Develop Bugs

[Q] Q: Detection of Rooted Devices by Security Appliances

My question is an academic one, of sorts.
My workplace has recently permitted the use of personal devices at the workplace, and they are using a Mobile Iron appliance to "secure" and manage these devices.
A recent change to these appliances resulted in my rooted Incredible being blocked access to the system. The one answer I cannot seem to get a clear response on is how this was detected, as my device had been working in this capacity before a recent change to both the back-end appliance and the client on the device. Clearly, though, this is not the case for all devices, as I know of someone who is still successfully using a rooted Samsung Galaxy S.
I tried a couple of iterations to determine how it detected my rooted device, and, at this point I have returned it to stock with S-OFF. I am pretty confident that the latter is what triggered my device being detected and blocked.
So, anyone have any insight as to how these appliances/devices detect root? Are they inspecting at the hardware level as opposed to a scan of applications?
Looking forward to the discussion.

Assuming superuser no longer on the device?
Sent from my ADR6300 using XDA Premium App

Correct. I returned the device to stock FroYo (2.2), with no SuperUser.

On the sd card there is a log file that says s-off maybe it see that

That must not be the case, as I did not format my SD card when I returned to stock. The soff.log file is still there.
So, perhaps it is not looking at that low a level. Given what I am seeing, though, it is certainly not looking at the applications either.

jasonjthomas said:
That must not be the case, as I did not format my SD card when I returned to stock. The soff.log file is still there.
So, perhaps it is not looking at that low a level. Given what I am seeing, though, it is certainly not looking at the applications either.
Click to expand...
Click to collapse
I'm no expert by any means but I would think that its some type of script that runs asking for access permission to the phone that only a superuser would have. I have an authenticator for a blizzard account that always pops up with a message that running it on a rooted phone is dangerous, so I'm asuming there is some type of script imbedded in the app that lets it know its on a rooted phone by querrying for su access. Why your buddies phone is not being blocked has me stumped.

Random Google wallet issues???

My experiences with Google wallet have been strange. Here's a run down:
Attempt 1
Went to Macy's, took about 4 tries before it went through.
Attempt 2
Went to meijer, got an error saying card reader could not be detected. I tried several times before giving up.
Attempt 3
Went to 7-11, no problems whatsoever.
Attempt 4
Went back to meijer tried a different checkout lane then the last time. No problems.
Attempt 5
Meijer, one more time went to the SAME lane as the time it worked. Didn't work this time got that error again saying couldn't detect card reader.
Is anyone else's this inconsistent? I don't understand. I unlock my phone, hold it up to the machine until it says sent. Any suggestions? Why is it like this? Everyone else stories I read say it works flawlessly or it doesn't work at all.
Sent from my Galaxy Nexus using xda premium

are you using any particular case, did you update the app to the newest build?

Any errors I've encountered could be chalked up to one of two things. Either the pad was not turned on/not connected (make sure there is a green light on the pad), or the network is down\you dont have a network connection.
The network has been somewhat spotty for me over the last day or two. Today it was down for almost 2 hours. An easy way to tell if the network is down is to look at the app, select payment cards, then choose the card you are using. I use the google prepaid card, tap it and at the bottom under userid if there is a number you are connected to the network.. If the network is down or you do not have connectivity you will see something that says "can't connect to bank". You can not make a purchase if you do not see your userid, I always open the app now and check while I'm waiting in line.

krichek said:
Any errors I've encountered could be chalked up to one of two things. Either the pad was not turned on/not connected (make sure there is a green light on the pad), or the network is down\you dont have a network connection.
The network has been somewhat spotty for me over the last day or two. Today it was down for almost 2 hours. An easy way to tell if the network is down is to look at the app, select payment cards, then choose the card you are using. I use the google prepaid card, tap it and at the bottom under userid if there is a number you are connected to the network.. If the network is down or you do not have connectivity you will see something that says "can't connect to bank". You can not make a purchase if you do not see your userid, I always open the app now and check while I'm waiting in line.
Click to expand...
Click to collapse
Thanks! I'll give that a shot(checking the user id) that sounds like it could be helpful.
@nyplaya
no, I don't have a case and I don't know if I have the latest updated version. I haven't checked because I didn't want to update and become a victim of the secure element error. I'm not exactly sure what the cause is and didn't want to risk it. But if its safe to do so, how do I find out if I have the latest version and where would I get it?
Sent from my Galaxy Nexus using xda premium

daledenton said:
Thanks! I'll give that a shot(checking the user id) that sounds like it could be helpful.
@nyplaya
no, I don't have a case and I don't know if I have the latest updated version. I haven't checked because I didn't want to update and become a victim of the secure element error. I'm not exactly sure what the cause is and didn't want to risk it. But if its safe to do so, how do I find out if I have the latest version and where would I get it?
Sent from my Galaxy Nexus using xda premium
Click to expand...
Click to collapse
you can do one of two things, follow the OP here:
Or you can try my little faster method: not sure if it is for the paid version only but if you download and install the APK of wallet, then use the app appmonster to backup the app, you can then simply select it in appmonster to view in the market and it bi-passes the restriction of the carriers in the normal market app it allows updating

[SIM unlocked] LG D693n Stylus turned "partially" SIM unlocked after Super-Sume

[SIM unlocked] LG D693n Stylus turned "partially" SIM unlocked after Super-Sume
I think this is weird enough for a new thread: I recently got this G3 Stylus and, as usual, I proceeded on rooting. This time using KingRoot. Done easily, I must admit. Now, since KingRoot installed some unwanted and "unreadable" stuff, I've turned my sight over Super-Sume (you know what it does)... Super-Sume performed it's job as expected, replacing everything it has to with Supersu. Following the process and right after reboot, something weird happend: my installed SIM card appeared as an "invalid SIM card". Rebooted again and still the same message. Turned off the phone, took the SIM card out, reinstalled, turned on again... same message. Device had lost network connection, but it was able to send and receive data!!!... started research about the particular issue, but found nothing similar anywhere. Then I've tried three SIM cards from different carriers and they worked flawlessly. Installed the "invalid SIM card" again (which is from the phone's original carrier, BTW) and the issue was still there. Then, about 12 hours later, data was lost as well and SIM became useless in this phone. Tested another card from the very same carrier and it was useless to; however, this two cards worked perfectly on three different phones, so not a card issue. Contacted Super-Sume developer and he told me there's NO relation between his app and such kind of issue. OK. Contacted carrier and they know nothing. OK. Next, I resolved to look for some hint at "Replace Kinguser with SuperSu" XDA thread, where fellow member "CVangelo" suggested to check if phone asks for unlock code. Well, it does. So the phone is SIM locked after all, but JUST FOR ONE CARRIER!!! which happens to be the phone's original carrier. Not to blame Super-Sume for the mess. Perhaps is a "gift" left from KingRoot due to getting rid of it. Or perhaps is just coincidental. Point is, this is clearly a weird issue as most of you can see; at least until somebody rises her/his hand with an explanation. Who's first?

CNK80Q3MX said:
Point is, this is clearly a weird issue as most of you can see; at least until somebody rises her/his hand with an explanation. Who's first?
Click to expand...
Click to collapse
Only thing I would say is that it is network locked but in the exact reverse of what you would expect. Never heard of such a thing or knew it was even possible. Is there anyone with experience in network locks who can explain exactly what kind of network lock this? It may help explain what might have happened and how.
Sent from my Nexus 7 using XDA Free mobile app

CVAngelo said:
Only thing I would say is that it is network locked but in the exact reverse of what you would expect. Never heard of such a thing or knew it was even possible. Is there anyone with experience in network locks who can explain exactly what kind of network lock this? It may help explain what might have happened and how.
Sent from my Nexus 7 using XDA Free mobile app
Click to expand...
Click to collapse
Hey... no one seems interested. I'm assuming no one will until someone else have the same issue. Though, I've been making some questions to some other "lock acquainted" people and most say it is kinda "blacklisted" lock "for sure". In such cases, the original carrier locks first; if you try another network carrier SIM, it will work for typically 3 to 5 more days and up to 8 (no more than that) then, that carrier will lock as well, and so on. Thing is, this phone IS NOT "blacklisted" (I've already made an inquiry for that in the global page) and there's about 17 days since original carrier network became locked. So... weirdness remains. On the other hand: How is that you're using "XDA free app"? I'm forced to use "Premium" because "Free" simply didn't work anymore on my devices. I like free version because it has more options and you can sign and stuff...

CNK80Q3MX said:
Hey... How is that you're using "XDA free app"? I'm forced to use "Premium" because "Free" simply didn't work anymore on my devices. I like free version because it has more options and you can sign and stuff...
Click to expand...
Click to collapse
Really? I didn't even know there was Premium version. What's even the point of that? Lol. Whaddaya mean, the Free version didn't work anymore? Mine just keeps on ticking...but I only started using it after I had been signed up on the website and participating on XDA via the desktop browser for ages. Had you signed up on the website, or only on the app?
BW, do you have the apk of the free app? I can send it to you if you don't.
Sent from my Nexus 7 using XDA Free mobile app

CVAngelo said:
Really? I didn't even know there was Premium version. What's even the point of that? Lol. Whaddaya mean, the Free version didn't work anymore? Mine just keeps on ticking...but I only started using it after I had been signed up on the website and participating on XDA via the desktop browser for ages. Had you signed up on the website, or only on the app?
BW, do you have the apk of the free app? I can send it to you if you don't.
Sent from my Nexus 7 using XDA Free mobile app
Click to expand...
Click to collapse
Well, signed both... "Premium" was once the paid app, as far as I know. I wasn't using "Free" app for a month or so; then when I required it again, it just didn't open. So I checked the store and they've turned "Free" into an earlier android versions app, thus it won't work for me anymore. Had to download "Premium" (now "Free") to keep going. If you can send the "Free" apk, I'll give it a try... Thanks!

(POSSIBLE SOLUTION) unfortunately the process com.android.phone has stopped

Hey everyone... I have read several posts about some roms prompting users that 'unfortunately the process com.android.phone has stopped'. I had this issue upon installing CM13 rom. Some people cannot even boot the rom ie. (and my case as well) Paranoid Android. When I was on CM13 I was able to make calls, but not receive them. I used my wife's phone to dial mine and as the first ring came, my phone would display the message about the phone process stopping. After some research I found that deleting cache and data from phone app might work. Well it didn't. I then caught a simtoolkit app... So I wondered about it. No idea what it does.. I don't use it... So i deleted it. I used a play store app that allows user to remove system apps with SU permissions of course. System App Remover by Jumobile.
Viola...the problem disappeared. I hope this helps some of you.
I tried booting Paranoid Android but immediately after 1+ boot logo it gives the 'unfortunately the process com.android.phone has stopped' repeatedly, not allowing me to proceed...however in the background there shows a password is needed to boot rom as well so I didn't bother with it. I read somewhere that removing the sim prior to boot will prevent that from popping up. I see some connection with that advice and my 'fix' involing the simtoolkit app.
Good luck
Update: Sun Jun 26. I advance wiped all but internal via TWRP. Installed BeanStalk ROM (1st time) and had same issue with incoming calls. Removed simtoolkit app and all is well. Just for good measure I proceeded to do the same with Resurrection ROM and Cyanogenmod 13 again. 4 different times, same issue, same solution. Sorry if this is already somewhere in a thread, but I couldn't find one.

So what you are saying is that you removed simtoolkit.apk from /system/apps and the com.android.phone force closing stopped? If so, that is great.
Does it affect the phones ability to place calls, or data at all? Does dual sim work?
If so, them I'll be able to flash and set up a custom ROM and still have the ability to keep work and personal cell on one device.
Sent from my ONEPLUS A3000 using Tapatalk

noobtoob said:
So what you are saying is that you removed simtoolkit.apk from /system/apps and the com.android.phone force closing stopped? If so, that is great.
Does it affect the phones ability to place calls, or data at all? Does dual sim work?
If so, them I'll be able to flash and set up a custom ROM and still have the ability to keep work and personal cell on one device.
Sent from my ONEPLUS A3000 using Tapatalk
Click to expand...
Click to collapse
I didn't go as far as to go into the filesystem. Ive got some understanding on it, but I simply relied on the app removal tool to do the work.
As for the dual sim capability, I can not answer...yet! I did think about it but I haven't tried. I'll pop in another sim card and confirm. I have no data/network issues as of writing. I can confirm that both sim slots pick up my sim though. But that's probably not much help. Ill report back.

Thank you sir. I'm in the road right now for business and don't want to flash until I get home and have solid backups just in case. But when I do I'll try this fix it and see what can happen.
Sent from my ONEPLUS A3000 using Tapatalk

Bought Unlocked Pixel 3 From Google, & T-Mobile Crammed an App Onto the Phone Anyway!

Bought Unlocked Pixel 3 From Google, & T-Mobile Crammed an App Onto the Phone Anyway!
How to make a customer very angry, and concerned about security...
Bought a brand-new Pixel 3 from Google, inserted my T-Mobile SIM card, (Goodbye Sony Xperia Series! Good Riddance!) and went about my business with my new Android 10 phone.
But a few days after, just today, I see a screen pop up that was pink - I asked me if I wanted to check and see if my phone was "eligible" for unlocking.
One surmises that T-Mobile noticed the new device ID associated with the same old SIM card, and downloaded the app WITHOUT PERMISSION AND WITHOUT ANY NOTICE THAT THEY WERE DOING SO. They also did not even bother to check the ID against their own inventory to determine if they had sold the phone or not, if they did, they would have seen that it was a Pixel, which they don't offer.
At no time did I visit a T-Mobile sit or download any T-Mobile related apps. They just took it upon themselves to silently install software without even asking.
So here's the punchline - what ELSE might they have installed, and how can I be sure about this?
What else might they install in the future? On whose behalf?

packetfire said:
How to make a customer very angry, and concerned about security...
Bought a brand-new Pixel 3 from Google, inserted my T-Mobile SIM card, (Goodbye Sony Xperia Series! Good Riddance!) and went about my business with my new Android 10 phone.
But a few days after, just today, I see a screen pop up that was pink - I asked me if I wanted to check and see if my phone was "eligible" for unlocking.
One surmises that T-Mobile noticed the new device ID associated with the same old SIM card, and downloaded the app WITHOUT PERMISSION AND WITHOUT ANY NOTICE THAT THEY WERE DOING SO. They also did not even bother to check the ID against their own inventory to determine if they had sold the phone or not, if they did, they would have seen that it was a Pixel, which they don't offer.
At no time did I visit a T-Mobile sit or download any T-Mobile related apps. They just took it upon themselves to silently install software without even asking.
So here's the punchline - what ELSE might they have installed, and how can I be sure about this?
What else might they install in the future? On whose behalf?
Click to expand...
Click to collapse
I noticed the same thing on my pixel 3 xl and I'm on Google Fi and I can't uninstall that app to unlock my phone, I can only disable the app

lavin40 said:
I noticed the same thing on my pixel 3 xl and I'm on Google Fi and I can't uninstall that app to unlock my phone, I can only disable the app
Click to expand...
Click to collapse
What's worse is that the app itself claims that you CAN remove the app, after it has (correctly) determined that the phone is not locked.
Is your app also a "T-Mobile" app with a pink icon, or is it a variant that is branded for the Google FI service?

packetfire said:
What's worse is that the app itself claims that you CAN remove the app, after it has (correctly) determined that the phone is not locked.
Is your app also a "T-Mobile" app with a pink icon, or is it a variant that is branded for the Google FI service?
Click to expand...
Click to collapse
The app is pink I believe I got a Verizon pixel 3 xl cause the OEM unlock option is greyed out so I can't even root the phone

During the initial setup, there is a "sneaky" screen that asks if you want to finish (or something, I forgot). But if you expand that screen, there are several apps that Google intends to install, and you can opt out right there. Duo is definitely one of the apps, and several T-Mobile apps (I'm on TMO) as well as some others. I opted out and don't have any TMO apps.

Just like the above comment, it's in your 'additional-apps' section of the initial setup. If you uncheck? It doesn't install.

jbarcus81 said:
Just like the above comment, it's in your 'additional-apps' section of the initial setup. If you uncheck? It doesn't install.
Click to expand...
Click to collapse
Yep. This. If the app(s) are installed it's because you let the setup install them. They (Google/T-Mobile) didn't install them on the phone without your consent. You just missed where you have the option to not install them.

ktmom said:
During the initial setup, there is a "sneaky" screen that asks if you want to finish (or something, I forgot). But if you expand that screen, there are several apps that Google intends to install, and you can opt out right there. Duo is definitely one of the apps, and several T-Mobile apps (I'm on TMO) as well as some others. I opted out and don't have any TMO apps.
Click to expand...
Click to collapse
Well, that must be how it was done - anyway, the app is gone now, all by itself, so it appears to be yes, an undetectable silent install of an undelete-able "system app", but it seems that once you are verified as "unlocked", it self-deletes.
But I got nothing but the "unlocker", no Duo installed for me. (I like Google Authenticator - 2FA without anything else to carry, and SIM-swap-proof).
So this was the paternalistic Google trying to be helpful, but creeping people out yet again with their presumptuousness.

packetfire said:
Well, that must be how it was done - anyway, the app is gone now, all by itself, so it appears to be yes, an undetectable silent install of an undelete-able "system app", but it seems that once you are verified as "unlocked", it self-deletes.
But I got nothing but the "unlocker", no Duo installed for me. (I like Google Authenticator - 2FA without anything else to carry, and SIM-swap-proof).
So this was the paternalistic Google trying to be helpful, but creeping people out yet again with their presumptuousness.
Click to expand...
Click to collapse
https://play.google.com/store/apps/details?id=com.tmobile.pr.mytmobile
Tmobile silently installed this app on my unlocked pixel 3xl from best buy just yesterday after I set up my playstore account!
As a User app though.

packetfire said:
How to make a customer very angry, and concerned about security...
Bought a brand-new Pixel 3 from Google, inserted my T-Mobile SIM card, (Goodbye Sony Xperia Series! Good Riddance!) and went about my business with my new Android 10 phone.
But a few days after, just today, I see a screen pop up that was pink - I asked me if I wanted to check and see if my phone was "eligible" for unlocking.
One surmises that T-Mobile noticed the new device ID associated with the same old SIM card, and downloaded the app WITHOUT PERMISSION AND WITHOUT ANY NOTICE THAT THEY WERE DOING SO. They also did not even bother to check the ID against their own inventory to determine if they had sold the phone or not, if they did, they would have seen that it was a Pixel, which they don't offer.
At no time did I visit a T-Mobile sit or download any T-Mobile related apps. They just took it upon themselves to silently install software without even asking.
So here's the punchline - what ELSE might they have installed, and how can I be sure about this?
What else might they install in the future? On whose behalf?
Click to expand...
Click to collapse
Just to show that it was indeed installed to the device...

dirtyreturn said:
Just to show that it was indeed installed to the device...
Click to expand...
Click to collapse
As stated in this thread, you accepted the install of the T-Mobile app during the setup process.

ktmom said:
As stated in this thread, you accepted the install of the T-Mobile app during the setup process.
Click to expand...
Click to collapse
That's just exclusive to the pixel 3? Stock Rom?
Just wondering since it's a first that this happened for me. Being on the same carrier with previous phones this did not happen.

dirtyreturn said:
That's just exclusive to the pixel 3? Stock Rom?
Just wondering since it's a first that this happened for me. Being on the same carrier with previous phones this did not happen.
Click to expand...
Click to collapse
I think I had to disable TMO apps during setup on my PH-1. I'm sure that Google has agreements with the carriers who offer the device. Even (esp?) when the device comes straight from Google.
And yes, stock ROM.