has extras) }

Line 1265: E/ActivityManager( 87): ANR in android.process.acore

Line 1267: E/ActivityManager( 87): Reason: Broadcast of Intent { act=android.intent.action.SCREEN_OFF flg=0x40000000 }

I have alot of those E/ errors. Do I have anything to be concerned about?

Thanks.
[Nexus One Q&A, Help & Troubleshooting] disgustip8ted:
Try reinstalling titanium perhaps, or maybe make sure busy box is installed
[Nexus One Q&A, Help & Troubleshooting] ClanLee:
Thanks for the suggestions. I downloaded BusyBox again via Titanium Backup and I no longer get those error messages! :D
[Droid X Android Development] Nickdroid86:
Do you think this will ever get cracked? I'm almost at my 30 trial ending. And if its not looking possible them I would like to exchange for the incredible.
[Droid X Android Development] SteveoSupremo:
I can tell you it isn't going to be hacked in 30 days. The milestone has been out for how long and it still isn't hacked.

You can send me your DX ;)
[Droid X Android Development] Ezun:
Nick - I have both right now trying to decide. Do you have any questions? Happy to help if I can. I started with the inc and now I'm trying the X. I think I'm going to stick with the X

Sent from my DROIDX using Swype and XDA App
[Droid X Android Development] nolsen311:
If you think getting custom ROMs on this phone will be possible before you're of retirement age why don't you ask a Milestone owner how they like CM6?
[Droid X Android Development] oldmacnut:
i was going to till full root/rom's etc befoe i got my x. i am glad i did not. for now i am happy with at least being able

to remove bloat. i am sure the best people are working on it right now. even with being limited to what i can do with this phone, i am happier with it than i was with the dinc.

Sent from my DROIDX using the XDA mobile application powered by Tapatalk
[Droid X Android Development] derekm_:
Crack_DroidX_Bootloader@home

So a lot of people here have programming skills right?

Would it be possible to develop a folding@home type of program (crack_bootloader@home) which could brute force the bootloader encryption? I would GLADLY participate.

I'm sure there are some clues from previous devices or looking at this one which would reduce the amount to look for.

Might be impossible but I wish somebody would do the math on it, with say 1000 computers, how long could it take min/max?

I sent back an HTC Incredible for the X because it's obviously a superior device, but I've been reading through the HTC Incr forums and am questioning my decision to switch. The HTC apps (light, etc), 2.2 already, and no encrypted bootloader bs. I really hope the droid X gets unlocked, and soon. It's like buying a car but they weld the hood shut so you can't mess with the engine then saying, "We do that because you might mess it up" even after you inform them that, "I own it!?!?". There is no legal reason to lock the bootloader, no intellectual property to be given away. And reason #1, it goes against the principals of open source and takes away KEY features of android. Google Android devices potential can only be realized once the developer community tinkers, optimizes, destroys, and reinvents the phone and its contents, this amazing process won't happen with the Motorola Droid X because of its bootloader lock, and that's sad.

My humble opinion: Google (excellent reputation), Motorola (decent reputation), fix this with GOOD press, First page on all android sites shows "uggggg, Motorola locked up their new device". seriously Motorola, you KNEW this was not going to be well received by your customers.

Oh yeah, good news for the Droid X. Saw somewhere where somebody talked to some verizon store staff (reliable source, i know, hah) who said that the X was planned to come with Froyo, but was rushed a month early (because of the HTC Inc delays, which were very real) and forced to throw together 'blur' for 2.1. Whether this is true or not is a toss up, but I sure do hope so. I just don't see why this wasn't publicized. Can't wait for this 2.1 virus to get off my machine (kiddin').

Come to think about it, Motorola's 2.2 might blow our socks off, and could even potentially unlock the damn bootloader, damn I'm tired of saying bootloader.
[Droid X Android Development] Ezun:
I love this idea. Can you start a new thread on it?!
[Droid X Android Development] Meister_Li:
If it was that easy and you'd just have to gather a few PCs together to brute force the encryption, we would have decrypted Playstation 3s and Milestones today. Sadly, it's not that easy if the key is 128 Bit long or so.

And I'm also doubtful that Motorola will just give in. The omission of the WiFi-Teather function in the Droid's Froyo Update as well as the soon-to-be-released Droid 2 that has this feature and the locking of the bootloader on the Milestone with absolute disregard to all people complaining about it - even going so far as to tell them to buy HTC phones - shows that Motorola doesn't even want us "advanced users" as customers.
[Droid X Android Development] jvward:
5 Dollars says HTC starts doing the same sooner or later.
[Droid X Android Development] Meister_Li:
I wouldn't be too surprised if it'd happen, either. Still, they don't use TI-OMAP-Processors with their cool (read: horrible) "High Security" mode. So it'll be a lot harder for them to pull something like this off.
[Droid X Android Development] drew630:
Imo it is more up to the carrier. T mobile seems really lax about rooting and custom roms. While all verizon android phone have been fairly locked down. Except the droid one. But even the eris and incredible by htc were tough to crack.

I think verizon doesn't want people messing up there phones and exchanging them as well as all the bandwith from tethering. They charge 20$ a month the tether so obviously they have an interest in not wanting you to get that functionality for free.
[Droid X Android Development] Meister_Li:
That just begs the question as to why the Milestone is locked down, which isn't even exclusive to any provider as far as I know.

And forcing people to use the free option (root + WiFi-Teather) instead of a payed option (Froyo-Teather) doesn't make sense if they want to gain extra money.
[Droid X Android Development] Big Dawg 23:
htc will not go to lock down. They have been very easing on allowing custom roms.
[Droid X Android Development] randallman:
If I were going to require signatures, I'd go with public/private keys with a far greater length...

I could be talking out my wazoo here because I am not an Android developer, but it would seem to make more sense to use 1024 or 2048bit RSA keys for the signing...

EDIT: Additionally, has Motorola actually encrypted anything, or are they just requiring a valid signature on the software that is to be booted and the public key is used to verify the signature made by the private key?
[Droid X Android Development] mrozzeh:
The keys are almost definitely 2048bit, a 128bit key would be cracked in a matter of hours. I'm going to be getting an X in the mail in a few days, so we'll be taking a look at ways to get around the bootloader signing.
[Droid X Android Development] derekm_:
So we'd need the collective power of every computer on earth for like1000 years?

I have lots of respect for the unrevoked team, please kee us informed and let me know if there's anything i can do to speed this up (i guess we should wait for froyo first)

Ok, i 'think' i've located the eFuse chip, any chance of bricking my phone if i physically remove it? Alright, took the chip out, how do i know if its unlocked?

Excuse my ignorance but is the eFuse thing the source of all these problems or is it unrelated

Also, read something about the new encrypted processors, it said one possible way to crack them could possibly involve heating up the chip hoping to get some useful faults or something to that effect.
[Droid X Android Development] Nickdroid86:
Sounds like a good time let's get all our built computers and have a bbq android meet and crack this thing.
[Droid X Android Development] LexusBrian400:
Have you ever owned an HTC Eris? That thing took over 7 months to crack. The only reason they had root was because a rooted update "leaked" into their hands.

HTC's are already locked down. Pretty damn good.
[Droid X Android Development] Ingvarr:
It seems that a lot of people think that situation with DROID X being locked is somewhat new.

It is, in fact, not.

That is one of the official Motorola rep posts that summarises situation pretty well: http://community.developer.motorola...OMs-and-Motorola-s-Android-Handsets/ba-p/4224

In short - Motorola always dedicated significant time & money investment to signature lock their Linux kernel-based phones. They did it for several years, even before they started producing Android phones (they started using Linux kernel even before that). Since significant investment was spend into that, they will not just "unlock" it any time soon - because the management person who will have to make that decision will essentially have to take responsibility for all previous time & money spent just have to be thrown away. I dont see this realistically happen.

Also people fail to realise that it was DROID that was an exception for being unlocked, not the other way (confirmed by Motorola),- and Motorola will do anything in their power to prevent this exception from happening ever again.

Now about "cracking the bootloader". Recent OMAP platform that Motorola uses implements almost full TPM-hardware security model. It was not designed by stupid people, and, since it's a hardware security, it will have to be cracked on hardware level - unless some stupid vulnerability will be found at the very root of trust chain (and this is very unlikely, since root is hardware-based, and it's security-polished to perfection). Another possible attack is if private key will be stolen/leak somehow - very unlikely (but higher probability then cracking 2048-bit RSA encryption used anyway ;) )

To prevent yourself from suggesting stuff that was long tried before, you really should familiarize yourself with this wiki, mainly dedicated to attempts of bypassing Motorola kernel security - http://and-developers.com/

There is a nicely classified database of attack tried, and why they didn't work.
[Droid X Android Development] mrozzeh:
Bootloader doesn't have to go down for custom roms to be viable. Nice link, but I'm not going to bother. We aren't the type to just throw CVE's at the device until it breaks. Not sure how experienced you are with embedded security, but all it takes is for one chip to turn into a hole. Were also talking about bootstrappers that haven't been rewritten in 5 or 6 years. Nobodys calling Motorola stupid; its the lazy programmers that cause the device to break.
[Droid X Android Development] derekm_:
That's a great website.

So... that tells me that the original motorola droid was a fluke and that they actively try to lock down all their devices. As does htc, but their key was leaked (?).

Now, because obviously very skilled programmers are already working on the problem i guess there's nothing motorola customers can do except put eXtream pressure on this company to release the key. I signed the petition online and would like EVERYBODY to participate by calling them and actively wasting 500x as much of their time as they've wasted of ours messing with this stupid bootloader encryption crap. Open source does no good if you can't change and reinstall the software.

Hmmm tomorrow im going to ask for the top technician available ($100/h) and demand to know why i can't install android on their android compatible device. Dear all corporations, you waste my time and resources for no good reason, then avoid giving a decent response and i will personally ensure that your time and resources are wasted. And as for anyone coming to me for.recommendations for a android phone, my response is 'dont get a motorola'. I hope to reduce your customers motorola. I despise motorola for their misguided attempts to lock down my phone. Could have been a legendary device, now im holding a $600 piece of sh!t locked motorola droid x.

Hah, do your thing unrevoked team. This could be bigger than the revolutionary war. If I worked at a defense base I would probably accidentally nuke motorola.
[Droid X Android Development] Ingvarr:
AFAIK HTC does not use same kind of hardware-based security model that Motorola does.

Sadly, publicity attacks/petitions were tried on Motorola since their first Linux-based phone was released several years ago. Motorola simply ignores them (or dismisses them for being "a minority"), and keeps their stance - and now they have additional argument that it didn't affect their sales over couple of years so why bother.

It also sickens me how they exploit the GPL license so they insist they obey the *letter* of it. But you can just see that they are not obeying the spirit. What's use in being able to compile the kernel when you are not even able to verify that it will run on your device correctly? In fact there is no real way even to verify that Motorola posts proper kernel sources for locked phones.

Also there is unresolved matter of "GPL installation scripts" which potential case against any TiVO-ized device, but nobody tested this in court yet. And unless somebody actually brings Motorola in court over that I doubt anything will change any time soon.

It's true, you dont need to break bootchain security for any custom ROM. But you need it to boot custom kernel. And custom ROMs without custom kernel are much more limited.

You need to break root of trust, because it's where security start (e.g. it's useless to try to crack the bootloader, because hardware will simply not run it without correct RSA signature). Don't underestimate quality of Moto's bootloaders - they aren't made by Moto in the first place, but by OMAP who made the whole secure OMAP platform (and they did put effort into making it secure).
[Droid X Android Development] derekm_:
This thread has been very informative for me, I appreciate the discussion.

One question about the kernel, you say that a custom ROM is not as good without a custom kernel, why? Seems to me like the kernel only changes hardware support, ohhhhhh..... so..... would the CPU clock changer app work?
[Droid X Android Development] Meister_Li:
It probably would work, if they left the kernel's ability to load modules intact. You can look into what the Milestone can do to see what you can expect with a locked bootloader.

You can overclock (if they didn't stuff this whole - it took about 5 months after the root that we where able to overclock), you can install custom themes (that took three months) and you can install new Android Versions on it (still working on it)

The thing is just: Getting for example Android 2.2 to run on an 2.1 Kernel is very complicated, unstable and lacks support for features as well as kernel-specific optimizations. Just look into the Milstone-Development forum over here. There is a 2.2 "Rom" cooking there, but it's increadibly buggy, unstable and lacks support for camera functions and the notification-LED. While at the same time, the unlocked Droid enjoys a stable and fast running updated Froyo Rom.
[Droid X Android Development] Ingvarr:
I said that inability to change kernel limits customizing.

If you don't change too much, than you are ok by changing only userspace files/settings.

But, say, you want to do major Android version upgrade (like from 2.1 to 2.2). You will find that many changes in userspace depend on specific kernel changes. Briefly, it's hard to make libraries from 2.2 to work with kernel from 2.1 (because libraries will want some changes introduced in more recent kernel).
[Droid X Android Development] Ezun:
This thread has been extremely informative for me as well, and it makes me want to help in any way I possibly can. Unfortunately I'm not a true developer so my knowledge ends after reading what others have done.

Please let me know if there is another way to help.

A few questions:

1) How do we support the developers to make sure they continue to work on the Droid X? Given all the detail here I would think they might turn their efforts towards newer devices that are less complicated.

2) Given this note:

Once we have the 2.2 OTA on our phones then we should be able to leverage that kernel. So the questions are:

Can we then remove Blur to have a fully stock 2.2?

Could we load a ported Sense UI?

I guess in a nutshell, what are the limitations?
[Droid X Android Development] Meister_Li:
It should be possible, with a little work, to remove the Blur-UI and go back to stock (I don't have a DroidX but as far as I know, it's mostly just the launcher anyway, right? Maybe you just want to check out ADW Launcher or Launcher Pro from the Market and see if you like them more)

As for SenseUI, that'll be a huge lot more difficult because HTC does not just put their UI "ontop" of stock android. They have modifications in the modules, the kernels and the whole system. There is a thread about porting the Sense UI to the Milestone, and it works even worse than Android 2.2
[Droid X Android Development] Ezun:
Meister_Li - Thank you for being so helpful and responsive. Your knowledge has been very helpful in understanding this much better.

Clearly I have very limited knowledge on any of this. So, how/where can we help?
[Droid X Android Development] derekm_:
I second the notion to try LauncherPro. It is the single greatest app I've found for my android device (other than the google built ones). If I could buy their stock I would.

On a random side note, has anybody used that Google App Inventor? I signed up for the beta months ago (I even have a kickass email address) and still have not received any kind of invite. :( Come to think about it, the last beta test invite I received was for Neosaurs from MS, FML.

@Ezun: Simple folk like me and you probably can't do much other than donate a few bucks or a phone. Seems to me like most hardcore programming is done alone, quietly, and with great frustration. But for these guys, how rewarding must it be to crack a bulletproof phone and help tens of thousands of paying customers/fans enjoy their device to it's fullest. Then again, there are the unfortunate dummies who didn't follow the steps right, well, they're out $600 and will never say the word root again.