6 ms·

I have a chinese Android phone. Instead of connecting it to the Internet I connected it to my computer over bluetooth and started monitoring the traffic it trie

I have a chinese Android phone. Instead of connecting it to the Internet I connected it to my computer over bluetooth and started monitoring the traffic it tried to send. There were attempts to connect to Google servers and chinese manufacturer's servers. The data sent to China was supposed to contain sensitive information like phone number or SIM card identifier. It also has an auto-update (read: backdoor) feature that cannot be disabled. I ended up making a linux-based whitelist firewall to access the Internet but it is pretty inconvinient because I have to manually enable every new host. And I can use it only at home. As a consumer I am very disappointed and feel being deceived by Google. I know about "you are the product" saying but the smartphone is not free. I bought an expensive (two hundred dollars!) device and I had to spend a lot of my time to be able to control its activity. And of course the advertisement never mentioned that a smartphone is going to spy on me. We need a law against this.

mbgaxyz 10y ago
Are there are any consumer protection laws that would help here, for example, to obtain a full refund if it is proven that a manufacturer and retailer sold you a product full of spyware?
- codedokode 10y ago
  I am not a lawyer. Ususally consumer protection laws protect only from not providing advertised features. There might be something related to privacy laws but I am not sure how they work internationally.
e40 10y ago
As a consumer I am very disappointed and feel being deceived by Google. Why Google and not the maker of the phone? They're the ones that wrote the backdoor that sent stuff to China. You're not suggesting that Google helped with that, are you?
- codedokode 10y ago
  Google could provide easy ways to control Internet traffic and to gain root access. For example, they could grant access to builtin linux iptables which doesn't cost anything to implement. And Google is easier to influence than noname chinese company. Or they could not to sell Android license to companies not repecting consumer's privacy. Even if I got refunded, what would I buy instead? Free market doesn't work here and all major manufacturers have some form of tracking and preinstalled software built in. It looks like the only way is to buy a backdoored proprietary device and replace a ROM (and then solve all kinds of problems with hardware not working properly or battery getting drained).
  - hx87 10y ago
    > Google could provide easy ways to control Internet traffic and to gain root access. For example, they could grant access to builtin linux iptables which doesn't cost anything to implement. And Google is easier to influence than noname chinese company. And the manufacturer could simply unroot the phone and lock its bootloader. At the end of the day it's the phone manufacturer that controls the product, even if Google tries to prohibit such practices in its contracts.
    - codedokode 10y ago
      My phone has an option to unlock a bootloader. But it would take time to find or build a custom ROM and install it and solve all kinds of problems with drivers and hardware. And generally it is pretty decent model. It sends some data home but at least it doesn't have preinstalled adware like another chinese tablet I saw (that displays an ad over browser window and tries to disguise it as a part of a web page).
      - whyagaindavid 10y ago
        Then do not buy such hardware. Do your homework or search or ask xda before buying phone/tablet. Or just get nexus or see copperheadOS
- 10y ago
paradite 10y ago
Where did you buy that phone from and what brand was it? I was under the impression that US does not allow selling of Android phones from most Chinese brands due to the reasons you mentioned, and for those that all allowed, they have strict vetting procedures to prevent phones with such capabilities from reaching the US market?
- dopamean 10y ago
  Have you not heard of OnePlus?
  - paradite 10y ago
    Yes, I know. I mean most brands, notably ZTE and Huawei. I am sure OnePlus is an exception here and does not fall into the category of phones with such capabilities otherwise it would have faced similar destinies as ZTE and Huawei. Anyway, I edited my comment to reflect that.
  - yolesaber 10y ago
    Is OnePlus a good phone? Been wanting an Android phone but can't seem to settle on one
    - redwards510 10y ago
      Yes. I replaced my Nexus6 with a OnePlus3 ($400) because paying the Pixel's price ($950) would have made me feel like a sucker. The screen is excellent, and there is a wide variety of ROMs to choose from.
- codedokode 10y ago
  The manufacturer's name is Shenzhen Huafurui Technology if it tells you anything. The brand name is Cubot. I do not live in US but one can buy such kind of phone on Amazon (if you search manufacturer's name there you can find it is even cheaper now). It is good to hear that in some countries importing such phones is not allowed.
bitmapbrother 10y ago
You feel deceived by Google for buying a cheap Chinese made phone? What other things do you feel deceived by Google? Buying a car from Ford that always breaks down?
- codedokode 10y ago
  Google is developing software for cars so maybe soon it will be inside Ford cars too. Of course with Google Analytics preinstalled.
BEEdwards 10y ago
I'm not sure what device you have, but there is a better than even chance that simply changing your rom will remove the spyware.
- codedokode 10y ago
  I am considering this but is would take time to find and configure all necessary drivers and build the ROM.
hackuser 10y ago
> Instead of connecting it to the Internet I connected it to my computer over bluetooth and started monitoring the traffic it tried to send How did you set that up? I'd be interested in knowing how to redirect/proxy cellular connections to something local, in a way I could read and monitor the data (is it encrypted?). Based on what you say, maybe you proxied Internet connections through Bluetooth - do you have a way to know whether there was any leakage? For example, I've read, but can't confirm, that Android makes connections during bootup and before any firewall takes affect. > I ended up making a linux-based whitelist firewall to access the Internet but it is pretty inconvinient because I have to manually enable every new host. And I can use it only at home. A VPN with a firewall might be easier.
- jdavis703 10y ago
  I imagine you just turn cellular off and only use Wi-Fi or LTE. A lot of these backdoors are poorly constructed and wouldn't check to see if they're on a cellular connection.
- codedokode 10y ago
  I used Windows laptop with bluetooth and linux machine in VirtualBox (that also provides a virtual internal network). I physically disconnected a laptop from the Internet and used standard Windows "share Internet connection" feature to "share" virtual network via bluetooth. So Windows thought that linux VM is an Internet gateway and provided DHCP service to bluetooth network. The phone connected via bluetooth, got an IP address and all its traffic was redirected to a virtual machine by Windows. Once you get traffic to go to linux machine everything gets easy (if your host OS is linux you could skip some steps and obviously you don't need VirtualBox). I used Wireshark on Windows to check that everythink is set up correctly and to see what kind of requests the phone makes. You can use WiFi instead of bluetooth the same way. You only need to use "hotspot" option and provide DHCP to a phone and set your linux machine as a gateway. Probably you can do that with a router too, for example if you connect its WAN port to your linux machine or set up traffic redirection. On linux I redirected traffic from phone to localhost with ports 53 (DNS), 80/443 (HTTP) and rejected any other traffic (there were some requests to time servers, that were sent by drm component of Android). I also ran a DNS server (dnsmasq) and Squid HTTP proxy that can process redirected traffic (Squid can also generate certificates to decrypt HTTPS traffic which was very useful though it took some time to find correct settings). I set up dnsmasq and squid to serve requests based on white and black lists. After I did some tests I found another, easier way to capture traffic from Android phone. Android has a useful "Always-on VPN" feature that sends all traffic through specified host (and doesn't allow any network access until VPN connection is set up). You only need to set up ipsec on a linux box (I used strongswan). I used "Always-on VPN" feature to redirect traffic to my VPS while using mobile internet connection. > Based on what you say, maybe you proxied Internet connections through Bluetooth - do you have a way to know whether there was any leakage? I physically disconnected a laptop from the Internet and monitored the traffic on a bluetooth interface with Wireshark. The phone did not have a SIM card inside so it could not connect to a mobile network. > For example, I've read, but can't confirm, that Android makes connections during bootup and before any firewall takes affect. This can be detected using my setup. But if software is programmed to send some data only via mobile network and not via WiFi/bluetooth then it is more difficult to detect. You would need to set up a fake BTS (using OpenBTS for example) to capture that traffic. You would need special (not very expensive) SDR hardware in this case. > A VPN with a firewall might be easier. I ended up with the same idea. I even wrote a simple PHP app to manage black and white lists and view logs.
gwu78 10y ago
"And I can use it only at home." In other words you can use it only on a network you control. In other words, at home you can use your own router; you can set the gateway as a computer that you control. Correct? What if you had a portable gateway, one that could travel with you? We now have Apple devices, Google/Android devices, Microsoft devices, and the majority of apps all phoning home. It is routine. No one cares. Right. We may not be able to run the latest device purchased from major retail sources using open source, user-installed OS (UNIX). But what we can do with UNIX is build our own routers from inexpensive hardware, including older hardware, and use these as our gateways. To do this, no one needs Apple, Google or Microsoft's assistance. We have what we need. It is easy to do at home, but what I would like to see is more travel-sized routers which can be driven by user chosen and user installed bootloader and user chosen UNIX-like kernel. The aim with these efforts is control, not impressive hardware specs. Proprietary hardware and locked bootloaders will always have the most impressive hardware specs on their side. But to get those things, the user has to sacrafice some control.
- codedokode 10y ago
  > In other words, at home you can use your own router; you can set the gateway as a computer that you control. Yes. > What if you had a portable gateway, one that could travel with you? I can rent a VPS and connect through it using "Always-on VPN" option (I did it once and it worked). But then I have to pay for a server monthly in addition to the mobile plan. It is not that expensive but I would prefer just having access to iptables and being able to install my firewall on a phone. I might be wrong but on Windows you can at least install a firewall. At least you could on earlier versions.
  - joshumax 10y ago
    > I can rent a VPS and connect through it using "Always-on VPN" option... Still though, you have to worry that the hosting provider is taking adequate measures to protect your data, as well as also not secretly spying on you. I've worked with enough hosting sysops making trivial errors with their OVZ/KVM setups to realize that some VPS providers are about as secure and resilient as a power grid made from discarded toasters with forks shoved in them.

mbgaxyz 10y ago

Are there are any consumer protection laws that would help here, for example, to obtain a full refund if it is proven that a manufacturer and retailer sold you a product full of spyware?

codedokode 10y ago
I am not a lawyer. Ususally consumer protection laws protect only from not providing advertised features. There might be something related to privacy laws but I am not sure how they work internationally.

e40 10y ago

As a consumer I am very disappointed and feel being deceived by Google. Why Google and not the maker of the phone? They're the ones that wrote the backdoor that sent stuff to China. You're not suggesting that Google helped with that, are you?

codedokode 10y ago
Google could provide easy ways to control Internet traffic and to gain root access. For example, they could grant access to builtin linux iptables which doesn't cost anything to implement. And Google is easier to influence than noname chinese company. Or they could not to sell Android license to companies not repecting consumer's privacy. Even if I got refunded, what would I buy instead? Free market doesn't work here and all major manufacturers have some form of tracking and preinstalled software built in. It looks like the only way is to buy a backdoored proprietary device and replace a ROM (and then solve all kinds of problems with hardware not working properly or battery getting drained).
- hx87 10y ago
  > Google could provide easy ways to control Internet traffic and to gain root access. For example, they could grant access to builtin linux iptables which doesn't cost anything to implement. And Google is easier to influence than noname chinese company. And the manufacturer could simply unroot the phone and lock its bootloader. At the end of the day it's the phone manufacturer that controls the product, even if Google tries to prohibit such practices in its contracts.
  - codedokode 10y ago
    My phone has an option to unlock a bootloader. But it would take time to find or build a custom ROM and install it and solve all kinds of problems with drivers and hardware. And generally it is pretty decent model. It sends some data home but at least it doesn't have preinstalled adware like another chinese tablet I saw (that displays an ad over browser window and tries to disguise it as a part of a web page).
    - whyagaindavid 10y ago
      Then do not buy such hardware. Do your homework or search or ask xda before buying phone/tablet. Or just get nexus or see copperheadOS
10y ago

paradite 10y ago

Where did you buy that phone from and what brand was it? I was under the impression that US does not allow selling of Android phones from most Chinese brands due to the reasons you mentioned, and for those that all allowed, they have strict vetting procedures to prevent phones with such capabilities from reaching the US market?

dopamean 10y ago
Have you not heard of OnePlus?
- paradite 10y ago
  Yes, I know. I mean most brands, notably ZTE and Huawei. I am sure OnePlus is an exception here and does not fall into the category of phones with such capabilities otherwise it would have faced similar destinies as ZTE and Huawei. Anyway, I edited my comment to reflect that.
- yolesaber 10y ago
  Is OnePlus a good phone? Been wanting an Android phone but can't seem to settle on one
  - redwards510 10y ago
    Yes. I replaced my Nexus6 with a OnePlus3 ($400) because paying the Pixel's price ($950) would have made me feel like a sucker. The screen is excellent, and there is a wide variety of ROMs to choose from.
codedokode 10y ago
The manufacturer's name is Shenzhen Huafurui Technology if it tells you anything. The brand name is Cubot. I do not live in US but one can buy such kind of phone on Amazon (if you search manufacturer's name there you can find it is even cheaper now). It is good to hear that in some countries importing such phones is not allowed.

bitmapbrother 10y ago

You feel deceived by Google for buying a cheap Chinese made phone? What other things do you feel deceived by Google? Buying a car from Ford that always breaks down?

codedokode 10y ago
Google is developing software for cars so maybe soon it will be inside Ford cars too. Of course with Google Analytics preinstalled.

BEEdwards 10y ago

I'm not sure what device you have, but there is a better than even chance that simply changing your rom will remove the spyware.

codedokode 10y ago
I am considering this but is would take time to find and configure all necessary drivers and build the ROM.

hackuser 10y ago

> Instead of connecting it to the Internet I connected it to my computer over bluetooth and started monitoring the traffic it tried to send How did you set that up? I'd be interested in knowing how to redirect/proxy cellular connections to something local, in a way I could read and monitor the data (is it encrypted?). Based on what you say, maybe you proxied Internet connections through Bluetooth - do you have a way to know whether there was any leakage? For example, I've read, but can't confirm, that Android makes connections during bootup and before any firewall takes affect. > I ended up making a linux-based whitelist firewall to access the Internet but it is pretty inconvinient because I have to manually enable every new host. And I can use it only at home. A VPN with a firewall might be easier.

jdavis703 10y ago
I imagine you just turn cellular off and only use Wi-Fi or LTE. A lot of these backdoors are poorly constructed and wouldn't check to see if they're on a cellular connection.
codedokode 10y ago
I used Windows laptop with bluetooth and linux machine in VirtualBox (that also provides a virtual internal network). I physically disconnected a laptop from the Internet and used standard Windows "share Internet connection" feature to "share" virtual network via bluetooth. So Windows thought that linux VM is an Internet gateway and provided DHCP service to bluetooth network. The phone connected via bluetooth, got an IP address and all its traffic was redirected to a virtual machine by Windows. Once you get traffic to go to linux machine everything gets easy (if your host OS is linux you could skip some steps and obviously you don't need VirtualBox). I used Wireshark on Windows to check that everythink is set up correctly and to see what kind of requests the phone makes. You can use WiFi instead of bluetooth the same way. You only need to use "hotspot" option and provide DHCP to a phone and set your linux machine as a gateway. Probably you can do that with a router too, for example if you connect its WAN port to your linux machine or set up traffic redirection. On linux I redirected traffic from phone to localhost with ports 53 (DNS), 80/443 (HTTP) and rejected any other traffic (there were some requests to time servers, that were sent by drm component of Android). I also ran a DNS server (dnsmasq) and Squid HTTP proxy that can process redirected traffic (Squid can also generate certificates to decrypt HTTPS traffic which was very useful though it took some time to find correct settings). I set up dnsmasq and squid to serve requests based on white and black lists. After I did some tests I found another, easier way to capture traffic from Android phone. Android has a useful "Always-on VPN" feature that sends all traffic through specified host (and doesn't allow any network access until VPN connection is set up). You only need to set up ipsec on a linux box (I used strongswan). I used "Always-on VPN" feature to redirect traffic to my VPS while using mobile internet connection. > Based on what you say, maybe you proxied Internet connections through Bluetooth - do you have a way to know whether there was any leakage? I physically disconnected a laptop from the Internet and monitored the traffic on a bluetooth interface with Wireshark. The phone did not have a SIM card inside so it could not connect to a mobile network. > For example, I've read, but can't confirm, that Android makes connections during bootup and before any firewall takes affect. This can be detected using my setup. But if software is programmed to send some data only via mobile network and not via WiFi/bluetooth then it is more difficult to detect. You would need to set up a fake BTS (using OpenBTS for example) to capture that traffic. You would need special (not very expensive) SDR hardware in this case. > A VPN with a firewall might be easier. I ended up with the same idea. I even wrote a simple PHP app to manage black and white lists and view logs.

gwu78 10y ago

"And I can use it only at home." In other words you can use it only on a network you control. In other words, at home you can use your own router; you can set the gateway as a computer that you control. Correct? What if you had a portable gateway, one that could travel with you? We now have Apple devices, Google/Android devices, Microsoft devices, and the majority of apps all phoning home. It is routine. No one cares. Right. We may not be able to run the latest device purchased from major retail sources using open source, user-installed OS (UNIX). But what we can do with UNIX is build our own routers from inexpensive hardware, including older hardware, and use these as our gateways. To do this, no one needs Apple, Google or Microsoft's assistance. We have what we need. It is easy to do at home, but what I would like to see is more travel-sized routers which can be driven by user chosen and user installed bootloader and user chosen UNIX-like kernel. The aim with these efforts is control, not impressive hardware specs. Proprietary hardware and locked bootloaders will always have the most impressive hardware specs on their side. But to get those things, the user has to sacrafice some control.

codedokode 10y ago
> In other words, at home you can use your own router; you can set the gateway as a computer that you control. Yes. > What if you had a portable gateway, one that could travel with you? I can rent a VPS and connect through it using "Always-on VPN" option (I did it once and it worked). But then I have to pay for a server monthly in addition to the mobile plan. It is not that expensive but I would prefer just having access to iptables and being able to install my firewall on a phone. I might be wrong but on Windows you can at least install a firewall. At least you could on earlier versions.
- joshumax 10y ago
  > I can rent a VPS and connect through it using "Always-on VPN" option... Still though, you have to worry that the hosting provider is taking adequate measures to protect your data, as well as also not secretly spying on you. I've worked with enough hosting sysops making trivial errors with their OVZ/KVM setups to realize that some VPS providers are about as secure and resilient as a power grid made from discarded toasters with forks shoved in them.