[Q] How to find which app is malware? - Android Q&A, Help & Troubleshooting

One of my gmail accounts sent spam message today. Gmail access log shows me that at the time when spam was sent account was accessed from mobile phone.
Telefon komórkowy[means "mobile phone"] Polska (83.4.246.117) 16:07 (6 godzin temu)
IMAP Polska (83.4.246.117) 16:07 (6 godzin temu)
How can I check which app did it?
Spam message was like this:
Topic: Re:9
Body:
Code:
..This is a solution to all men�s problem like erectile dysfunction
and impotence. <link>
I'm using cyanogenmod on Nexus One.
Edit:
I used lookout and it found nothing.

It doesn't have to be an app (and most likely it's not) which sent it to you. When you check your email on your PC (and I'm sure there are spam messages sometimes), do they usually relate to software installed on your PC? No, most times not at all (if ever).

It wasn't sent to me, it was sent from my gmail account to all my contacts.

This comes in handy for malware scouting and other stuff: lsof !
That's a neat nix tool to map what program is operating which file/pipe/socket.
example
Code:
# lsof -w | grep TCP
dropbear 1676 0 3u IPv6 25400 TCP *:2222 (LISTEN)
dropbear 1683 0 4u IPv6 26210 TCP 192.168.0.242:2222->192.168.0.110:50519 (ESTABLISHED)
dropbear 1728 0 4u IPv6 26574 TCP 192.168.0.242:2222->192.168.0.110:50695 (ESTABLISHED)
^^ my SSHd
you could script it to make it silently monitor all your connections and log information for further analisys. (instead of filtering TCP we could use the gmail server address or the port number) See on the left, there is the app name that uses the resource (a socket in this case). This means possibly that the infected app will need to send emails again
But we don't want our friends be spammed again, so we'll change our gmail password from another computer or phone we believe it's safe (or just download a linux live system and change from there, if we want to be 99% paranoid)
And of course we won't be updating the password on the phone until we catch the evil app. Eventually, it will try again to connect to gmail and send spam, but access will be denied and you will spot what application is trying to access your mailbox.
Happy hunting !!

Related

[Q] Help! Yahoo mail sync bug?

Hey guys,
omni here with what should be a relatively easy question/fix...
There may be a post on this already, but I searched around for a good 10 minutes, and at least I know I'm in the right section (not spamming dev)
I have Yahoo! Mail liked through my MotoBlur Accounts so that it will show emails in my Universal Inbox (standard Messaging app). It works intermittently, and what is really strange is that when it ISN'T working (when it has the orange error/caution symbol over the syncing icon), the stored password under Accounts is randomly modified to a 20-ish character string (my password is much fewer characters). I can go back and change the password while its in the mood not to work, but it never seems to sync. Then I forget about it and it randomly connects later. As you can imagine, this gets quite annoying... I'm running GreyBlur 1.0 and SteelBlue 1.15 (compatible; the problem was happening long before layering this theme). I do move around campus alot, which switches to new wifi networks or to 3.5G.
So to sum up the question: how can I stop MotoBlur's Accounts/Yahoo! Mail from changing my password and losing connectivity (not sure which comes first/causes the other)?
Great thanks to this community's wonderful attitude and android wizardy!
-bump- (oh noes, its happened again!)
Bumpitty bump
Sent from my MB860 using XDA Premium App
Issue Summary
In order to improve security, Yahoo recently disabled non-secure (non-SSL) connections to their IMAP e-mail servers. As a result, customers with devices running the Android operating system may encounter errors when attempting to setup or access their Yahoo e-mail account via the device's native e-mail client.
Customers attempting to setup a Yahoo e-mail account for the first time will receive an authentication failed or similar error when using the automatic setup method (only e-mail address & password are entered).
Customers who previously setup a Yahoo e-mail account may receive an error or be unable to retrieve new e-mail messages.
Critical Must Know/Must Do
New users (or existing user attempting to add a new Yahoo/AT&T account): use the Manual Set up option to enter the required server settings.
Existing users: If their Yahoo/AT&T account stops syncing, direct them to Edit the account settings and enable SSL.
Server/Protocol - IMAP
IMAP/Incoming Server - imap.mail.yahoo.com
Security Type - SSL (or "secure connection" option)
Incoming Port - 993
Outgoing Server - smtp.mail.yahoo.com
Security Type - SSL (or "secure connection" option)
Outgoing Port - 465
To find out how to edit the settings go here:
https://www.wireless.att.com/answer-center/solutionDisplay.jsp?solutionId=KB116471
After following these instructions, hit the thanks button to show some love.
Thanks a hundred times over!

[Q] Password not encrypted

I've asked this on the Google android-platform group but it looks very quiet so I'll ask here (I'm not sure its an issue that is TFP specific).
In /data/system there is a file accounts.db and a table within it is the table accounts with 3 records one of these relates to AsusPCSync and is of no interest .
For the other two records I have
name | type | password
<email add>|com.android.email | plain text pwd
<email add> | com.google | 64 char string (rough count)
Does anyone know if my email password should be in plain text when the com.google is encrypted?
Will a change to an alternative email client change anything - I would expect that all apps will use the same android API ?
Just sayin thanks for finding this. And actually I am a bit surprised that it's so quiet also here. I find that a bit disturbing!
So anyone an opinion?
I've established that this issue was reported in September 2010 here http://www.androidcentral.com/android-passwords-rooted-clear-text. I think it was picked up from the Google Code forum discussion here http://code.google.com/p/android/issues/detail?id=10809. Assuming that the moderator is knowledgeable then post 128 "Starting with Honeycomb, device encryption is now supported and is the most appropriate solution for this issue. Closing this now." brings the ASUS Android build into question. So if you are using a rooted device and the default mail client then anyone borrowing your device can gain access to your email password. I can't comment about any apps being able to transmit the password via an internet connection.
The solution is simple.
Install the free K9 email client
Open up the "Asus" email app and delete any email accounts
Check in /data/system/accounts.db that accounts is now clean of the email password
FYI, this issue exists on stock ICS 4.x on my Galaxy Nexus, so the issue isn't just with Asus.

Microsoft Exchange...

Here I am asking this same old question again on yet another Android phone. Maybe I should just take a hint and get a phone with real exchange support yeah?
I have a Droid RAZR MAXX , about 30 minutes old.
Anyhow, apparently NO ONE uses exchange or I'm the ONLY ONE with this issue.
Press Settings
Press Accounts
Press Add Account
Press Corporate Sync
...
.....
What the **** am I supposed to do with just "Email" and "Password?"
Where am I supposed to enter my domain, my server, and the other options that go along with exchange?
Who approved this? This is even less usefull than just activesync, it doesn't work at all.
Anyone use exchange or understand where the mystery settings are?
**UPDATE** I THINK, I just lost about 80 IQ points when I found this. This could possibly be the saddest fail in exchange history..
https://motorola-enterprise.custhel...roid-razr-maxx-corporate-sync-email-settings?
Don't feel bad. I just returned a Galaxy Nexus because I was unable to get my Exchange account working. I figured out how to get all the info into the corporate sync settings and got excited when it said it worked. Alas, it refused to actually get any mail or sync any folders.
So I downloaded Touchdown. I was unable to even get that working with my Nexus. With the Maxx I still wasn't able to get it working with Activesync, but at least I can get it working with polling. I hate the idea of paying an extra $20 for Touchdown, but in the end I think it's probably worth it.
Wow. I knew the workaround, but had no idea they'd actually make that official. That's hilariously unprofessional. All the same, points to them for putting it up there when they knew people were having problems..
Sent from my XT910 using xda premium
Well.. So much for moto blur..
Sent from my XT910
What the heck are you complaining about? Just enter the email and password and it will try to configure on the basis of that. If it is not able to do that it will ask for the server and other info.
Szadzik said:
What the heck are you complaining about? Just enter the email and password and it will try to configure on the basis of that. If it is not able to do that it will ask for the server and other info.
Click to expand...
Click to collapse
Except when it doesn't, and just says it is unable to connect, offering no option to enter the server name. Have a look at the linked knowledgebase article.
Sent from my XT910 using xda premium
What is the section "Server settings" in Account settings for then? I am using the Exchange server on my RAZR from the first day I bought it. The corporate mail is excellent a reliable.
I set up the name of the server and login including domain name and password. The last option is proxy. That is all you need.
Wow... wish I'd known this before purchasing Enhanced Email. It's a nice program, but the only reason I needed it was because the stock mail program wouldn't let me set up my exchange email after the first OTA update from VZW.
Live and learn.
For some reason on the Maxx when you go into Corporate Account/Sync, there only 2 options
Email Address
Password
No other options are available. Menu button does nothing. Period. It wasn't until I stumbled upon the dumbest feature ever that I knew to use any current account that I have access to (NON EXCHANGE ONLY , i.e. YAHOO, HOTMAIL, GMAIL,) in order to get those options (Domain, server, etc, ) to appear so I could edit it.
Ludacris..
Some accounts work straight off the bat, others won't. Assume it's exchange version and server implementation to blame. The problem does exist, as evident by the Moto knowledgebase link in the OP, so he posts claiming people who can't set exchange up are missing something are, well, missing something themselves.
Sent from my XT910 using xda premium
onslaught86 said:
Some accounts work straight off the bat, others won't. Assume it's exchange version and server implementation to blame. The problem does exist, as evident by the Moto knowledgebase link in the OP, so he posts claiming people who can't set exchange up are missing something are, well, missing something themselves.
Sent from my XT910 using xda premium
Click to expand...
Click to collapse
On what planet does it make any sense to to input a yahoo.com email address and password to trigger server setup, domain etc, for an exchange server? Just to make those options visible?
I could never, even on accident could do a worse job in designing this software. And I'm an idiot.
Corporate Email Autodiscover
I would suspect that the reason you're only prompted for the email address and password is that newer versions of Exchange can work with autodiscover, if properly configured. That's why when you set up an account in Outlook 2010, it asks for your email address and password to begin with. It goes out and looks for the information from DNS for your domain, and automatically gets the mail server information.
My RAZR works fine??? what's your deal
Hey i just opened a Droid RAZR MAXX and turned it on and set up my gmail account then set up my exchange 2007 account.
Here's how( maybe your doing it wrong):
- First Unlock the device's screen.
- Press home key as many times as you want, but more than 0.
- Press the settings button. Looks like 3 little lines on top of each other. It is just to the left of the little house button.
- Select Settings by touching the gear icon. - bottom left.
- Scroll down to accounts and press it. (accounts that is)
- At the very bottom touch the words "Add account"
- Now touch the little blue stamp icon that has the words Corporate Sync under it
- Enter your microsoft exchange account email address in the box that is for Email address:
- Enter your password in the box that is for Password.
- Click next on the bottom right of the screen.
Now your droid will try to connect to your companies exchange server.
If it cant it will allow you to put in server and domain information.
You have to be patient, it could be 30 whole seconds or so before it prompts you.
- Enter your companies domain name in the domain box.
- Enter your microsoft user account information in the name and password boxes.
- Enter the name of your mail server w/ the domain name at the end ie. mail.yourDomain.com
- click Next.
If you have your information correct it will work. Else check w/ your admins. If you are your admin... try again.
Ya i have been using exchange for several years with moto android phones with no connection issues. My Razr has worked fine, like stated in post im running exchange 2003 which does not offer auto config for phones, you might be running a newer version of exchange which does have auto config setup but not setup right? If your running exchange 2007 or up make sure the auto config settings on server are right because if there wrong it will fill in the wrong info and not let you enter your own server info.
Sorry to dig up this old thread, but everyone seems to be so hard core about searching for solutions before posting new threads. So I guess, better to dig up an old one.
I am having a variant of this problem. I am setting up Office365 for my company as a replacement for onsite Exchange2007. I set up a new domain just to have something to play with in test/dev. The domain I'm using is set up for the Autodiscover that a few people alluded to above, just requires a few new DNS records. It worked perfect on my Xperia Play with Android 2.3.3 that I had prior to the Razr. I just put my email and password in and boom it configured. Not so with the Razr, I don't know if this due to the Razr not using the stock Android email application or just the difference between 2.3.3. and 2.3.6.
I found this thread on the Office365 support site:
http://community.office365.com/en-us/f/160/p/25689/118705.aspx
While *I* can make that work, being an admin and all, I think it's probably way too confusing for our end users. I can imagine a greatly increased support volume should we have to go down that path with IMAP servers. Or using the Motorola method in the link closer to the top the thread, which would probably work fine for connection to the onsite Exchange server, but is more dicey on Office365 since there is no "server name" per se.
I can't imagine that this issue is going to go away. A lot of companies are moving to cloud email and Office365 is a popular choice.
---------- Post added at 04:51 PM ---------- Previous post was at 04:02 PM ----------
OK, I was able to get it working.
First, I logged into my Office365 account with a web browser, going to my inbox and then in the upper right hand corner hitting the question mark and then from the drop down menu choosing About. This is described in the link I put in my last post.
Then I went to log in using the Corporate Sync. It failed and then came back and asked me for the server name and domain. For the server information I put in the information from the Host Address field on the box that popped up from the Help-About box in the last step,
listed as: Host address: https://*********.outlook.com/owa but leaving out the OWA on the end. I left the Domain blank and entered my email account as the username, and re-entered the password (Important-it was failing before I re-entered the password.). Then it worked, came back and asked me to set a screen lock code. Yay!
Hope maybe this helps someone else.
As long as this thread was dug up (thank you BTW), I thought it important to update my situation from what I had in the 2nd post.
It turns out there was an Active Directory (AD) configuration error on my account. I figured this out by looking at the log from attempts to connect using Activesync. This lead me to the Touchdown support website which then linked to another website. Basically my account didn't have permission to create devices.
Fortunately I have a good relationship with the AD admins. I was able to configure email on my device without issue using another users credentials. This told me it should work with my accounts. So I sat down with the AD admin and we compared permissions on the 2 accounts till we eventually found the differences.
Once my account was fixed I was able to get Activesync working using Touchdown. Unfortunately I couldn't get Auto Discover to work, but manual setup worked fine. Then I set up my account using both the built-in email client and Enhanced Mail (bought it for 10 cents during Google sale). It worked fine on all 3. Even download Moxier. Turned out, of all the options, I liked the interface and options most using Touchdown so I stuck with that.
Motor's corporate email client makes one assumption I wish they would not make. They assume your Exchange administrator has properly setup autodiscovery. If autodiscovery is properly configured (that requires a proper autodiscover.domain.com address) all you need is your email address and password and everything will work. This is a really bad assumption as most people who set this stuff up are idiots.
That said, after a failure to use autodiscover the client should eventually fail to a manual setup screen for server name, domain login etc.
Sent from my ASUS Transformer Pad TF300T using Tapatalk 2
wingdo said:
Motor's corporate email client makes one assumption I wish they would not make. They assume your Exchange administrator has properly setup autodiscovery. If autodiscovery is properly configured (that requires a proper autodiscover.domain.com address) all you need is your email address and password and everything will work. This is a really bad assumption as most people who set this stuff up are idiots.
That said, after a failure to use autodiscover the client should eventually fail to a manual setup screen for server name, domain login etc.
Sent from my ASUS Transformer Pad TF300T using Tapatalk 2
Click to expand...
Click to collapse
I do have autodiscovery properly set up for my Office365 domain, it's no longer optional. Not even your Outlook client will connect to Office365 Exchange without autodiscovery working. As I mentioned before, there's not a server name in the traditional sense. Obviously, you can find A server name in the help-->about information when you are logged into the OWA version of Office365, but you couldn't drop that server name into a traditional Outlook setup and have it work.
My domain autodiscover works with other phones. In fact I just added a Windows Phone7 device to it last night and all I had to do was enter the email address and password. I pulled my Xperia Play out of a drawer last night and put it on the charger. It's been factory wiped and I'm going to run through the setup for my Office365 domain on it again. I just got busy doing other things last night like working out and watching the basketball game
Work Around for adding Corp Sync Account without using Touchdown
i had this problem when i went to create a Corp Sync account and did not see a place to type in the Server name ....there is a "work around" for adding a Corporate Email account without using Touchdown... type in your gmail account information let the app verify the account... once it is verified you can go back and modify the account ... you "should" see a box to type in webmail.ihostexchange.net...
Wow my iq dropped by reading this noob thread. Just open the email app click add account select other enter your email and password then press manual setup enter your domain and server your good to go it automatically syncs contacts and calendar.
Sent from my DROID RAZR using xda premium

[Q] Stock Email passwords still stored in clear text.

I realize that this has been an 'issue' for a while now, but I would like to know if there are any new ways secure and use stock email client with Exchange ActiveSync and not have credentials stored in clear text on the device. The same goes for IMAP and POP accounts using the app.
Yes, this is really only an issue on rooted devices, Google's official answer is to enable Device Encryption and that there are other email clients out there that handle credentials better. I personally switched to Touchdown, but would rather use the stock client.
I am trying to come up with a MDM solution for my company and really don't want to have to block devices if I don't have to. But as it stands my only options are have the user buy a 3rd party email client, force encryption and/or block rooted / jailbroken devices or use Citrix and OWA. I've spent a couple days researching this and haven't come up with anything promising that puts a smile on my face.
Any other Exchange Admins out there? How have you dealt with this?
For those who were not aware of your network username, password and domain being stored in clear text. Using Sql Lite open the Email app, Open EmailProvider.db and select HostAuth. Within you will find your connection info staring back at you, clear as day.
Android Issue Log:
https://code.google.com/p/android/issues/detail?id=10809
Google's Response:
https://code.google.com/p/android/issues/detail?id=10809#c128

[Q] POP 3 reconfiguration - HELP needed

Hi,
I am having problems with the ISP I use for my webmail so I have decided to run my family mail domain on my local mailserver on my Mac Mini as the family mail system.
I can sort out this easily enough and am ready to switch at any moment but...
I have an HTC One Mini (UK Vodafone stock roms). It is running:
Android 4.3
HTC Sense 5.5
Software number 2.12.161.2
HTC SDK API level 5.65
Kernel Version 3.4.10-g5208099
[email protected] #1
SMP PREEMPT
Build Number 2.12.161.2 CL282558 Release-keys
Browser version webkit/534.30
NON-Rooted
I have downloaded all my webmail from the ISP via POP3 into my One Mini using the standard mail app (it is no longer on the isp mail server). When I attempt to change the inbound and outbound mail settings on my HTC One Mini I get a message stating:
Warning Changing the Server will delete the current account
The user mail address will be the same but I would be pointing to a new server with new logon credentials.
I need to preserve my mail messages (sender addresses) as I change the in/out pop servers so that when i change the POP3 account details I can maintain my mail data.
Can anyone explain what I need to do to enable the change safely. I cannot afford to lose these mails nor can I stay with the ISP forever?
Does someone have an export tool?
I can find nothing on the web on this subject so I am turning to this community because there are some wizards out there...
I need to change the inbound, outbound, user name and pw details for the account settings. Is there some way I can poke these values into the internals of the application? Can anyone offer me a script to help to do this? Would this bypass the account content deletion?
All help appreciated,
Many thanks

Categories

Resources