Security [questions, problems and discussion]

[Rakoen]

Hello all

As someone handling sensitive information, I would like to investigate the security Android is dealing with.

First of all I got scared when I bought the app called SQLite Editor. It had all of my most vital passwords just stored in plain text. What I did immediately was a format of both internal and SD card as a reaction. However, I couldn't even find a feature to secure wipe the internal memory, while I've DBAN'd the SD card 7x.

So my thought was, I have to encrypt it. ICS seems to have a nice feature for that, however, it doesn't kind of work for me. I'm currently on cm-9.0.0-rc1-tinystream-hephappy-p500 (RC1-Rev.B). I went to Security in System Settings and touched "Encrypt Device". It gave some confirmations and I've accepted them however, now I'm kind of stuck on this screen.

My first thought was "it is encrypting". But after hours of waiting, I wanted to check if it's done already. So I clicked the power-button once (just to unlock) and it asked for my password. I've entered it and it just went into my normal launcher. I've checked if anything had changed and no, my device has not been encrypted. Any logs somewhere? Any ideas what could have caused the problem?

Beside that, I asked myself the question "how secure is my Google account". As I am not planning to store any password to my device anymore, I am still connected to my Google account. I have DroidWall blocking all connections (except for my OpenVPN one).

Now my question is, what if my phone gets stolen. Does my SD-card contain any sensitive data, that's the first question. I am using LINK2SD to put everything on my SD card by the way. What security does Android use to connect to my Google account? If the thief turns on wifi and starts sniffing what data passes, what exactly would a hacker be able to sniff from me? Even then, my contacts contain valuable information. If my phone gets stolen, a hacker could simply steal all of my contacts, can't he?

Does someone have any idea to secure my phone? To connect to the internet I have OpenVPN working and blocking other connections with DroidWall. So the real case is, the data on my phone itself. Even if I use a anti-theft tool from the market and do a remote factory reset, the thief would still be able to use a datarecovery tool and so I would be screwed...

Another question: is it possible to combine a password lock and a slide lockscreen? As when I now enter my password and then put my phone in my pocket, it automaticly presses lots of things I don't want to press as there is no lockscreen for 30 minutes (I made the modification to the settings as my password is very long and I don't want to re-enter it each time). It would be perfect if a password lock would be on there to boot the phone (and even better to decrypt it) and every next time without rebooting the phone getting a patern unlock, that would be great.

So, if you can add anything usefull about securing or what security Android uses, please let me know.

Thank you very much

PS: One completely different question: does someone know why my phone boots when I plug it in to a charger? I don't like that, I want to charge without booting.

 

[davidprahl]

These are some good in-depth questions, I wish I knew the answers. You may want to look into Android forensics, as that may reveal ways to retrieve (and protect) your data. Depending on the speed of your device you might be able to upgrade the OS to 4.0 or load the equivalent custom ROM (CM9).

 

[tonymail]

To ensure that your OpenVPN working properly

 

[termi]

The android is not a secure device. It is a marketing data collection tool.

I'm gonna have to see this sqlite editor for myself because I currently have this set to use my primary email... if its stored my password in plain text then my domain names, steam accounts and banking are now at risk. GG Google.

 

[EarlyMon]

If your phone reboots when plugged into a charger, then it's best to suspect a short, either in the cable or charger.

 

[Rakoen]

These are some good in-depth questions, I wish I knew the answers. You may want to look into Android forensics, as that may reveal ways to retrieve (and protect) your data. Depending on the speed of your device you might be able to upgrade the OS to 4.0 or load the equivalent custom ROM (CM9).

I am currently on Android 4.0.4, using Cyanogenmod 9, so I don't know why you are talking about "upgrading".

To ensure that your OpenVPN working properly

It is working properly.

The android is not a secure device. It is a marketing data collection tool.

I'm gonna have to see this sqlite editor for myself because I currently have this set to use my primary email... if its stored my password in plain text then my domain names, steam accounts and banking are now at risk. GG Google.

Not true at all. Android is very good at its security, I've learned that yesterday. Google uses some kind of tunnel connection between Google Apps, for more information, see this: https://developers.google.com/secure-data-connector/docs/1.3/security

It seems like it also uses some kind of encryption for the SQL Database, but note that it's only for Google. Almost every Android apps stores your data in plain text, so indeed, your domain names, steam accounts and banking is now at risk and this actually is not the mistake of Google, but from the app developers.

If your phone reboots when plugged into a charger, then it's best to suspect a short, either in the cable or charger.

Incorrect. My phone doesn't reboot, it boots. That's what I meant. When I turned it off and plug in the cable, it boots. I had it on my first custom ROM too, but on my previous rom (CM9 Alpha), it just booted to the battery recharge screen. Nothing wrong with the cable, but most likely with the ROM. However, I just contacted the developer and he removed the offline charging feature, so never mind.

--

This discussion is very interesting, however, this forum doesn't seem to offer any experienced people in this topic, so I would like to refer to XDA, which brought me to the answers: Android Security [questions, problems and discussion] - xda-developers

The solution is simple: use a strong pattern unlock. The FBI can't get behind it, so why would someone else be. Beside that, if you want to be untraceable (encrypted calls, encrypted videos, encrypted messaging, encrypted connection, encrypted logins, encrypted logs or no logs,...) then unplug your SIM and use Skype.

 

[termi]

Not true at all. Android is very good at its security, I've learned that yesterday. Google uses some kind of tunnel connection between Google Apps, for more information, see this: https://developers.google.com/secure-data-connector/docs/1.3/security

It seems like it also uses some kind of encryption for the SQL Database, but note that it's only for Google. Almost every Android apps stores your data in plain text, so indeed, your domain names, steam accounts and banking is now at risk and this actually is not the mistake of Google, but from the app developers

Unfortunately it is also Google's fault for disallowing me access to my own system by design. For example I have a piece of spyware called zinio that will forever be on my android, because Google has designed the system in such a way that makes it literally impossible to remove.

I am unable to remove certain apps
I am unable to prevent apps from automatically starting up
These apps have the capability to intercept, and retransmit all SMS, IM, email etc

So you see, while Google may have allowed for an app to store an encrypted string, it also prevents me from removing the ones that don't, and forces me to accept that all information that comes through this device may be recorded and retransmitted

Check out the app called Trustee Rapport, designed as a secure banking app... actively intercepts and transmits your incoming SMS messages to their server.
Even though it has been proven this app does this many banks like BMO still recommend it and it is still distributed on Google play.

Facebook app is also guilty of collecting IMs, SMS, phone calls, etc.
Dead Trigger, now free, want to know why? Because it starts up on boot and has permission to monitor SMS and incoming calls. Yes a 3d graphic video game requires SMS
nd boottime acess.

The reason so many apps are free is not because the developer is nice, its because it has additional functionality as a data collection tool that the developer can make money from.

When Sony released the ps3 they sold them for less then the cost to build it. They didn't do tis out of kindness... they did it knowing they would penetrate more homes with a cheaper console and they could recover that loss by exposing you to their advertising and selling you other things

If its free, YOU are the product. Google doesn't run 8gb email accounts without analyzing every mail for marketing potential. A coupon for a free hamburger? So that you buy a soda and fries with it.

Sadly, I paid for the privledge of being monitored by the likes of zinio and 'vibe'. I have no right to remove their software from my device that I paid for.

I really wish I had tried a Droid emulator before buying this. I would have gotten the windows RT tablet next month instead. Future shop won't refund it because its working as intended. Asus just hangs up on me when I mention not being able to uninstall zinio (2* they hung up on me upon mention of zinio)
Finally getting an Asus agent that won't hang up he said his test device does the same and apologised, and was more concerned with me filling out a survey about how well he helped me

 

[Rakoen]

Unfortunately it is also Google's fault for disallowing me access to my own system by design. For example I have a piece of spyware called zinio that will forever be on my android, because Google has designed the system in such a way that makes it literally impossible to remove.

I am unable to remove certain apps
I am unable to prevent apps from automatically starting up
These apps have the capability to intercept, and retransmit all SMS, IM, email etc

So you see, while Google may have allowed for an app to store an encrypted string, it also prevents me from removing the ones that don't, and forces me to accept that all information that comes through this device may be recorded and retransmitted

Check out the app called Trustee Rapport, designed as a secure banking app... actively intercepts and transmits your incoming SMS messages to their server.
Even though it has been proven this app does this many banks like BMO still recommend it and it is still distributed on Google play.

Facebook app is also guilty of collecting IMs, SMS, phone calls, etc.

The reason so many apps are free is not because the developer is nice, its because it has additional functionality as a data collection tool that the developer can make money from.

While this is kind of true, it is always your own responsibility to keep your device safe. There are many things to do that. Google released an app that helps you monitor which app is requesting what permission. You can even set which permission is denied so that you can't install the app and highly "dangerous" apps will be kept away from your device.

Beside that, who doesn't root his device? It's Linux, a user of a Linux OS should know how to access his own system. What an app does is listed before you install it, it is your own choice to install it. Even if you don't trust it, you can still use things like DroidWall or Comodo to block it...

 

[termi]

While this is kind of true, it is always your own responsibility to keep your device safe. There are many things to do that. Google released an app that helps you monitor which app is requesting what permission. You can even set which permission is denied so that you can't install the app and highly "dangerous" apps will be kept away from your device.

Beside that, who doesn't root his device? It's Linux, a user of a Linux OS should know how to access his own system. What an app does is listed before you install it, it is your own choice to install it. Even if you don't trust it, you can still use things like DroidWall or Comodo to block it...

Zinio and vibe come pre-loaded, and the uninstall buttons do NOT WORK.
Rooting the device voids the warrenty. I shouldn't have to give up my warrenty in exchange for privacy.

What app monitors permissions? I mean, I check on Google play what permissions it uses before I install it.

the problem isn't staying away from malware, the problem is the malware came pre loaded and google's OS is designed to block me from removing it.

The problem is the device sends a signal for Every event. Apps can register themselves for these events so they boot up to handle that event.

Sounds like features? If you are in the business of selling usage/behavior information and ads, certainly.

But big bad evil Microsoft doesn't even do this. Intact, they have made utilities specifically to get rid of unwanted programs and auto runs. Google has taken the exact opposite side, giving others the ability to decide that for me, if I like it or not

 

[termi]

Maybe I've been out of the loop too long... I've avoided facebook, MySpace, twitter etc like the plague

My first few days on the appstore and its apparent there is a certain lack of quality but that's not what really disturbs me... what really gets me is that even the 'professional'/'official' often even paid apps want ridiculous permissions. Banks recommend spyware literally. And people don't really seem to care.

Its like I've woken up in 1984 and we all have portable telescreens. People have gotten so used to having heir privacy trampled that it doesn't even get a second thought. I'm starting to wonder if I'm going to be banned for mentioning such unspeakable things....

1.2gb 3d game wants to load at boot time? Maybe its just that sure I'm going to love it! ...and it wants access to my phone calls? Maybe to ensure I receive their SMS offer for free in game items!


I mean, Google themselves said do no evil!' So I'm sure they wouldn't profit by spying on my browsing and email habbits or anything


Here's a bit of perspective... back in the glory days of 56k, there was an internet fiend known as DoubleClick... cyberspace's worst privacy invader... everyone knew not to eat their cookies. Companies were formed with the single purpose of blocking them at all cost...
Fast forward to today... Google now owns DoubleClick. And we allow them to handle our emails and IMs now too!

If major international banks can survive price fixing scandals and still repo your home to cover their gambling debts, you don't think some internet companies are corrupt too?

Here's a fun fact. My inbox hasn't gotten spam in literally months. Today I got two pieces of spam. Only thing that's changed is I used that email on this android device. I guess that zinio software is working.

 

[Rakoen]

I don't know what kind of mobile phone you have, but mine doesn't come pre-loaded with zinio or vibe. Also, when I look at the original source of Android, there is no such a malware included. So it is not Google blocking you from removing it, it is the brand/vendor of your phone that cooked it into the rom.

Lots of things are corrupt, I am aware of that. But still, I am not blaming Google. They indeed are evil if you look at it your way, that's why this video was made: The Beast File: Google ('HUNGRY BEAST', ABC TV) - YouTube

However, on the other hand, what are they doing wrong with your information? They aren't even handling your account information to the FBI: FBI, stumped by pimp