Killer apps for Android?

[DaFace]

Since there's an iPhone version, I figured I'd start a Droid version. After being handcuffed by Sprint's SERO plan for the past two years, I finally ordered my LG Optimus S last night. It'll be here in about 24 hours. So, what toys should I play with when it arrives?

[DaveNull]

Originally Posted by planetdoc

building your own gsm phone

[DaveNull]

Originally Posted by planetdoc

silent circle is not opensource (unlike textsecure) and is not free. In either case, the security of a communication app such as silentcircle is dubious on top of a system using propreity blobs of code.

Not trying to start a fight, but you're saying that any non-open source system is questionable?

[planetdoc]

Originally Posted by Fish

I've been pretty happy with WidgetLocker.

https://play.google.com/store/apps/d...w.widgetlocker

I've heard good things about it, but I've also read that it sits ontop of the default lockscreen.

Originally Posted by DaveNull

thats pretty neat. I didnt know anything about it and just did some reading. Looks like they have a base-station as well, and I dont know how legal that is unless they are broadcasting on public spectrum.

When I made that statement, I was speaking more about an arduino DIY phone or a raspberry pi based phone. If one thinks the sim or GSM module are compromised, it can easily be replaced compared to destroying the entire phone (burner phone).

Originally Posted by DaveNull

Not trying to start a fight,

understand, and I appreciate the discussion.

Originally Posted by DaveNull

but you're saying that any non-open source system is questionable?

any software that cannot be independently and openly audited (theoretically) must be considered suspect until proven otherwise. It has become pretty clear that many electronics (such as consumer routers for example) have been backdoored from the start.

The second operating system hiding in every mobile phone

Every smartphone or other device with mobile communications capability (e.g. 3G or LTE) actually runs not one, but two operating systems. Aside from the operating system that we as end-users see (Android, iOS, PalmOS), it also runs a small operating system that manages everything related to radio. Since this functionality is highly timing-dependent, a real-time operating system is required.

This operating system is stored in firmware, and runs on the baseband processor. As far as I know, this baseband RTOS is always entirely proprietary. For instance, the RTOS inside Qualcomm baseband processorsis called AMSS, built upon their own proprietary REX kernel, and is made up of 69 concurrent tasks, handling everything from USB to GPS. It runs on an ARMv5 processor.

The problem here is clear: these baseband processors and the proprietary, closed software they run are poorly understood, as there's no proper peer review. This is actually kind of weird, considering just how important these little bits of software are to the functioning of a modern communication device. You may think these baseband RTOS' are safe and secure, but that's not exactly the case. You may have the most secure mobile operating system in the world, but you're still running a second operating system that is poorly understood, poorly documented, proprietary, and all you have to go on are Qualcomm's Infineon's, and others' blue eyes.

The insecurity of baseband software is not by error; it's by design. The standards that govern how these baseband processors and radios work were designed in the '80s, ending up with a complicated codebase written in the '90s - complete with a '90s attitude towards security. For instance, there is barely any exploit mitigation, so exploits are free to run amok. What makes it even worse, is that every baseband processor inherently trusts whatever data it receives from a base station (e.g. in a cell tower). Nothing is checked, everything is automatically trusted. Lastly, the baseband processor is usually the master processor, whereas the application processor (which runs the mobile operating system) is the slave.

So, we have a complete operating system, running on an ARM processor, without any exploit mitigation (or only very little of it), which automatically trusts every instruction, piece of code, or data it receives from the base station you're connected to. What could possibly go wrong?

With this in mind, security researcher Ralf-Philipp Weinmann of the University of Luxembourg set out to reverse engineer the baseband processor software of both Qualcomm and Infineon, and he easily spotted loads and loads of bugs, scattered all over the place, each and every one of which could lead to exploits - crashing the device, and even allowing the attacker to remotely execute code. Remember: all over the air. One of the exploits he found required nothing more but a 73 byte message to get remote code execution. Over the air.

You can do some crazy things with these exploits. For instance, you can turn on auto-answer, using the Hayes command set. This is a command language for modems designed in 1981, and it still works on modern baseband processors found in smartphones today (!). The auto-answer can be made silent and invisible, too.

While we can sort-of assume that the base stations in cell towers operated by large carriers are "safe", the fact of the matter is that base stations are becoming a lot cheaper, and are being sold on eBay - and there are even open source base station software packages. Such base stations can be used to target phones. Put a compromised base station in a crowded area - or even a financial district or some other sensitive area - and you can remotely turn on microphones, cameras, place rootkits, place calls/send SMS messages to expensive numbers, and so on. Yes, you can even brick phones permanently.

http://www.extremetech.com/computing...phone-insecure

This is just one example of a secondary OS. As I previously mentioned, your SIM also has a small processor that runs a tiny kernel that can execute Java software. (The SIM card and its OS was recently hacked, incidentally.) If your computer has some kind of secure storage area, such as ARM’s TrustZone, there’s probably another separate OS and processor in there, too. The minuscule size of wimpy ARM cores and lack of documentation means that it’s very hard to tell just how many discrete OSes are running on your computer concurrently. In classic pre-internet, security-through-obscurity style, we won’t know how secure these OSes are until they’re (publicly) hacked. If the NSA wanted to deploy a wide-scale hack that gives it access to everyone’s phone calls, the baseband would be the place to do it.

The only real solution to this problem is to move away from closed-source hardware and software.

[DaFace]

I just discovered MightyText. Basically, it syncs your texts with an online interface so that you can read/respond to your texts from your computer. I was getting tired of Google Voice never updating anything, and it's a nice alternative.

[Bearcat]

Originally Posted by DaFace

I just discovered MightyText. Basically, it syncs your texts with an online interface so that you can read/respond to your texts from your computer. I was getting tired of Google Voice never updating anything, and it's a nice alternative.

Set it up after seeing it on Lifehacker last night... I'll probably drop it if Google ever does the same with Hangouts or Voice (assuming it supported MMS, too), but I'm liking it so far.

[DaFace]

Originally Posted by Bearcat

Set it up after seeing it on Lifehacker last night... I'll probably drop it if Google ever does the same with Hangouts or Voice (assuming it supported MMS, too), but I'm liking it so far.

Yeah, I'm in the exact same boat. I'd rather use Voice and keep it all under one system, but I've grown pretty tired of the lack of development on it over the years. There are plenty of rumors suggesting that Voice will finally be integrated into Hangouts in the summer, but for now, this will do nicely.

[nstygma]

is MightyText better than AirDroid? I see a lot of their functionality overlaps.

[DaFace]

Originally Posted by nstygma

is MightyText better than AirDroid? I see a lot of their functionality overlaps.

I haven't personally used AirDroid, but after looking over a couple sites I think it's a matter of focus. AirDroid does a lot of stuff (including sending/receiving texts), and does it reasonably well, while MightyText is focused specifically on texting, and does it great.

Here's a decent review that compares a few similar apps. (There are many other reviews online, but both have added features lately that have made old reviews obsolete.)

http://www.greenbot.com/article/2102...r-desktop.html

[DMAC]

In the last month, my S3 has slowed down to a crawl. It seems as if the memory is full, but its not. Apps taking many seconds to open. I don't want a new phone.

[Fish]

Originally Posted by DMAC

In the last month, my S3 has slowed down to a crawl. It seems as if the memory is full, but its not. Apps taking many seconds to open. I don't want a new phone.

Have you reset your phone in a while?

You might have an app that was updated and is now using more resources.

Hold down the Home button, then select Task Manager. It will show all running apps, and how much RAM and CPU it's using. Monitor that and see if you notice any apps going crazy.

Also go to Settings\Data Usage. Scroll down and it should show you a list of apps that have been using OTA data. See if any apps stand out as using considerable data.

[DMAC]

Originally Posted by Fish

Have you reset your phone in a while?

You might have an app that was updated and is now using more resources.

Hold down the Home button, then select Task Manager. It will show all running apps, and how much RAM and CPU it's using. Monitor that and see if you notice any apps going crazy.

Also go to Settings\Data Usage. Scroll down and it should show you a list of apps that have been using OTA data. See if any apps stand out as using considerable data.

Shit ya. It's Chrome. WTF? 0.98 GB in the last month. Is that from Google Now?

[Fish]

Originally Posted by DMAC

Shit ya. It's Chrome. WTF? 0.98 GB in the last month. Is that from Google Now?

Hard to tell. Do you have any open tabs that are refreshing or anything?

You might try to uninstall it, then reinstall it.

You can go to Chrome settings\Bandwidth Management and turn on "Reduce data usage".

[Bearcat]

Has to be an issue with Chrome unless you watch a lot of video via the browser or something is refreshing a lot... I'd make sure you're on the most current version and use the compression as Fish said. Syncing between devices crossed my mind, but that's still insanely high for a mobile browser.

Google Now will show up as Google Search under data usage.

[Bearcat]

Originally Posted by DaFace

Yeah, I'm in the exact same boat. I'd rather use Voice and keep it all under one system, but I've grown pretty tired of the lack of development on it over the years. There are plenty of rumors suggesting that Voice will finally be integrated into Hangouts in the summer, but for now, this will do nicely.

After a few day, it's pretty sweet... I've gotten text and phone notifications on my desktop before my phone sounds. Just started using the Gmail extension, too... Google should just buy it.

[Anyong Bluth]

Once the Android version of Cyber Dust is made available, I'll give it a try.

It automatically deletes your sent message 24 - 30 seconds once it has been opened by the person, and can block screen shots being taken of your message on most phone, but if one is taken it, it alerts you that one has been screen captured.