Security issues on Android - Android Q&A, Help & Troubleshooting

Hi all,
Is there any reported app that can trace us / can act as a key logger and send the data to 3rd users? Especially creditcard numbers..
Recently i used my creditcard first time ever on my htc one to book a hostel. next day somebody tried to buy something online. thank god it was over limit and transaction denied.
I'm just wondering if i had some security issues on my android?
I never lost my credit card there is no possiblity that anyone could see the numbers. it was always on my pocket so there is no other way around. As i said it was the firs time and i didnt use elsewhere. I just booked a hostel through hostelbookers.com.
What do you suggest? Do you think there is an app tracing my phone or somebody who works for hostelbookers.com steal the credit card info?
Thank you in advance!

Related

My XDA got STOLEN!!

Last week on a business trip to Rome, my XDA got stolen..
Offcourse I had it blocked as soon as possible and have password protection on it, but resetting it would make it usable for anyone.
If anyone sees a secondhand XDA for sale from Italy (where they are not sold) please remember me....
IMEI: 350312010049224
S/N : HT220CC15367
P/N : 99HJ00007-00
So... when is this new model XDA comming on the market?!
We thought of a program to stick into ROM which would, after cold-boot, send one SMS to a pre-determined number. Could be a friend's number, or possibly even a web-service, where you can look up all the phone numbers of all SIMs ever in that phone at cold-boot. You could even wait a few days to see if the owner field was ever filled out...
Please go into that, as I will buy an XDA again but feel quite bad about this one stolen and would very much want something to have a little more protection/means of getting it back.
I saw an advertisement on www.thinkgeek.com about a software that would automatically send emails with IP adresses when a stolen laptop is connected to internet.
Something like that could possibly be an option in a theft-recovery program?
Thanks,
Lx
Great idea XDA developer Peter Poelman...you guys should definitly do that!!
XDA developer Peter Poelman, that is one of the best ideas I have heard of!! If there were a server you could register your XDA on, then install the 'tracking' software it would be very cool.
Would it even be possible to get a fix on the location by picking up the nodes that the XDA is near? Effectively your XDA would text you its location, name of the new owner and new number to server where you could pickup the info. Hay-presto, you can inform the provider and authorities and maybe even get it back. I bet you could even sell the software to the providers!!
Gil.
Hold on guys, if you developed such a ROM, it should be clearly stated that it is doing that. I can imagine, if people started offering ROMS, that made unsolicited calls to premium rate numbers, that would be a great, and illegal, business venture.
Anything, that works behind the scenes must be clearly highlighted if trust is to be maintained in a public community
Sounds good though. If i could find all the people that have stolen bits and pieces from me, revenge would be sweet!
I guess that watching out for ROMs that have spy-wearz or nasty apps in the background ARE possible, there could be something about now. Let’s face it the ROM tool is not that hard to understand. And if someone was really that nasty they could make a lot of money in a very short period. After all a premium rate text number has no price cap. But lets not get in to that right now.
The answer to this, like a lot of things in IT is A trust in the developer, B trust that is has not been hackled – as above and C you have noting to hide.
The provider can already see al the calls and text that the sent from your phone. So the only thing for them to see would be your ROM version.
If this was made a voluntary process and secure I can see it doing a lot more good than harm.
Also another though on the spy wear bit, it would be good to have an app that watches the activity on you device and allow you to see it.
Sorry for the rant, Gil.
Oh yeah, we've thought of nasty things one could do. Possibly more scary still: if you have this Action Engine framework, someone holding a private key somewhere can remotely update your ROM, without telling you.
perhaps thats how o2 intended to upgrade in the future?
is it easy to place the AE exe file back onto the xda? its just the one file right?
No, it's a whole bunch of files. They were installed from the operator section of the ROM, though AutoConfig.exe, into device RAM.
I'm not really into the programming stuff, but I was just thinking...
If such a thing was to be implemented, you would not want it to be active until your device actually got lost. So how do you tell your device (that probably has a different SIM card in it) that it should start to broadcast it's location and new SIM information? And where to?
I was thinking of a site where you should register, very securely and only upon activating the 'tracking' program from this secure site that a constantly updated log file of all nodes where the device is connected to a GSM/GPRS network would state the deveice's location.
With this list (and possibly the information of the new SIM card) it should definatly be possible to retrieve the device, with collaboration from the provider/authorities ofcourse.
Also I heard a provider can locate any GSM down to 5meters accuratly when the phone is being used, about 100 meters when the device is on stand-by. Don't know for shure if this is true though.
If things like these could be incorporated, this would be the best software/ROM update ever to be made in my opinion. If there is any way in wich I could be of any help I would gladly be of service!
Two complimentary options would be:
the XDA sends a message to a server whenever the SIM card is changed, unless you enter a particular password first.
Send a specifically crafted sms to the XDA that causes it to realize that it is stolen. This starts it sending location info to the server.
I think you could switch XDA in to stolen mode using a broadcast directly to the PIN on the phone. This is how P2P works in the US instead of SMS. This could be done from a web site and the user of the stolen phone would not know until it was too late.
But then again I may be wrong?
Gil.
this is all good and well, but there will be always someone out there that says this is a privacy thing and they do not want people knowing where they are using their XDA
What should be developed is a Rom that once the owner name has changed, the XDA will then send a message to a server(if the XDA is registered) informing of the new number of the inserted SIM, the IMEI number and all other numbers/contacts straight to your provider. they then contact the new provider for information on the new owner. send the bissies round and reclaim your XDA.
this would be big money to phone service providers as it would reduce the amount of insuance claims and hastle.
if it can be done, then I will be buying it (once i own the XDA !!)
cheets

[Q] NT use outside of US

does the registration process check on your location/IP address such that if you're outside the US, you're unable to register & eventually use the NT?
i read somewhere here that even on a rooted NT, you can't bypass the registration process w/ B&N to start using (& eventually rooting) it. i've been keeping tabs on these NT forums with plans of buying one for use outside of the US. (courtesy of the root exploit, of course).
TIA for any merciful god/s out there!
also, this might be a good thread for all general concerns on using the NT, rooted or otherwise, internationally
just like NC, it should have no problems.
so, you could easily register from anywhere in the world with no hassle?
maxq1 said:
so, you could easily register from anywhere in the world with no hassle?
Click to expand...
Click to collapse
yes, i've registered mine from Italy 2 days ago and no problems.
of course the services that works only in us will not work but... for the whole rest tablet is working sooooo good!
I heard from one of the B&N booksellers in person that you can register but you will not be able to purchase anything from B&N outside of US.
But the same B&N account can be used to register up to 5 devices. I am in US now and I will be gifting a NT to my niece in India registered with my account. So whatever I purchase here, she will be able to download and read there without any issue.
ASIQ said:
Hi,
My name is Mohamed Asiq, I from India. I have a nook tablet, but have not registered it yet. So please I kindly request you to allow me to use your nook account. I ensure that I will not misuse it or purchase or use it, besides in India the account will not work. Please consider my request. Please.....
Click to expand...
Click to collapse
Why don't you enter any U.S. adress, for example the adress of a Barnes and Noble store? The adress you enter to register your device should not matter, considering you will not buy anything directly from B&N anyway.
And by the way, stop spamming threads with your request.
and there are many consumer shipping forwarders which offer a us shipping address for free. like shipitto, comgateway, etc...
thank you
Balzard said:
Why don't you enter any U.S. adress, for example the adress of a Barnes and Noble store? The adress you enter to register your device should not matter, considering you will not buy anything directly from B&N anyway.
And by the way, stop spamming threads with your request.
Click to expand...
Click to collapse
thank you very much for your reply. By the way I am no spammer. . i think you know how you will feel when you bought a device at an extra $60 and it does not run. i bought the nook in India from a third-party with no bill or warranty.
i would consider your solution, but will not the B&N server want a proper credit card address. Guys i am not forcing anyone to share their account, there may be other possibilities that i do not know, so please help me with any advice not just your account.
Would this work?
http://nookdevs.com/NookColor_Factory_Mode/Skip_Out_of_Box_Experience
ASIQ said:
thank you very much for your reply. By the way I am no spammer. . i think you know how you will feel when you bought a device at an extra $60 and it does not run. i bought the nook in India from a third-party with no bill or warranty.
i would consider your solution, but will not the B&N server want a proper credit card address. Guys i am not forcing anyone to share their account, there may be other possibilities that i do not know, so please help me with any advice not just your account.
Click to expand...
Click to collapse
YOU ARE A SPAMMER - You're littering your pleas all over the place.
We understand your frustration that not able to use a device that you paid a lot of money for. But that doesn't deprive us of our right to enjoy a enjoyable forum experience.
Seriously, XDA does not have the most behaving forum - Lots of noob and useless posts and that. But your spams are on another level!
This is not a playground that you can come and shout around. Well, even at a playground I guess you have to behave yourself.
I will give you the benefit of doubt that you're new to this thing called Internet forums, maybe things are little bit different over there in India or the forums you used to be, but stop doing it or I'm sure the mods will ban your account very soon.
No one in his right sense of mind will give you, someone we don't know at all, his bn.com account with the credit card information. This is soooooo stupid to ask in the first place and so I believe you have no malicious purpose.
But we still won't.
PS To avoid us being labelled racists or discriminate against Indians, lots of us are *not* from the US nor Europe.
see if this helps too http://bookclubs.barnesandnoble.com/t5/NOOK-Technical-Support/No-credit-card-for-nook/td-p/787914
maybe this helps too http://bugmenot.com/view/bn1.com
[OT] VPN
Sorry for OT, but can anyone suggest VPN service which help me to log in BN store and buy books. I'm not in US.
there you go
www.google.com/search?q=us+vpn
Apology
hey andyrubin,
sorry man if i have hurt anyone's feelings. Well just as you said i am new to internet forums. Sorry if i misbehaved. I know its stupid enough to ask anyone about their account, i just did since i was exhausted with my tablet. Anyway sorry guys if i was posting unwanted things.
Thanks once again for your support guys.
gett said:
Sorry for OT, but can anyone suggest VPN service which help me to log in BN store and buy books. I'm not in US.
Click to expand...
Click to collapse
I don't think you need a VPN. You need a credit card with a US address, the physical location of the tablet shouldn't matter.
ASIQ said:
hey andyrubin,
sorry man if i have hurt anyone's feelings. Well just as you said i am new to internet forums. Sorry if i misbehaved. I know its stupid enough to ask anyone about their account, i just did since i was exhausted with my tablet. Anyway sorry guys if i was posting unwanted things.
Thanks once again for your support guys.
Click to expand...
Click to collapse
You don't even need a credit card to register your device. I registered mine without inputting my credit card information. You can register with B&N without a card, they just won't let you download anything from their app store. Load the Android market on instead and you'll have access to everything.
so everything is okay now, right?

[Q] Abuse and GPS tracking

Hey XDA!! I came here because I know you're quick to deliver the help. I'm not sure if this should go in Q&A or the Development section, and you'll see why in a bit.
A friend of mine (we’ll call him M for ease) recently came to me with a concern. His coworker's ex-boyfriend has been hassling and harassing her using her Android phone. **BEFORE I go any further, YES I have suggested that the proper authorities get contacted.** At first he was allegedly sending texts to MY friend via the girl’s phone. He had some forwarding/spy type app (that’s all I could figure out from some research) on her phone that would allow him to text it, and then those messages would forward to M as if they came from his coworker. I have no idea how he could have done that, and I couldn’t find a lot of apps in the play store that seemed to have similar functions.
But now, he is apparently trying to get the poor girl to install a GPS tracker on her phone (unwittingly, I assume) so he can, well, know where she is. M can’t tell me the name of this app because he’s unsure.
So at this point I’m thinking that we not only have someone who’s being evil, but who is *maybe* making his own apps to stalk and get this girl, and my friend, in trouble at work.
I found a GPS spoofer on the play store https://play.google.com/store/apps/details?id=com.lexa.fakegps&hl=en I have offered to help root phones and install this and do whatever is necessary to get this guy off their backs. I can test it all day long since I have a rooted device—my question is, I don’t have a spy app to spoof, nor do I know what exactly I’m trying to spoof, so how do I know this will be helpful?
I’m also considering finding a custom ROM and helping this girl lock her phone down more. Or telling her to call her carrier and change her number. Beyond that, does XDA have any suggestions or advice? I’m not a coder, but I can follow directions to change things if you tell me exactly where to go and what to change (i have dabbled a teensy bit in android source code before breaking my phone >_>)
The girl has a Samsung Dart, I’m currently unsure of the version of Android it’s running, but should find out soon and will edit the post.
Thanks for all the help!
You can format the phone and see if that works. Plus there are many text blocker apps on market.
Hope i helped .
Sent from my GT-S5360 using xda app-developers app
Yes ,I patiently read the entire story! Wipe the phones data !
As far as the text problem you said I don't think there is anything like that which could receive an sms from a number and then forward it to another number. So there are two options either the girl sent the text or the guy semt the text with a spoof number!
And as far as the GPS is concerned, one doesn't need a GPS tracker to know where one is! Just Google maps is enough if the guy has the girls mail in his contacts. Ask her to change the mail id it should be enough!
Sent from my GT-P3100 using Tapatalk 2

Facebook mobile number substitution?

So my ex girlfriend is convinced that I have somehow hacked her phone. (I haven't.) So much so that she drowned an HTC phone and got herself a new Droid Maxx. However she is still having the issues that led her on this paranoid delusion. I am looking for someone to help me explain to her she has not been hacked, or if I am wrong to correct me.
The story starts with her saying that her Facebook app on the phone is acting funny. Yeah the nebulous adjective, funny. When I asked her what does she mean by that she has various performance complaints as well as the app crashing at inopportune times. Setting aside such shaky evidence of somebody hacking a phone (because as you know, one thing a hacker does not want to do is let their victim know that they are inside their phone and thus shutting down the exploits they have already put in place) I am now seeking anyone who knows more about this than I do to help explain what she is seeing so that she stops accusing me of something I am not doing. To make matters worse ex-girlfriend decides to start monkeying around with things that she doesn't understand inside her phone settings and discovers something that I finally find to be odd but can't really explain away.
She went into her old phone (an HTC M8 I believe) account synch settings and sees the Facebook mobile number displayed as not her own. In fact it's not even a proper number. Here is a screen shot from the new phone (my memory says that a very similar result was on her old phone):
(Annnd Dammit since I am a fairly fresh user I cannot post a pic link, if you are trying to help me PM me and I think it'll let me pate you the link)
(Or I can try to put 5 spaces in the link to make it non working and if you have the patience copy it and take the spaces out to go to the screen shot)
http: // imgur.com / Mfba WdE
The number listed is not even a complete number and does not come up in any useful way in Google searches. This odd number was on her previous HTC phone before she sent it for drowning and then her new Droid Maxx phone is showing the same thing.
As you know it's useless to go and ask Facebook for any sort of support seeing as how we are not their customers, we are actually the commodity they sell to advertisers so they could give a rat's ass about assisting their commodity. Remember when you don't pay for something then what is being sold is you.
I must add that she also has confirmed to me that when she signs in to Facebook in a browser on a PC she does not see her number replaced inside her profile. It seems really very odd to me how her mobile app still knows how to link with her regular profile when the number is not matching. I have an HTC One M9 and I do not have the same behavior as she reports. According to her she can still see her news feeds and friend posts and all that Facebook goodness. She says she has Avast running on the phone, and she does not install any software not obtained through the Google Play Store.
My research came up with not a very convincing theory. What I found was a dated forum post regarding a Facebook feature that had been discontinued. The feature being cited was like an address book feature that sought to synch the phone's address book and the Facebook Friends list and address book together. But the discussion did not quite match what I was observing so it is unconvincing that I found what the cause was.
Can anyone follow this story at all? Has her phone been hacked? Can anyone tell me a better place to post a question regarding this?

Question I have been totally hacked for 9 months

We have been through five phones -Samsung Galaxy, then Motorola, two internet providers two cell phone providers, made so many calls I have lost count. He uses Chromebook and a Motorola Droid phone. He has even hacked my old home phone, tv, you name it, he has tried to own it . Oh, I forgot-my home security and ring doorbells also. I can change an app permission and I can see him go right in and change it back. I am sure he lives close in the neighborhood How do I get rid of this horrible person?
He grays out permissions, default apps, etc., Which keeps me from being able to delete an app, or change someone being able to access in the background. He has confiscated our emails (Gmail), prevents us from sending or receiving ones he doesn't like. He uses email for email on the web, advertising, chat, and many other things. He listens to phone calls steals all photos, maps addresses to companies or people in contacts, uses maps for ?? Xxx an anyone help me, or at least tell me how to reverse graying out on apps? This has become unbearable! Thank you!
How do you know it's a he?
It's always the girl next door.
Lol! I cannot prove it, but the big gamers nextdoor moved in when this started happening. Their best friend is an experienced IT guy who only appears when I have gone in and changed things. In those days, new changes happen, such as Ring doorbells hacker, etc. Not blaming, but coincidence?
blackhawk said:
How do you know it's a he?
It's always the girl next door.
Click to expand...
Click to collapse
Sorry. See reply in post.
Bro, I'm so sorry. My husband has been going through this VERY thing for the past year. They don't mess with mine. I just wanted to let you know even though I don't have any resolve for you, I hear you and know that it's not phony and we totally feel for you. Seriously, maybe you and my hubby can talk. I'm so sorry that you're going through it. Feel free to message me.
This sounds like a great fan fiction and will bookmark this to see how the story develops. Thank you for putting this in Moto G Power section right where it belongs!
Sounds like you might need to invest in a router with better security features.
Moosetears said:
This sounds like a great fan fiction and will bookmark this to see how the story develops. Thank you for putting this in Moto G Power section right where it belongs!
Sounds like you might need to invest in a router with better security features.
Click to expand...
Click to collapse
Definitely not fiction. It is a nightmare and could REALLY use some advice!
gunnshot81488 said:
Bro, I'm so sorry. My husband has been going through this VERY thing for the past year. They don't mess with mine. I just wanted to let you know even though I don't have any resolve for you, I hear you and know that it's not phony and we totally feel for you. Seriously, maybe you and my hubby can talk. I'm so sorry that you're going through it. Feel free to message me.
Click to expand...
Click to collapse
It has been a nightmare! They started with mine, and have now invaded my husband's phone also.
Scammed said:
It has been a nightmare! They started with mine, and have now invaded my husband's phone also.
Click to expand...
Click to collapse
Why are you posting on XDA? If you are this convinced that someone has unauthorized access to your devices, you need to be talking to law enforcement. The best advice we can offer you is to change all your passwords immediately, enable 2 factor authentication, and if possible seek a restraining order. XDA is a smart device hacking and development community, not a private investigation service.
V0latyle said:
Why are you posting on XDA? If you are this convinced that someone has unauthorized access to your devices, you need to be talking to law enforcement. The best advice we can offer you is to change all your passwords immediately, enable 2 factor authentication, and if possible seek a restraining order. XDA is a smart device hacking and development community, not a private investigation service.
Click to expand...
Click to collapse
I didn't think you were a p.i. firm. Obviously, I am not tech savvy. A little kindness please? I simply want to know how to ungray grayed out app permissions. I have searched on my own and cannot find the answer. I have reported it to local police, state police, Motorola, Samsung, Verizon, Xfinity, metronet, on and on and on. No help from anyone. I don't have $2,500.00 to just put down a retainer for a p.i. I knew someone on this forum would know the answer I am searching for and might kindly tell me. Thank you.
Scammed said:
I didn't think you were a p.i. firm. Obviously, I am not tech savvy. A little kindness please? I simply want to know how to ungray grayed out app permissions. I have searched on my own and cannot find the answer. I have reported it to local police, state police, Motorola, Samsung, Verizon, Xfinity, metronet, on and on and on. No help from anyone. I don't have $2,500.00 to just put down a retainer for a p.i. I knew someone on this forum would know the answer I am searching for and might kindly tell me. Thank you.
Click to expand...
Click to collapse
Well, it can be hard to distinguish the difference between reasonable concern over privacy violations vs unwarranted paranoia, and you aren't the only one who's come to XDA with this type of story. Most of your assumptions are likely mistaken and can be simply explained by the nature of Android itself.
Remote intrusion of mobile devices is actually pretty rare. The most common ways bad actors get ahold of sensitive user information are: phishing, user-approved permissions on questionable apps such as TikTok, and "connected" social media accounts, where users allow websites and apps access to their social media profiles, or use their social media as a login.
Regardless, to the technical point of the matter, grayed out app permissions are not the result of hacking or surreptitious malfeasance, but rather the nature of the "rules" inherent to Android - you can't remove system apps or disable system-controlled permissions without root.
If you still think you have reasons for concern, this is my only suggestion:
Change your phone number
Immediately change all relevant passwords - minimum 10 characters, a mix of upper case, lower case, numbers, and special characters, do not reuse them
Enable 2 factor authentication on all accounts, ensuring your 2nd factor is something that you and only you have access to
Once done, sign out all devices signed into those accounts
Perform a factory reset on your device; even better, reflash factory firmware. Keep bootloader locked.
Do not use questionable apps

Categories

Resources