Motorola cell phones are regularly phoning home(beneaththewaves.net) |
Motorola cell phones are regularly phoning home(beneaththewaves.net) |
Spyware like this is depressingly universal among carriers.
Since I made a conscious effort (years ago) to remove all Microsoft products from my life, ActiveSync is another app which I have never used.
Who needs it?
*" What I am going to do as a result of this discovery
As of 23 June 2013, I've removed my ActiveSync configuration from the phone, because I can't guarantee that proprietary corporate information isn't being funneled through Motorola's servers. I know that some information (like the name of our ActiveSync server, our domain name, and a few examples of our account-naming conventions) is, but I don't have time to exhaustively test to see what else is being sent their way, or to do that every time the phone updates its configuration.
I've also deleted the IMAP configuration that connected to my personal email, and have installed K-9 Mail as a temporary workaround.
I'm going to figure out how to root this phone and install a "clean" version of Android. That will mean I can't use ActiveSync (my employer doesn't allow rooted phones to connect), which means a major reason I use my phone will disappear, but better that than risk sending their data to Motorola.
I'll assume that other manufacturers and carriers have their own equivalent of this - recall the Carrier IQ revelation from 2011."*
Judging by your past comments, you are merely another Microsoft shill who believes that they can do no wrong...
[from the article]
*" I was quickly able to determine that the connections to Motorola were triggered every time I updated the ActiveSync configuration on my phone, and that the unencrypted HTTP traffic contained the following data:
The DNS name of the ActiveSync server (only sent when the configuration is first created).
The domain name and user ID I specified for authentication.
The full email address of the account.
The name of the connection.
As I looked through more of the proxy history, I could see less-frequent connections in which larger chunks of data were sent - for example, a list of all the application shortcuts and widgets on my phone's home screen(s)."*
In all fairness, it seems that the implementation uses a middle server (pretty common in big companies where good engineering isn't a requirement) where log in data is sent, is stored in the users' profile and where timelines and other content is parsed before being sent back to the user's device, in a "dumb" format that the BLUR system can understand.
Nokia has a bit of the same for their low-end phones (understandably) and BlackBerry used to do much of the same. Yet, in those days, and in an Android phone that can easily connect to social networks on its own, this seems like a very unfortunate techncial decision.
In other words: the official Gmail app, Twitter or Facebook apps are unlikely to be "compromised".
EDIT: submission I am refering to: https://news.ycombinator.com/item?id=5975598
One connection that pushes aggregated social networking data saves the need for a multitude of apps constantly polling or keeping their own open commections to various services.
BlackBerry also provided similar services as part of their BIS plan. It would poll Gmail and Exchange servers from its own servers, and push compressed data to the device.
Also, remember that these services existed at a time of slow networks and devices and a lack of support for it from Google. At the present, it's becoming increasingly clear that only few companies have the expertise and trust to do this securely. Motorola is probably not one of them.
D/CheckinProvider( 507): insertEvents Process tag not allowed: XMPPConnection
I/XMPPConnection( 772): Preparing to connect user XXXXXXXXXXX to service:
jabber1.cloud2.sdc100.blurdev.com on host: jabber-cloud2-sdc100.blurdev.com and port: 5222
E/PacketReader( 772): at org.jivesoftware.smack.PacketReader.parseXMPPPacket(PacketReader.java:503)
D/CheckinProvider( 507): insertEvents Process tag not allowed: XMPPConnection
I/XMPPConnection( 772): Shutting down connection for user XXXXXXXXXXX to host jabber-cloud2-sdc100.blurdev.com
W/System.err( 772): at org.jivesoftware.smack.PacketReader.parseXMPPPacket(PacketReader.java:503)
E/XMPPConnectionManager( 772): Failed to connect user 'XXXXXXXXXXX' to host
'jabber-cloud2-sdc100.blurdev.com on port 5222: Connection failed. No response from server.:Then people wonder the "nothing to hide" well, you might not, but will everyone you know be bothered you are sending their e-mails around to intelligence agencies?
I guess since Google bought them, this is their disaster now.
From a "hacker" perspective, even metadata on the key employees of a corporation is incredibly valuable -- imagine knowing with what firms a company is communicating, giving inside lines of investment-impacting activities like acquisitions. This is enormously valuable stuff.
"Also interestingly, while testing Picasa and/or Youtube integration, Motorola's methods of authenticating actually tripped Google's suspicious activity alarm. Looking up the source IP in ARIN confirmed the connection was coming from Motorola."
With that said I bet this is all for their social networking integration, some engineer thinking it would be cool for them to aggregate all your social data in the cloud, with no concept of the privacy implications.
https://forums.motorola.com/posts/64e9971ab3
Amazing that they've been doing it for so long.
Furthermore, if this report is true: why aren't there more tools out there so that there are more eyes watching this stuff? Or is everyone just too busy being "social" ??
How would you sniff your device? WiFi and let your router do the thing? It wouldnt be difficult for your phone to stop suspicious activity when WiFi or VPN is turned on.
How do you sniff 3G? Can you sniff GPRS/GSM for any suspicious activity? Now we're talking 0.000000001%.
Android 4.x has vpn, so one way to sniff data is to setup openvpn and on your server tcpdump or wireshark everything.
To sniff 3G/GSM I believe one would have to root their phone and sniff it there as most people dont have 3G/GSM hardware. I dont know more about that, perhaps its as "easy" as rooting it and running tcpdump on the device and saving to sd-card from some of its interfaces?
Anyway Cyanogen solved problem on my Defy.
Why should Blur care about keeping your FB credentials private?
Edit: upon closer reading, credentials were sent over a secure connection, but aggregated content was sent in the clear.
* sigh *
Well, if I must...
It's pure engineering incompetence from Motorola, not a nefarious way to collect data.
Just curious, were these devices manufactured before or after Google acquisition?
Does anyone know if this is a part of the Android Kernel? If it is it means they've modified the source code and they're obligated to share their changes.
Wait, isn't Motorola owned by Google now???
That's pretty much the exact same thing. Although: 'Never attribute to malice that which is adequately explained by stupidity.'
*" I was using my personal phone at work to do some testing related to Microsoft Exchange ActiveSync. In order to monitor the traffic, I had configured my phone to proxy all HTTP and HTTPS traffic through Burp Suite Professional - an intercepting proxy that we use for penetration testing - so that I could easily view the contents of the ActiveSync communication.
Looking through the proxy history, I saw frequent HTTP connections to ws-cloud112-blur.svcmot.com mixed in with the expected ActiveSync connections."*
Manifest: http://pastie.org/pastes/8102815/text strings.xml: http://pastie.org/pastes/8102837/text
I also found a bunch of apks that look like 'plugins', haven't really looked at them, but should provide a clue to what they're snooping
blur_myspace.apk
blur_linkedin.apk
blur_picasa.apk
blur_orkut.apk
blur_lastfm.apk
blur_flickr.apk
blur_youtube.apk
blur_activesync.apk
blur_email.apk
blur_twitter.apk
blur_skyrock.apk
blur_facebook.apk
blur_photobucket.apk
blur_yahoo.apk
> it seems that all this stuff is mostly
> to provide social networking integration for MotoBlur
I don't feel like buying into the idea that it was all consultants hired on short term by motorola, in a mad scramble to create an android platform and compete with the iPhone, working under a temporary contract with no accountability.
I don't even want to buy into the idea that maybe there was a large team of disinterested 9 to 5 corporate drones, with a middle manager who was a real dick with a middling paycheck as a mediocre incentive to produce high-quality work, who inspired nothing but apathy in his subordinates, and was too lazy, and too interested in fantasy football, to check their work for network security practices.
Capture ALLLL the traffic, and don't encrypt it? As an innocent mistake?
No way. I can't put the blinders on, here.
According to Wikipedia pages the dates were:
http://en.wikipedia.org/wiki/Droid_X: On May 19, 2011, Motorola released the Droid X2
http://en.wikipedia.org/wiki/Motorola_Mobility#Acquisition_b...: The deal received subsequent approval from Chinese authorities and was completed on May 22, 2012.
That's over a year, if barely.
When Boeing and McDonnell Douglas merged, executives from those companies would fly to different, distinct cities for negotiations and then drive several hours to the actual meeting location. In that case, just knowing that execs from those two firms were flying to the same city repeatedly would be more than enough to start merger rumors.
IIRC, ExxonMobil did the same when acquiring XTO. Exxon didn't want XTO's share price to skyrocket on rumors of an acquisition as it could've made the deal unprofitable.
That doesn't make sense. If shares rose on the merger rumor, Exxon could still offer a low price, since everyone knew XTO's price would collapse if the merge fell through.
I just want people to stop thinking that encryption is some magic bullet that will solve all communication trust issues.
Makes much more sense for them to use those shares in acquisitions in the form of a stock swap.
Our shift to Java EE recently has resulted in us switching a few users to Ubuntu 12.04. Removing a couple of packages makes it 100% network silent plus we can host a mirror in house of packages.
Windows is going to end up inside virtualbox on a private virtual lan on the workstation if this works out.
I dread to think what nefarious code phones have in them if these are the problems we have with a desktop OS.
Should be "don't use proprietary software," no? That would apply to Google as well.
Report: Android malware up 614% as smartphone scams go industrial http://www.theregister.co.uk/2013/06/26/android_malware_bloo...
From http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...
In at least four cases, Barksdale spied on minors' Google accounts without their consent, according to a source close to the incidents. In an incident this spring involving a 15-year-old boy who he'd befriended, Barksdale tapped into call logs from Google Voice, Google's Internet phone service, after the boy refused to tell him the name of his new girlfriend, according to our source. After accessing the kid's account to retrieve her name and phone number, Barksdale then taunted the boy and threatened to call her.
In other cases involving teens of both sexes, Barksdale exhibited a similar pattern of aggressively violating others' privacy, according to our source. He accessed contact lists and chat transcripts, and in one case quoted from an IM that he'd looked up behind the person's back. (He later apologized to one for retrieving the information without her knowledge.) In another incident, Barksdale unblocked himself from a Gtalk buddy list even though the teen in question had taken steps to cut communications with the Google engineer.
I don't recommend taking the time, but if you were to trawl through all my posts on Hacker News, you'd find that I've said this about Google several times in the past, before the breaking of the NSA scandal.
Funnily enough I stopped using Google products because they keep alienating me with their decisions like the Real Names policy or killing Reader. Taking my privacy back is an added bonus.
That also means no Android phone, although FirefoxOS phones look promising.
The aggressive behavior and language you are using are not welcome or appreciated on Hacker News.
Also, you are coming across as a Microsoft astroturfer. If you are, you're going to be doing more harm to the MS brand than good.
Please note that shortly after I made the comment you are responding to, I made an additional comment clarifying why I suspected possible astroturfing.
Also, note that I'm not "anti-Microsoft." I'm making a facts-based argument that Windows is not suitable for business that need security.