Is our phone phoning home to Google?
-
In the most recent post of Kyle Rankin, Chief Security Officer of Purism https://puri.sm/posts/snitching-on-phones-that-snitch-on-you/ is a pointer to an investigation about the facts what iOS or Android phones are doing when you think they do nothing: they are phoning home to Google or Apple with a lot of your sensitive data, details here: https://www.scss.tcd.ie/doug.leith/apple_google.pdf
The fact that our beloved Ubuntu phones are running an Android kernel and some other stuff behind the Ubuntu shell let me ask: Does the Android in our phones does the same, at least in parts?
-
When no networking applications are running... only one TCP connection I can see to the 188.166.168.0/21 DigitalOcean (hosting provider) US IP pool, port 5001/TCP, from service process, /usr/lib/ubuntu-push-client/ubuntu-push-client
Android / Vendor stuff is in the LXC sandbox, and as I can see, these processes have access to the network:root@ubuntu-phablet:~# lxc-info -n android Name: android State: RUNNING PID: 1416 IP: 10.15.19.82 IP: {my LAN WiFi IP here} -
@guru Ubuntu Tuoch doesn't use Android. Uses the Android kernel.
Hal blob libraries are loaded through Haliun (confined?)
-
@cibersheep said in Is our phone phoning home to Google?:
@guru Ubuntu Tuoch doesn't use Android. Uses the Android kernel.
Hal blob libraries are loaded through Haliun (confined?)
This is what I said as well: running an Android kernel. So, what is new in your reply?
-
@guru the new in my reply is that there is no Android in UT.
Kernel boots, loads libs through HalLium and Ubuntu is started
-
@guru only as much as your linux desktop is phoning home to amd or nvidia.
the android kernel is altered linux, and is open source so its only the drivers and I dont see why snapdragon would make drivers that call google. -
One could use an UNIX laptop as AP in station mode and monitore the connections the phone is doing in detail (as it was done in the mentioned investigation). Was this done with our Android kernel?
-
@guru I'm pretty sure thats what Markatafik did in there reply.
-
@guru You are all right in your own way. :))) You don't have to use the whole project to pull in malicious code. In the code can be a Time Bomb, or the code activated by a signal from the network, for example, tracking the transfer of some sequence of bytes, and may be working very rarely. If you do not have detailed source code with comments, and do not disassemble and reverse-engineer, but no one can give any guarantees. Including on the presence of all sorts of bookmarks or exploitable code. Even Google, Inc. management may not know about this. So even though components are used, not the entire Android system as a whole, no one can sign off on it. Ideally, the code should be free, and using a Virtual Machine is not a good practice. So there is room for development...
-
@markatrafik I Think its fair to say that Ubuntu Touch is absolutely "phoning home" but most likely none of it will be to google, a lot of data that's sent to google is with there priority apps, not the open source kernel, or the priority drivers.
The reason the PinePhone has kill switches, isn't because of the OS on top, but because if you use a sim, youre telling phone operators where you are at all time, you're giving them data and the only way to not do that is to turn off the modem.
Theres other bits of hidden software to, but the chances that its google is extremely low, because why add spyware there when you already have so much spyware that works a lot easier for you, in your apps that are default on all android phones?
-
Hello, thank you all for this interesting discussion.
@markatrafik , do you know what purpose is ubuntu push client ? Is it a server related to push for SMS for instance ?Another question, do you know what is the 10.15.19.82 address ? I have tried to reach it in a browser to find the owner without success.
Thank you !
-
@prog-amateur said in Is our phone phoning home to Google?:
@markatrafik , do you know what purpose is ubuntu push client ?
Is it a server related to push for SMS for instance ?
Perhaps, as in Android, apps maintainers can use this feature to report through the Cloud about changes in settings (for example: a new list of maps or remote servers), rather than when everyone is connecting to their Cloud and wasting battery of the phone.
Another question, do you know what is the 10.15.19.82 address ? > I have tried to reach it in a browser to find the owner without success.
Perhaps it is some kind of IP network for internal use, as I understand it, the external network may not be available, for example not given to DHCP for some reason, but communication within the phone is needed, within the same OS communication can be organized through localhost or named sockets, and here between different OSs.
I hope that people knowledgeable in the subject will correct me, I am purely out of general knowledge...
-
@prog-amateur said in Is our phone phoning home to Google?:
Hello, thank you all for this interesting discussion.
@markatrafik , do you know what purpose is ubuntu push client ?https://forums.ubports.com/topic/5185/is-ubports-still-phoning-home/11
-
@markatrafik Port 5001 is the push server registration...
-
What about alternative Android-based OSes 'free' of google services? ... Volla OS, lineage OS.. Are they phoning home to google? What happens if there is MicroG installed ?
-
What is "micro G"?
-
-
@domubpkm said in Is our phone phoning home to Google?:
What about alternative Android-based OSes 'free' of google services? ... Volla OS, lineage OS.. Are they phoning home to google? What happens if there is MicroG installed ?
Ubuntu Touch IS NOT PHONING google.
-
@keneda said in Is our phone phoning home to Google?:
Ubuntu Touch IS NOT PHONING google
Thank goodness for that !!
-
@domubpkm
IMHO alternative android based OSes are OK.
The problem comes from the apps.Google's android is a huge spyware. And major popular apps are too.
IDK about microG, but if it allows an app that requires Google suite to work then I don't think that's a good privacy-oriented idea.That is also why I don't need Anbox because bringing android apps to Ubuntu Touch will bring those privacy issues with them.
Yes confinement is now isolating android apps rendering them almost unusable.
And I'm afraid a better integration is possible by relaxing the confinement which I'm opposed to.Just my 2 cents.
