J700 hacked? Random connections uid 1000 different app every reboot - Android Q&A, Help & Troubleshooting

On my j700t (2 separate phones now, both the same problem, multiple factory resets, no root) , when I view the network connections using sockstat, there is always ports listening, usually 5060 ( SIP ) . Also, 6200, 6201, 59473, 40802, 40802, and more usually UDP listeners. Also, there is always an established connection with 0.0.0.1 on port 65529 via TCP ( the remote address is 0.0.0.1 , the local address is a routable ipv4 address) , with a random IP address every time I reboot the phone, yet the last octet in the ip is always 1 (*.*.*.1). Usually it would say the app initiating this connection is software update, with UID 1000, but sometimes it will list random system apps such as camera test, hwmodule, etc. After a recent complete factory reset, the connections are still there, except this time its no app and just a lock icon ( Still UID 1000). The phone is not rooted, I am not going to root it. I suspect the phone has repeatedly been hacked ( within 1 hour of the phone first being taken out of the box) . I have searched for months now and there are zero resources online for this type of activity. If I use the app Network Connections, it says the same app has an established connection, except it gives a Unique l local IPV6 address (starting with FD00) instead of an ipv4. Also, the ip in the app sockstat is always in the "local" field, and the remote field is 0.0.0.1. This is my last resort before I go to a flip phone. It also is the exact same with max updates.
After reboot it switches to another app.
local: 253.224.206.1:6101
Remote: 0.0.0.1:65529
State: TCP_ESTABLISHED
uid: 1000
[Copied to clipboard]
local: 0.0.0.0:6100
Remote: 0.0.0.0:0
State: UDP_LISTEN
uid: 1000
[Copied to clipboard]

Having same problem. Can you furnish a list of apps you have installed? Have you figured this out yet?

uid 1000 is the user id assigned to "system" in android.
The network logs looks fine since the addresses are not connectable.
Factory reset only resets the data partition.
If you want to do a full reset of your phone, look up on Samsung Odin in this forum and flash the entire firmware.

Flashing with Odin did not do the job. Ports are still open.
How can you tell the addresses are not connectable? My phone (a Note 8) has many of the same open ports as the original poster, and the IPs these ports are open to are geographically distributed around the world. Many of the open ports have to do with bogon IPs, and the fact that the local and remote addresses are swapped makes it seem like malware might be using a reverse proxy and bogons to hide traffic. The ports always correspond to the system UID 1000, so I have reason to believe there is malware in the OS kernel.
null223, if you have any new information on this, please chime in.

null223, are you there?
I am wondering where you bought your phone(s) from. Did you happen to get them from an Amazon seller?
Also, what carrier are these phones on? Are they GSM? What country are you in?
My phone only exhibits the open ports when a SIM card is inserted and the phone is not in airplane mode (just disabling wifi and mobile data does not work). I tried two different SIMs on a single US-based GSM carrier.

Anyone?

Related

HELP: Sync over the internet ???

Is it possible to sync using activesync over the internet without running an exchange server? I'd like to be able to sync my XDA while I'm out and about to my PC at home.
:shock: :?: :?:
been trying to do the same for ages , but never found out how to do it
It can be done, under a few conditions:
1. You need to have a static IP address for you PC
2. You need to install Pocket Hosts or a similar free utility to map the WINS host name to your PC's IP address.
3. Your carrier / ISP must not have a firewall that blocks ports 5678 or 5679 (T-mobile seems to block this)
Remote active sync was designed with a local area network in mind and it is configured to connect to you computer by using the WINS name and not using an internet based DNS name. When you connect over an internet connection from your XDA, it is not able to find you PC.
If you install a free utility such as Pocket Hosts (http://zimac.de/cestuff.htm) you can configure the Pocket PC to be able to find you PC. This utility will allow you to configure you Pocket PC to map your PC Name to an IP address (similar to the HOST file on a Windows based PC)
Before I had the unlimited GPRS plan, I created a dial up connection to an ISP on my PocketPC Phone and it works perfectly. However, when I try the same thing over the GPRS connection, it does not work. From my end, it looks like T-Mobile blocks ports 5678 or 5679 on their firewall, which are the ports that remote active sync uses to complete the connection. (It looks like it is about to work, but then fails to complete the connection)
I have tried to convince t-mobile to fix this, but they keep claiming that it will not work out of the box, they don't know how to make it work, and they won't support it. They try to "upsell" me the sidekick or other device. I can't seem to get through to the right people. It seems crazy that a setting on their end blocks us from being able to sync over the air. After all, what is the point of a data connection if you are still restricted to using a cradle to sync. I understand that they don't want to support this and walk people through setting this up, but blocking the functionality seems pointless.
Anyone tested this on ATT? With number portability starting, I may have to explore other options. Anyone have an in at T-mobile that can get them to open up these ports on the firewall?
try www.yahoo.com
get an account (if you don't have one already)
login -- click on mail
the click the tab for addresses
on the next line to the right you will see the word "sync"
this will take you to download intellisync for yahoo
then follow instructions
sync you pda and your good to go, you will have your info on the internet and sync from anywhere
one more thing if youown a palm os and a pocket pc pda and you want to have both devices with same info (contacts, mail, notes etc. etc.)
the change the settings on your intellisync for your other device and resync
hope this helps it did for me...
Hi, I'm from the Philippines and my Network is SMART Communications. I tried synching with my active sync via GPRS but it seems it can't find my PC eventhough I used Pocket Hosts utility. It seems they block the port too. Anybody from Smart to please open the gate for us.
I've setup up my Win2k PC as dial-up server. And with the help of the Pocket Hosts utility, I can now be able to sync my Outlook over the air. But the call charges is killing me.
Jose
I've been investigating this myself too - and have to say T-Mobile's attitude is also alive and well here in the UK on O2 (via crapphone-whorehouse data support team).
I was actually shouted at by one of their 'tech' guys when I tried to persuade them that it could technically be done, but I needed to find out whether they were blocking the relevant ports. He eventually hung up on me! Fantastic service, eh!
I've been trying to get ActiveSync working over the Internet for the past few days and have finally managed to get it to work reliably. There are a couple of things that I have found...
Firstly, at least one of the ports required for ActiveSync does seem to be blocked when using GPRS (Vodadone UK in my case). Setting up a normal dial-up ISP connection results in first time connections to ActiveSync every time. It would be nice to know why there is problem over GPRS.
Secondly, my device was still connecting as Guest. Whilst reading through various other forums I found a fix that seem to work for this but it involves deleting a registry key. I wouldn't recommend it as I have know idea what else this key might be used for but it certainly solved the problem for me. The key I removed is HKLM/Ident/Username value is guest. The key is replaced automatically at some point (maybe after a reset) so if it stops working, you have to go and delete it again! There must be a better way....
That's great information, thanks.
I now have my device remote synching!
Just to summarise my steps to get things working on my XDA II:
1) XDA: Set up new work connection (don't you just hate the organisation of conenctions...) to a dial-up ISP over GSM, as O2 UK also block the ports required for activesync.
2) PC: Open sockets 990, 999, 5678, 5679 on my firewall
3) XDA: Use pockethosts to set up the IP address for my PC name
4) XDA: Change HKLM\Ident\User from guest to my normal PC logon user id
5) PC: Set allow network connections in activesync
6) XDA: Manually Connect to the ISP connection
7) XDA: Open activesync and click synch - away we go!
As an update to this, I had to do a full restore at the weekend after loosing all my data on the XDAII. The problem was not related to these changes but it made me look again at the Ident key. There are two keys normally like...
HKLM/Ident/Name Value<Your chosen PDA Name>
HKLM/Ident/OrigName Value<Pocket_PC>
This time I changed only HKLM/Ident/OrigName to the same value as in HKLM/Ident/Name and it connected first time. Also, this value does not seem to be reset unless you do a hard reset on the device. This may be better than changing the Username value though I have yet to try either on another computer where my preferred connection should actually be as a Guest.
Got it working
Thanks to andyclap's suggestions I finally got it working. It looks like T-mobile does not block any ports, but without the registry hack the error I got was the same as when I tested this over a dial up connection and blocked the ports on my firewall.
The other change since my last post is that I am using WM2003 and it requires you to set up a VPN connection to the PC instead of just using PocketHosts for the name resolution.

[Q] [Galaxy Nexus VPN] How do I set this up?

So I just bought my first brand new smartphone ever. My last 'smartphone' was pre-Blackberry, pre-iPhone, and bought used.
Now I've got the International variant of the Galaxy Nexus (because AT&T is being a whiny, monopolistic, non-competitive ***** and trying to release a version of it that isn't pentaband-HSPA+).
I'm currently on a phone plan that has *no data*. And that's fine. It saves me money. I may switch later, but until then, I'd like to stick to using Wi-Fi connections.
I'm under the vague understanding that a VPN will further secure my connection if I do use Wi-Fi. The Wi-Fi owner won't see what sites I'm accessing, etc, because all connections will be going directly to my VPN provider (home PC). Everything even might be additionally encrypted.
Is this correct?
Also, I've been trying to set up a VPN service on my Windows 7 machine at home. I've managed to use logcat to determine that *at first* my login name was incorrect. (Apparently the format is actually PCNAME\USERNAME; PASSWORD, rather than just USERNAME; PASSWORD.) Since discovering this, I no longer see MS-CHAP Authentication Failed errors showing up in the log. I've also confirmed that I'm getting through my router's firewall by turning the port off and on on various connection attempts, and when the port is NOT forwarded I get very simple 'Connection Refused' errors in the log.
However, with the port open and the username and password finally correct, I get something approaching the following:
---
Tunnel Established
Session Established
Using PPPoX
Using interface ppp0
Connect: ppp0 <--->
LCP terminated by peer (K|HM-0^@<M-Mt^@^^@^@^@)
Remote server hung up
---
(I can't escape the carets in that line, so each 'superscript' is actually a caret.)
I'm guessing it's the termination line there, but I don't know what it means.
Does anyone have any ideas?

[Q] App to Stay Connected to Wi-Fi At Work

Hello,
I have an HTC ONE S, and I hoping someone can recommend an App for a very specific situation.
Recently, my employer switched to a Guest access Wi-Fi. Basically, when I walk into the office in the morning, all my settings and passwords are still saved to login to the corporate network; however in order to connect to the network I have to open my web browser, a web page will load listing the conditions governing the use of the corporate WI-Fi, and I need to click on the Accept button on the page. I'm then connected to the network. So far, so good.
Here is where I'm hoping for assistance: I typically leave the phone charging on my desk. I'll check it periodically throughout the day (or if I receive a text). The problem is that the network must sense a lack of activity after a certain amount of time. At which point, I'm no longer connected to the network and must then open up my web browser again, Accept the conditions of use again, at which point I'm logged back onto the network.
Is there an application I could install that would automatically generate some sort of activity to keep me logged into the network? I have the weather app that come stock on the HTC One S; however the smallest update interval the app allows is one hour. I thought that might have been a possible solution, but along with the 1 hour time interval, I'm unsure if it is web browser activity or of any sort of network activity that is required to stay logged in?
If this is helpful: I have Automagic installed and I've used Tasker in the past but I'm not well versed in writing scripts for Tasker.
The phone is an HTC One S
Network is T-Mobile
Android version is 4.0.4
I did root the phone as there is no SD Card slot on this phone, and I removed the bloatware to free up some space.
Many thanks in advance.
Respectfully,
Vaux

[Q] Firewalls do not work.-swiss cheese

I am running a rooted LGA V400 tablet with Android 4.4.2 Kernel version 3.4.0+, software version v40010e and build number KOT49l.A1403851534. The tablet does not have provisions for a data connection via a SIM card- wifi only.
I am using the connections tab in eolwral OS monitor to keep track of what connections the various applications and the OS are making with the outside i.e.. via wi-fi. I also am running AFWall + to shut down phone home garbage. I had Droidwall installed before this. Neither Droidwall nor AFWall + shut down non whitelisted connections......
As normal course of operation the ONLY applications I whitelist are
Firefox
GMail
Google+
GPS Status
Internet (the built in browser)
Kaspersky Internet Security
Maps
Navigator
Skype
Speedtest
Sun, Moon & Planets
UCBrowserHD.
As I am writing this the tablet has an uptime of 1 hr 42 minutes. The only existing connection to the internet according to OSMonitor is Youtube through 127.0.0.1:42818. Youtube is NOT whitelisted. Also please note that I am composing this post on my laptop.
If I restart the tablet things change radically. I have 19 connections either syn_sent, time_wait,Listening or Established. Most are from System although there are things like Google Account Manager (not whitelisted) Qualcom, Youtube (again) and things like Google Input Services. On the first boot of the day its is worse with more of the system connections to various IP's in various states, Kernel connections (not whitelisted) App updates(not whitelisted), Google backup Transport and its group (not whitelisted), Google Partner Setup ( not whitelisted), Hidden Person Menu (not whitelisted), Software Update (not whitelisted), and a group of others appear which are not whitelisted.
My questions are-
. If either Droidwall or AFWall+ are true IPTables firewalls how and why is all of this crap able to get on wifi?
When transport for a certain service is not available i.e. blocked by a firewall does Android do something different with the connection request to enable it i.e. the plethora of system connections? It appears to me that AFWall+ isn't working as advertised because of f these leakers-
Most of the connections appear at boot up- is what is happening that these connections are established before AFWall+ gets up and running and it does not have the ability to close them? Note that on boot up after the GUI is running I get a SuperSU notification that AFWall + has been granted root permission so I am curious about the order of things starting i.e. a lot of the connection sockets being established before the firewall is running.
Finally- the V400 is somewhat of a stepchild. Is there another version of Android I can load on this platform that will work?
Thanks to all for the expertise here. I searched the forum before posting this as well as the internet, I am experienced with Unix and Linux and have done IPTables in non Android OS'es. I find what I am seeing here disturbing. Any help or suggestions would be deeply appreciated.
Expat.

Android phone connecting to internet through mobile data even with Cellular Data off?

Greetings,
I own a OnePlus 5T (128GB) and I am running stock firmware (OxygenOS 5.1.7), rooted and bootloader unlocked. I traveled to a country for which I have a local SIM for, but didn't have (yet) any data plan. What I did to prevent unexpected charges was disable mobile data immediately (I did the same to my wife's phone, which is on the same ISP), so that I could receive phone calls and SMS, but I won't use internet and obviously I won't make phone calls or send SMS.
What happened next is that my phone connected for 0 seconds to the internet every day at a random time during the day, triggering a 6€ expense for 10 days.
I searched through the data usage log to see if any app used internet, but it was empty.
Interestingly, my wife didn't get any charge, so I presume that the configuration I used to prevent access to mobile data was correct (it displayed an X instead of 4G+ over the chart showing the mobile signal strength).
What I'd like to discover is what caused the charges (I did get a refund since those connections lasted 0 seconds each), to prevent this from happening again. However, the phone has been completely unhelpful. I do have a data plan now, in case it's needed to perform some tests.
My best guess so far is AFWall+, it's the only application I can picture bypassing the "cellular data off" option. Those connections looked like DNS connections also, due to how short-lived were.
Any suggestion over how to diagnose this?
Thanks for your help.

Categories

Resources