Develop Bugs

HUGE security flaw

Anyone else uneasy that no matter what if someone finds your phone they can hook up to pc and have access to your internal storage?? Is there no way to change this and have a charge only option under usb?

If someone has your phone plugged into their computer, you either:
1) Are with them
2) Had your phone stolen.
If you have your phone stolen, there's nothing stopping them from battery pulling, going into recovery, and getting all your data from there (granted you're rooted).

Still ide rather not anyone including nosey friends get the pics of my ding dong off my phone with out my permission...
All kidding aside you see my point right

It's very simple, set a passcode and MTP does not show any data until the phone is unlocked.

beast67x said:
Still ide rather not anyone including nosey friends get the pics of my ding dong off my phone with out my permission...
All kidding aside you see my point right
Click to expand...
Click to collapse
I typically prefer nekkids of my gf on my phone vs sausage but to each their own

This is why you should likely have the ability to remote-wipe your device (via Software), and why you need to ponder very carefully what data you keep on your phone. The easiest way to avoid your friends finding pictures you'd rather they don't see is not to keep those pictures on your phone in the first place.
There are encryption-based Lockboxes which function on the Galaxy Nexus, and it does actually support Full-Disk encryption (with many bugs and downsides), but in short, you need to assume that anything on your phone is accessible to anybody who cares enough to take it from you. Remember, security never buys you safety against others getting your data, it just gives you time to respond before they can get access.

Wow how foolish of me. I totally didnt realize and i googled this an apparently no.one else did.either thanks

sluflyer06 said:
I typically prefer nekkids of my gf on my phone vs sausage but to each their own
Click to expand...
Click to collapse
Hahaha its my own sausage i swear.
Seriously though the guy above is correct. Locked my phone, plugged in, and no data shows.until i swipe and enter pin

There are also apps you can download to lock certain apps you don't want opened. (Gallery for instance)
I agree though, the safest and best bet is to set a password on your phone and be done with it!

beast67x said:
Hahaha its my own sausage i swear.
Seriously though the guy above is correct. Locked my phone, plugged in, and no data shows.until i swipe and enter pin
Click to expand...
Click to collapse
A setting for my Exchange server for my company that i work for reminds me each time setup my phone that they can remote wipe my phone. As can i From our Web Access portal for email. Just another option.
Will

Mine doesn't work that way.
I have a pattern set on my galaxy nexus. If I connect it to my computer the "internal storage" doesn't show up until I unlock the phone.
However, if you lost your phone, there are numerous ways to get your data. This applies to most phones out there
Sent from my Galaxy Nexus using XDA App

move the pics you don't want people to see into a hidden folder then they wont show up in the gallery

I have "gotya" installed. Not only will send me the gps location of my ohone command but also take a pic of the peraon using the phone when.an incorrect pin is entered. Screw wiping my phone ill just go get it myself

I could really use some advice from a technical standpoint please

Hi everyone. I recently got a T989 from Telus, to which I used an Ebay unlocked. Now first things first....I have never had my email account or any account hacked. My computers in my home are virus free, so I have eliminated them. Within a week of using my T989 with Mobilicity, my gmail account (which my phone knows the password to) was hacked and logged in by someone in the U.S (Gmail shows IP logins) and they spammed my entire contact list. Now I am trying to think of ways this could have happened, but I honestly think the phone may have a keylogger or something on it.
Here are the steps they had me carry out (and it did unlock the phone immediately).
Download and install necessary files
http://www.UnlockClient.com/SAMSUNG_USB_Driver.exe
http://www.UnlockClient.com/dotNetFx40_Full_setup.exe
Very simple procedure:
1. Enter your paypal email or start in demo mode
2. Type *#7284# and select USB - Modem
3. Type *#9090# and select [1] USB
4. Exit service menu and reboot the phone
5. Once phone rebooted connect the phone and computer
6. Wait until all drivers are installed
7. Click "Unlock" button
8. Enter 00000000
Here is the auction for this unlock I got. http://www.ebay.ca/itm/280852210909?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649
Is there anything there that I should worry about? Or is there any possibility they have someone routed everything I do on my phone through them? I am seriously worried about my online banking information and such. Thank you very much in advance.

not sure if serious?
- taz b.

Why wouldn't I be serious? Isn't this a legitimate conclusion? I don't have a lot of posts but I have been lurking for years. I am serious however.

Unlocking phone is really a matter of entering a simple code in one step. All your steps there including entering your PayPal account, connecting USB?? and installing drivers are unneccesary and sketchy at best.
I've seen some reputable phone unlocking sites but definitely never seen something like that from eBay.
If I were you I would try a darkside full wipe and go back to whatever was at a safe state before.
Sent from my SAMSUNG-SGH-T989 using XDA

Oh I have wiped many times. The problem is that I don't think any of that wipe stuff will go back to factory settings in those *# menus or for the modem settings etc.
I know an unlock code is all that is needed, but I bought from a website that couldn't find the code. This one offered and instant unlock by a program (like the ones shops use) to unlock.
I am also not dumb, the paypal account doesn't require a password or anything it is just a way to identify your keys.

wy2sl0 said:
Oh I have wiped many times. The problem is that I don't think any of that wipe stuff will go back to factory settings in those *# menus or for the modem settings etc.
I know an unlock code is all that is needed, but I bought from a website that couldn't find the code. This one offered and instant unlock by a program (like the ones shops use) to unlock.
I am also not dumb, the paypal account doesn't require a password or anything it is just a way to identify your keys.
Click to expand...
Click to collapse
And did you test your phone with a different sim card? Everything is functional?
As far as I know, the legitimate way and the only way to unlock a phone is through the codes generated by the datebase. All the reputable sites that unlock phones that I know of, all use codes to unlock. When I had bought my telus g2sx the store unlocked it using the code.

Something like a keylogger would be app level, not modem info or hardware level. Also, something transmitting every keystroke would use a LOT of data and battery.
First thing I would do, personally, is check my battery stats to see if any app was using a suspicious amount of battery.
In my opinion, it wouldn't make sense for a company who already got your money for an unlock service to install a key logger to spam your Gmail contacts.
Just my two cents. It would take a tremendous amount of technology to track everyone who used the service. Not to mention man hours in sifting through collected data.
Check the battery stats. Settings>About Phone>Battery Use.
Hope this helps in any way. Hacked accounts are always a bummer man.

Wierd, I used that site a week or two ago and nothing like that happened to me. Makes me worried now.
I didn't use ebay though, I did it directly from the site. You could always re-flash your phone to stock then update it, that would eliminate any possibility of odd software.

In step 1, did you run a program on your computer, on the phone or both?

anomy13 said:
Unlocking phone is really a matter of entering a simple code in one step. All your steps there including entering your PayPal account, connecting USB?? and installing drivers are unneccesary and sketchy at best.
I've seen some reputable phone unlocking sites but definitely never seen something like that from eBay.
If I were you I would try a darkside full wipe and go back to whatever was at a safe state before.
Sent from my SAMSUNG-SGH-T989 using XDA
Click to expand...
Click to collapse
If you want your phone as clean as possible then do this in recovery
go to mounts and storage format /data format /system format /cache format/emmc. Then flash the super wipe followed by the rom but remember doing it this way deletes everything from your phone.
Sent from my SGH-T989 using Tapatalk 2

probably had nothing to do with the unlock, but more likely you had soem one arp attack your wifi on an open hotspot and they just nabbed your password.
I fiddle with this in coffee shops all the time and i always leave with a list of facebook, youtube, gmail hotmail and other passwords.
I'm not a spammer, i just like to see how insecure things are and if any one is intelligent to use ssl... even though ssl can be stripped from a packet now lol

-Mr. X- said:
probably had nothing to do with the unlock, but more likely you had soem one arp attack your wifi on an open hotspot and they just nabbed your password.
I fiddle with this in coffee shops all the time and i always leave with a list of facebook, youtube, gmail hotmail and other passwords.
Click to expand...
Click to collapse
Isn't GMail SSL now?

Joe USer said:
Isn't GMail SSL now?
Click to expand...
Click to collapse
and ssl can be stripped from packets now. Intercept the packet and then use it to sign in. then profit.
an app to play with if you want to try it out for your self is faceniff for andorid.

-Mr. X- said:
probably had nothing to do with the unlock, but more likely you had soem one arp attack your wifi on an open hotspot and they just nabbed your password.
I fiddle with this in coffee shops all the time and i always leave with a list of facebook, youtube, gmail hotmail and other passwords.
I'm not a spammer, i just like to see how insecure things are and if any one is intelligent to use ssl... even though ssl can be stripped from a packet now lol
Click to expand...
Click to collapse
Any recommendations to protect yourself then?
sent from the darkside of the galaxy

Z-Man™ said:
Any recommendations to protect yourself then?
sent from the darkside of the galaxy
Click to expand...
Click to collapse
dont use open hotspots at coffee shops and stuff like that. look for the shady nerd in the corner, and i think there is an app that can detect if your wifi is being arp spoofed.
https://play.google.com/store/apps/details?id=com.gurkedev.wifiprotector&hl=en
i think there may be free ones too, i dont know. but that app will detect if your being attack by a man in the middle/arp spoofing

I don't use Wi-Fi hotspots since I have unlimited data on my phone. I really don't understand how this could've happened.

wy2sl0 said:
I don't use Wi-Fi hotspots since I have unlimited data on my phone. I really don't understand how this could've happened.
Click to expand...
Click to collapse
its not just your phone that is at risk for these attacks. anything you sign on with is if some one does the man in the middle attack, among other attacks.
Other reasons besides your phone unlocking are the root cause of your issue. It's unfortunate none the less but man in the middle password sniffing and fishing are the leading causes i see at work for your spamming hijacking. i work with this stuff daily.

wy2sl0 said:
I don't use Wi-Fi hotspots since I have unlimited data on my phone. I really don't understand how this could've happened.
Click to expand...
Click to collapse
Did you ever figured out if unlockclient.com had injected some malware in your device.
Has anyone on this site had problem with them or any developper had a chance to check what they are doing ?

G3 locked out help

Edit: when the device has no internet the email used to unlock the phone is useless. The phone should keep the email and pass locally. So don't forget you pin or let anyone enter the wrong thing. I had to factory reset it however it still retained root. Strange? I wasn't able to obtain any data so far. I may try to dig deeper with a recovery program but right now I no longer need use of the device (my son has a new toy, lol).
This is my phone. Before anyone says it's not trust me it is and I can prove it via old cell bills. And that Google still has it attached to the account.
I need back into it for a few very important photos relating to an accident a few months ago.
This model was on the us cellular network. It is not an active phone. (No data). Here is my problem, not being able to connect to data or wifi networks I am locked out because my son played with the 4 digit pin. The phone now asks for my email and password. Of which I know but the phone will not accept it. Thinking that I might have updated my password since I was on the G3 last I have tried all passwords that I know I have used and still nothing. This phone is also rooted. With stock jellybean.
Any help would be appreciated.

combatarms said:
This is my phone. Before anyone says it's not trust me it is and I can prove it via old cell bills. And that Google still has it attached to the account.
I need back into it for a few very important photos relating to an accident a few months ago.
This model was on the us cellular network. It is not an active phone. (No data). Here is my problem, not being able to connect to data or wifi networks I am locked out because my son played with the 4 digit pin. The phone now asks for my email and password. Of which I know but the phone will not accept it. Thinking that I might have updated my password since I was on the G3 last I have tried all passwords that I know I have used and still nothing. This phone is also rooted. With stock jellybean.
Any help would be appreciated.
Click to expand...
Click to collapse
You could go back to stock using KDZ. It will reset everything

dcop7 said:
You could go back to stock using KDZ. It will reset everything
Click to expand...
Click to collapse
I'm trying to avoid data loss. As I need the few images off the phone. After I get them off I really don't care what happens to the device.
march 16 per google was the last active date. From then till now it's only been a paperweight because I thought google backed up my images which isn't the case.
Does google keep passwords in a viewable manner in case I forgot one I used?
Edit: google doesn't save passes for viewing unless in your browser saved password section, however I wonder how it knows of a duplicate pass when changing the current one.

Phone hacked

I need help identifying what app or setting got me into this mess.
I think the hacker has adb access.
He shuts down apps.. etc
He is messing with the notifications.. i get ony a few. Sometimes they come in late.
I have made reset from samsung setting and the boot menu, AND I INSTALLED A NEW ROM (the one for my phone) WITH ODIN. Still the issue resurfaces.
I think my roomate installed smthg in it. He is on the house wifi and he is got a degree in networking (i think thats what it's called, we study in french in my country)
Please i need help.

If someone needs any further details, please ask.

Avoid the wifi network you suspect your hacker friend is on, reinstall the rom downloaded on another network and stay on 4G and see if it still happens? Also suspect your PC to be hacked...

Thx for replying,
I did format my pc but i have connected it to house wifi.. didn't notice anything out of order though.
I found out about the "Revoke USB debugging authorisations" option in Developer Options. I think it is working.

Today, since i made a new instagram account, i added a mutual friend. Turns out it was an old and lost account, and thats when i got the error from the video.
Fortunately, i fixed it by un.following the account and clearing the app storage.
I need to know what access does he have?

Can't upload the video, here's some shots.

Look no further than yourself for the cause of this... one way or another.
RX: Factory reset, change Google account password.
Stop with the social media crap and go mingle with real people.

This not about social media, it's about getting my phone back.
With my old account, I couldn't even talk to my messenger friend. Today, thats like having your phone number unreachable all the time, frustrating.
Please if you don't want to help don't, but no need for quick unhelpful replies.

Carch921 said:
This not about social media, it's about getting my phone back.
With my old account, I couldn't even talk to my messenger friend. Today, thats like having your phone number unreachable all the time, frustrating.
Please if you don't want to help don't, but no need for quick unhelpful replies.
Click to expand...
Click to collapse
How was it compromised?
Understand if it was compromised it's more than likely because you left yourself vulnerable to attack.
A compromised OS needs to be cleaned or wiped... I gave you the solution(s).
No need to say thanks but don't give me lip about your screw ups.

Thank you.
I tried factory reset more than 10 times, different ways. No luck.
I think he is got access to one of my friends account but i don't know how he is using this connection with me ( message, notification.. i don't know)
@blackhawk what you said is true, and i didn't mean no offense.

Carch921 said:
Thank you.
I tried factory reset more than 10 times, different ways. No luck.
I think he is got access to one of my friends account but i don't know how he is using this connection with me ( message, notification.. i don't know)
@blackhawk what you said is true, and i didn't mean no offense.
Click to expand...
Click to collapse
Reflash the firmware especially if it is Oreo or below.
If it's not embedded in the firmware, it's being added by you albeit inadvertently.
Your Achilles heel is social media... don't be so predictable. Break the link in the chain.
None of the social apps should be running on the device, they are malware. At least keep them in the cloud.
Email must always be kept in the cloud and any attachments downloaded from it scruntinized or preferably not downloaded at all. All downloads are suspect.
At this point your data base is suspect as well.
Insanity is doing the same thing over and over, expecting a different result.

Android 11.
I am trying.

Carch921 said:
Android 11.
I am trying.
Click to expand...
Click to collapse
Unless someone physically got their hands on it, there's no known way the Android 11 stock factory image can be compromised by a rootkit or virus. A factory reset is all that is needed.
The problem happened after the reset.

blackhawk said:
Unless someone physically got their hands on it, there's no known way the Android 11 stock factory image can be compromised by a rootkit or virus. A factory reset is all that is needed.
The problem happened after the reset.
Click to expand...
Click to collapse
That is exactly what i suspect did happen. I often leave my phone home and my pattern is known for him.
How can i undo a modification of that level.
(I intend to go to a phone repair shop and install new soft with the "box". Is this recommended or is it a bad idea)

Carch921 said:
That is exactly what i suspect did happen. I often leave my phone home and my pattern is known for him.
How can i undo a modification of that level.
(I intend to go to a phone repair shop and install new soft with the "box". Is this recommended or is it a bad idea)
Click to expand...
Click to collapse
Never leave a phone physically unsecured as that's the only real security there is.
You need to have the firmware reflashed then be careful what you put back on it.
Change all your passwords and use secure passwords.

I ithink i this is the problem.( in the pic below)
There was an app called android device.. don't know if this is normal. So i deleted it and restarted and things are back to normal.

Sorry i can't upload the image, the app closes automatically.

Scan it online with Virustotal.

Sell the phone Facebook

Question PIN unknown, owner deceased :( Need to open the phone w/o wiping it

Is there a way to get into the phone after a reboot if the PIN is unknown? The owner died and the family needs to get into the phone. Any pointers appreciated. Thanks!

bitdisturbed said:
Is there a way to get into the phone after a reboot if the PIN is unknown? The owner died and the family needs to get into the phone. Any pointers appreciated. Thanks!
Click to expand...
Click to collapse
It is out there on how to do it, search for it, because we cannot know if this is indeed a truthful and/or legal request we can not answer. Sorry!

"it's out there" - yeah, I figured that much. I'm not about to upload a death certificate on a public board, you'll have to forgive me. Any actually helpful pointers to get this done? Just trying to help the family. Thanks.

Android All_In_One_Tool maybe

Is Jack Bauer involved?

I wish! He'd have the thing enter it's own code just by giving it an angry stare

So I found the tool mentioned above, not quite sure which function I'd use to take a crack at it. Best option would be a giant "remove pin" button, highlighted in yellow for me, lol... The 9 Pro isn't explicitly stated as supported either, hope that's not an issue in this case. Am I going to Recovery/Flasher and Device Rooter or Decrypt internal storage?

Any new Oneplus phone that has a PIN also has FBEv2. Everything that matters on the phone is encrypted at rest.* Even if you bypass lock screen, you need the PIN to open any data in the phone. If the bootloader is unlocked, you can try backing up data with a custom recovery like TWRP or orangefox, but most if not all files stored in internal storage is encrypted.
Basically, if the PIN is lost, bypass the lock screen is no use and you can wipe the data now. See if the PIN is written down somewhere

Mmm was the phone linked to Google? It could be what you're after has been uploaded to Google drive ( photos etc)

its worth a shot
Hacker earned $70,000 for finding a way to bypass Google Pixel’s screen lock - IT World Canada
A security researcher, David Schütz has received a $70,000 bug bounty after inadvertently discovering a Google Pixel lock-screen bypass hack that solved a high-severity security problem on all Pixel smartphones that could easily be exploited to unlock the devices.
www.itworldcanada.com

Let the dead rest in peace , stop messing with his phone.

ElitePotato said:
Let the dead rest in peace , stop messing with his phone.
Click to expand...
Click to collapse
Gotta hide em secrets buried

ElitePotato said:
Let the dead rest in peace , stop messing with his phone.
Click to expand...
Click to collapse
Alright, in the end the family opted for that. Thanks for all your help, learned a few things from you guys (and gals, possibly)