My LAN firewall logs were showing weird connexions at night from my phone, connected by WiFi, so I decided to play around and check how I could log network connections from Android.
My phone runs ParanoidAndroid version 4.4.4, which fortunately ships with iptables and all the nices kernel modules so I could just do:
iptables -A OUTPUT ! -o lo -j NFLOG --nflog-prefix "NFLOG " --log-uid
and see that it was logging stuff when browsing the web from my favorite app :
which indeed looks like firefox. The only issue is this weird timestamp 264504 which would be ~3 days but my phone was up for more than 19 days, oh well.
#!/usr/bin/rubyrequire"resolv"require"pp"defload_app_ids(f)res={}File.read(f).each_line{|l|caselwhen/<package/name=l[/name="([^"]+)"/,1]suid=l[/sharedUserId="([^"]+)"/,1]uid=l[/userId="([^"]+)"/,1]ifnameifuidres[uid]=nameelseres[suid]=nameendendend}returnresend$appsid=load_app_ids("packages.xml")logfile=ARGV[0]res={}File.open(logfile,"r+").each_linedo|l|ifl=~/\[([.0-9]+)\] "{NL}"IN=([^ ]*) OUT=([^ ]+) SRC=([^ ]+) DST=([^ ]+) LEN=([^ ]+) .+ PROTO=([^ ]+) SPT=([^ ]+) DPT=([^ ]+) .* UID=([0-9]+)/entry={}entry["time"]=$1entry["ifin"]=$2entry["ifout"]=$3entry["ipsrc"]=$4entry["ipdst"]=$5entry["len"]=$6entry["proto"]=$7entry["spt"]=$8entry["dpt"]=$9entry["name"]=$appsid[$10]key="#{entry['ipdst']}:#{entry['dpt']}:#{entry['proto']}"(res[key]||=[])<<entry["name"]res[key].uniq!endendres.eachdo|k,v|ip=k[/^([^:]+):/,1]key=k.dupbeginname=Resolv.getname(ip)key.gsub!(ip,name)rescueResolv::ResolvError=>eend# Ignore 'normal' stuff# next if key=~/1e100.net:(80|443)/# next if key=~/mozilla\.(com|net):443/# if v.include?("org.mozilla.firefox") and key=~/(80|443):TCP/# next# end# next if key=~/239.255.255.250:1900:UDP/puts"#{key} => #{v}"end
the script gets started this way, once the phone is connected:
WTF is that app ?!! There is no source code to be found, it seems the APK is slammed into the AOSP repo. It looks like it’s been removed for the future 5.0 release of AOSPA, and from what I could read it’s just some weird app for Sprint telco company that does stuff…. the apk has like half of all the possible permissions and tries to connect to some OVH IP (which actually might be a ntp.org pool server). I don’t want that ! The solution is:
root@hammerhead:/ # pm disable com.lge.SprintHiddenMenu
Package com.lge.SprintHiddenMenu new state: disabled
Some dude over there put online the result of his scans.
The (big) output file is in JSON which is easy to play with. He used his scan to sell his visualization tool but I don’t have time for this hipster-y stuff.
I know the web is being scanned all the time, and some results have already been made public, so what’s just after is no news.
Here is the transcribed romaji for all your karaoke purposes.
1) [Samayoeru tamashī no tame no kyōshikyoku ]
(Bohemian Rhapsody)
kore ga genjitsu ka
soretomo yume ka
ataman naka doshakuzure
genjitsu nara nigerare nē
kāsan ore, yacchatta
aitsu no atama ni jū o muke
hikigane o hii te uttan da
kāsan mō dame da yo ne
jinsei hajimatta bakkari na noni
kāsan ru rururu
naka nai de hoshii
ashita moshi ore ga kaera naku te mo
dōka dōka iki te itte hoshii
hitoni no otoko no kagebōshi
sukaramūshu dōkeshi odoreyo supein buyō
itten niwakani kakikumorya kaminari gorogoro inazuma pikkapika kowai
kirisutokyōto kirisutokyōto kirisutokyōto kirisutokyōto
kirisutokyōto no riyō shi san anta saikō da!
demo ore wa binbō mote nai otoko
dashi ka ni kare wa binbō kawaisō
korosu na kare o hido sugiru'
so da ? so da ? minogashi te kure
nan man dabu
akan minogase ma hen
minogashi te yare
minogase ma hen
minogashi te yare
minogashi te yare
minogase ma hen
zettai zettai minogase ma hen
akan akan akan akan akan akan
ofukuro ofukuro ofukuro tasuke te
maō bīruzubabu yo akuma o ucchatte kure yo
ore no tame ni ore no tame ni
------------------
2) [ jitensha kyōsō ]
(Bicycle race)
jitensha jitensha jitensha
boku nori tai na boku no
jitensha jitensha jitensha
boku nori tai na boku no jitensha ni
boku nori tai na boku noni
boku nori tai na boku no jitensha ni
doko demo suki na tokoro de
kuro? iya, shiro
hoero? iya, kame
same? choi to ossan
yamero yo ore wa jōzu mo
sutā wōzu mo kirai da yo
rōrusu? iya, ro isu
kami? erabasero
shu yo? iya, kirisuto
pītā pan mo
furankenshutain mo sūpāman mo
boku wa shinji nai
jitensha jitensha jitensha
boku nori tai na boku no
jitensha jitensha jitensha
jitensha jitensha jitensha kyōsō
------------------
3) [ goroshi ya joō ]
( Killer Queen )
jōtō na happō shu o oshare na tansu ni ire toi tari
'kēki de mo kuwashitoke ba' nante marude marī antowane
kenedi no shōtai mo furushichofu no sore mo 'itsu ki te mo yokutte yo' sonae bantan
chōzame no tamago to tabako o jōhin na shigusa mō honto suge ?
kanojo wa koroshi ya joō
kayaku kanten bakudan
jōzu na kōsen jū de
otoko o ichi koro itsu demo
u ? osusume suru ze
nekashi te mo kure nai kamo yo
sono ki ni natta kai?
------------------
4) [ hirameki ]
( Flash )
hirameki ā
uchū no kyūseishu
hirameki ā
kare wa kiseki sonomono
------------------
5) [ itsuka omae o yusaburu ]
( We will rock you )
urusee gaki domo sawai de iyagaru itsuka ōmono ni nan no kane
doro o kao ni tsuke mittomo nē
kan keri shi nagara utatteru
hora!
itsuka omae o yusaburu
bibirase te yaru ze kanarazu
bibirase te yaru ze kanarazu
------------------
6) [ mō ichi nin shinu ]
( Another one bites the dust )
sutību wa yōjinbuka ge ni tōri o aruku
kutsuoto ga hibiku sono toki kikan jū ga neratteru
ii suka? nē, junbi ii suka? inochi girigiri desho
soto ni derya dan ga ton de kuru bishibishi ba shibashi u wāi
mō hitori shinu buttaore te shinu
mata occhin da mata kutabatta jimen ni taore ta sore
nē nē kimi mo yacchau yo dakara mō hitori shinu
------------------
7) [ ai to yobareru iwayuru hitotsu no chinchikurin na koto ]
( Crazy little thing called love )
kore wa ai boku ni wa atsukai nikui
kore wa ai chanto torikuma nakuccha
junbi dekite nai chinchikurin na aitte yatsu ni
soko iku boku no kawai ko chan nekkara yurayura guruguru
boku o muchakucha unten suru kinchō kan to kōfun
demo ase mo hika nu ma ni abayō
------------------
8) [ warera yokozuna ]
( We are the champions )
nariyama nai hakushu no naka ojigishita
tomi to meisei sore nimatsuwaru iroiro na ii koto
okage sama
demo sore wa raku de wa nai chōshi no ii funatabi de mo nai
yuunareba chōsen da!
misumisu haji o sarasu wake nya ika nē ? ssu
kachisusumu no sa zūtto zūtto zūtto zu ?
warera yokozuna ssu tomodachi yo
senshūraku made tatakao u
warera yokozuna ssu warera yokozuna ssu
makekoshi yarō ni yō wa nai
datte warera yokozuna ssu sekai no