Get out of my phone !

My LAN firewall logs were showing weird connexions at night from my phone, connected by WiFi, so I decided to play around and check how I could log network connections from Android.

My phone runs ParanoidAndroid version 4.4.4, which fortunately ships with iptables and all the nices kernel modules so I could just do:

iptables -A OUTPUT ! -o lo -j NFLOG --nflog-prefix "NFLOG " --log-uid

and see that it was logging stuff when browsing the web from my favorite app :

root@hammerhead:/ # dmesg | grep NFLOG

<4>[264504.310460] NFLOG IN= OUT=wlan0 SRC=10.0.2.141 DST=91.198.174.204 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=55084 DF PROTO=TCP SPT=56159 DPT=80 WINDOW=1550 RES=0x00 ACK URGP=0 UID=10057 GID=10057 
<4>[264504.310930] NFLOG IN= OUT=wlan0 SRC=10.0.2.141 DST=91.198.174.204 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=55085 DF PROTO=TCP SPT=56159 DPT=80 WINDOW=1595 RES=0x00 ACK URGP=0 UID=10057 GID=10057 
<4>[264504.311754] NFLOG IN= OUT=wlan0 SRC=10.0.2.141 DST=91.198.174.204 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=55086 DF PROTO=TCP SPT=56159 DPT=80 WINDOW=1641 RES=0x00 ACK URGP=0 UID=10057 GID=10057 

Nice! Now to check what app is UID=10057

root@hammerhead:/ # grep -i "userId=\"10057" /data/system/packages.xml         
    <package name="org.mozilla.firefox" codePath="/data/app/org.mozilla.firefox-1.apk" nativeLibraryPath="/data/app-lib/org.mozilla.firefox-1" flags="572996" ft="14b3ba98788>
    <shared-user name="org.mozilla.firefox.sharedID" userId="10057">

which indeed looks like firefox. The only issue is this weird timestamp 264504 which would be ~3 days but my phone was up for more than 19 days, oh well.

I store that log on a file on my phone :

cat /proc/kmsg | grep NL > /mnt/shell/emulated/log &

Make some stupid ruby script :

#!/usr/bin/ruby

require "resolv"
require "pp"

def load_app_ids(f)
    res={}
    File.read(f).each_line {|l|
        case l
        when /<package/
            name = l[/name="([^"]+)"/,1]
            suid = l[/sharedUserId="([^"]+)"/,1]
            uid = l[/userId="([^"]+)"/,1]
            if name
                if uid
                    res[uid]=name
                else
                    res[suid] = name
                end
            end
        end
    }
    return res
end

$appsid=load_app_ids("packages.xml")

logfile = ARGV[0]
res={}
File.open(logfile,"r+").each_line do |l|
    if l=~/\[([.0-9]+)\] "{NL}"IN=([^ ]*) OUT=([^ ]+) SRC=([^ ]+) DST=([^ ]+) LEN=([^ ]+) .+ PROTO=([^ ]+) SPT=([^ ]+) DPT=([^ ]+) .* UID=([0-9]+)/
        entry={}
        entry["time"] = $1
        entry["ifin"] = $2
        entry["ifout"] = $3
        entry["ipsrc"] = $4
        entry["ipdst"] = $5
        entry["len"] = $6
        entry["proto"] = $7
        entry["spt"] = $8
        entry["dpt"] = $9
        entry["name"] = $appsid[$10]
        key = "#{entry['ipdst']}:#{entry['dpt']}:#{entry['proto']}"
        (res[key] ||= [] ) << entry["name"]
        res[key].uniq!
    end

end
res.each do |k,v|
        ip = k[/^([^:]+):/,1]
        key = k.dup
        begin
            name =Resolv.getname(ip)
            key.gsub!(ip,name)
        rescue Resolv::ResolvError => e
        end

        # Ignore 'normal' stuff
        # next if key=~/1e100.net:(80|443)/
        # next if key=~/mozilla\.(com|net):443/
        # if v.include?("org.mozilla.firefox") and key=~/(80|443):TCP/
        #    next
        # end
        # next if key=~/239.255.255.250:1900:UDP/
        puts "#{key} => #{v}"
end

the script gets started this way, once the phone is connected:

adb pull /mnt/shell/emulated/log .
adb pull /data/system/packages.xml .
ruby stuff.rb log

Some “weird” things happen :

"239.255.255.250:1900:UDP"=>["org.mozilla.firefox"],

Firefox does SSDP, it seems to discover second-screen devices.

"mygateway:4886:UDP"=>["org.mozilla.firefox"],

Now this is somewhat crazy. It looks like firefox will kinda hit your gateway on some randomly-chosen-then-hard-coded-UDP-port with a 0-length UDP packet to keep your wireless connection “live”.

And scarier :

"5.196.196.168:123:UDP"=>["com.lge.SprintHiddenMenu"]

WTF is that app ?!! There is no source code to be found, it seems the APK is slammed into the AOSP repo. It looks like it’s been removed for the future 5.0 release of AOSPA, and from what I could read it’s just some weird app for Sprint telco company that does stuff…. the apk has like half of all the possible permissions and tries to connect to some OVH IP (which actually might be a ntp.org pool server). I don’t want that ! The solution is:

root@hammerhead:/ # pm disable com.lge.SprintHiddenMenu                        
Package com.lge.SprintHiddenMenu new state: disabled

On further exploring, it looks like some kind of bloatware designed to make Sprint customers’ life a pain in the ass with weird activation process. It also hijack the telephony to catch magic numbers in order to do magical things.

UPDATE: this un-removeable app reboots your phone on recieving a specific intent… THANKS

Not-social font-faces

Nowadays, resisting peer pressure and trying to join as little as possible any kind of social network is very hard.

You need to be proud of resisting, and display your anarchism on your blog/webpage/whatever.

Yet you’re curious about how the web is made and want to be (kinda) part of it.

That’s why you want anti-@font-faces like those:

Code and fonts here

Playing with some internet scan

Some dude over there put online the result of his scans.

The (big) output file is in JSON which is easy to play with. He used his scan to sell his visualization tool but I don’t have time for this hipster-y stuff.

I know the web is being scanned all the time, and some results have already been made public, so what’s just after is no news.

SSL fun

 egrep "\"notAfter\": \"(200[0-9]|19)" Nmap-Modbus-IPv4.json | ruby -e "require 'json'; require 'pp' ; STDIN.each_line {|l|  JSON.parse(l)['ports'].each {|p| (p['scripts'] || []).each{|s| pp s['ssl-cert']['validity']['notAfter'] if s['ssl-cert']}}}"  | sort | head
"19031206150859Z"
"19040105065354Z"
"19060322212239Z"
"19060330212826Z"
"19060401212741Z"
"19060409211230Z"
"19060421204958Z"
"19060423210554Z"
"19060424212323Z"
"19060430204429Z"

Haha. Let’s check the winner here :

$ openssl s_client -connect 190.95.241.194:8888 -showcerts

depth=0 C = EC, ST = Napo, L = Papallacta, O = Ecoluz, CN = 190.95.241.194, emailAddress = drenbiedel@gmail.com
verify error:num=18:self signed certificate

Looks like ecuador had internet, and Gmail in 1903 !

Queen in japanese

Some awesome song from P-kawai :

Queen_-Megamix(Japanese_Version).mp3

Here is the transcribed romaji for all your karaoke purposes.

1) [Samayoeru  tamashī no tame no kyōshikyoku ]
(Bohemian Rhapsody)

kore ga genjitsu ka 
soretomo yume ka 
ataman naka doshakuzure 
genjitsu nara nigerare nē 

kāsan ore, yacchatta 
aitsu no atama ni jū o muke 
hikigane o hii te uttan da 
kāsan mō dame da yo ne 
jinsei hajimatta bakkari na noni 
kāsan ru rururu 
naka nai de hoshii 
ashita moshi ore ga kaera naku te mo 
dōka dōka iki te itte hoshii 

hitoni no otoko no kagebōshi 
sukaramūshu dōkeshi odoreyo supein buyō 
itten niwakani kakikumorya kaminari gorogoro inazuma pikkapika kowai 
kirisutokyōto kirisutokyōto kirisutokyōto kirisutokyōto 
kirisutokyōto no riyō shi san anta saikō da! 
demo ore wa binbō mote nai otoko 
dashi ka ni kare wa binbō kawaisō 
korosu na kare o hido sugiru'
so da ? so da ? minogashi te kure 
nan man dabu 
akan minogase ma hen 
minogashi te yare 
minogase ma hen 
minogashi te yare 
minogashi te yare 
minogase ma hen 
zettai zettai minogase ma hen 
akan akan akan akan akan akan 
ofukuro ofukuro ofukuro tasuke te 
maō bīruzubabu yo akuma o ucchatte kure yo 
ore no tame ni ore no tame ni 

------------------

2) [ jitensha kyōsō ] 
(Bicycle race)

jitensha jitensha jitensha 
boku nori tai na boku no 
jitensha jitensha jitensha 
boku nori tai na boku no jitensha ni 
boku nori tai na boku noni 
boku nori tai na boku no jitensha ni 
doko demo suki na tokoro de 

kuro? iya, shiro 
hoero? iya, kame 
same? choi to ossan 
yamero yo ore wa jōzu mo 
sutā wōzu mo kirai da yo 

rōrusu? iya, ro isu 
kami? erabasero 
shu yo? iya, kirisuto 
pītā pan mo 
furankenshutain mo sūpāman mo 
boku wa shinji nai 

jitensha jitensha jitensha 
boku nori tai na boku no 
jitensha jitensha jitensha 
jitensha jitensha jitensha kyōsō 

------------------

3) [ goroshi ya joō ] 
( Killer Queen )
jōtō na happō shu o oshare na tansu ni ire toi tari 
'kēki de mo kuwashitoke ba' nante marude marī antowane
kenedi no shōtai mo furushichofu no sore mo 'itsu ki te mo yokutte yo' sonae bantan 
chōzame no tamago to tabako o jōhin na shigusa mō honto suge ? 

kanojo wa koroshi ya joō 
kayaku kanten bakudan 
jōzu na kōsen jū de 
otoko o ichi koro itsu demo 

u ? osusume suru ze 
nekashi te mo kure nai kamo yo 
sono ki ni natta kai? 

------------------

4) [ hirameki ] 
( Flash )
hirameki ā 
uchū no kyūseishu 
hirameki ā 
kare wa kiseki sonomono 

------------------

5) [ itsuka omae o yusaburu ] 
( We will rock you )
urusee gaki domo sawai de iyagaru itsuka ōmono ni nan no kane 
doro o kao ni tsuke mittomo nē 
kan keri shi nagara utatteru 
hora! 
itsuka omae o yusaburu 
bibirase te yaru ze kanarazu 
bibirase te yaru ze kanarazu 

------------------

6) [ mō ichi nin shinu ] 
( Another one bites the dust )
sutību wa yōjinbuka ge ni tōri o aruku 
kutsuoto ga hibiku sono toki kikan jū ga neratteru 
ii suka? nē, junbi ii suka? inochi girigiri desho 
soto ni derya dan ga ton de kuru bishibishi ba shibashi u wāi 
mō hitori shinu buttaore te shinu 
mata occhin da mata kutabatta jimen ni taore ta sore 
nē nē kimi mo yacchau yo dakara mō hitori shinu 

------------------

7) [ ai to yobareru iwayuru hitotsu no chinchikurin na koto ] 
( Crazy little thing called love )
kore wa ai boku ni wa atsukai nikui 
kore wa ai chanto torikuma nakuccha 
junbi dekite nai chinchikurin na aitte yatsu ni 
soko iku boku no kawai ko chan nekkara yurayura guruguru 
boku o muchakucha unten suru kinchō kan to kōfun 
demo ase mo hika nu ma ni abayō 

------------------

8) [ warera yokozuna ] 
( We are the champions )
nariyama nai hakushu no naka ojigishita 
tomi to meisei sore nimatsuwaru iroiro na ii koto 
okage sama 
demo sore wa raku de wa nai chōshi no ii funatabi de mo nai 
yuunareba chōsen da! 
misumisu haji o sarasu wake nya ika nē ? ssu 
kachisusumu no sa zūtto zūtto zūtto zu ? 

warera yokozuna ssu tomodachi yo 
senshūraku made tatakao u 
warera yokozuna ssu warera yokozuna ssu 
makekoshi yarō ni yō wa nai 
datte warera yokozuna ssu sekai no 

Original from this website :

1) 
[さまよえる魂のための狂詩曲]
これが現実か 
それとも夢か 
頭ん中土砂崩れ 
現実なら逃げられねぇ

母さん 俺、殺っちゃった 
あいつの頭に銃を向け 
引き金を引いて撃ったんだ 
母さんもうだめだよね 
人生始まったばっかりなのに 
母さん ルルルル 
泣かないで欲しい 
明日もし俺が帰らなくても 
どうか どうか 生きていって欲しい

一人の男の影法師 
スカラムーシュ 道化師 踊れよ スペイン舞踊 
一天にわかにかき曇りゃ 雷ゴロゴロ 稲妻ぴっかぴか 恐い 
キリスト教徒 キリスト教徒 キリスト教徒 キリスト教徒 
キリスト教徒の理容師さん あんた最高だ! 
でも俺は貧乏 もてない男 
「誰かに彼は貧乏 可哀想 
殺すな 彼を ひどすぎる」 
そーだ そーだ 見逃してくれ 
なんまんだぶ
あかん 見逃せまへん 
見逃してやれ 
見逃せまへん 
見逃してやれ 
見逃してやれ 
見逃せまへん 
絶対絶対見逃せまへん 
あかんあかんあかんあかんあかんあかん 
お袋お袋お袋助けて 
魔王ビールズバブよ 悪魔をうっちゃってくれよ 
俺のために 俺のために

------------------

2)
自転車競争]
自転車 自転車 自転車 
ボク乗りたいなボクの 
自転車 自転車 自転車 
ボク乗りたいなボクの自転車に 
ボク乗りたいなボクのに 
ボク乗りたいなボクの自転車に 
何処でも好きなところで

黒? いや、白 
吠えろ? いや、噛め 
鮫?ちょいとおっさん 
やめろよ俺は ジョーズも 
スター・ウォーズも嫌いだよ

ロールス? いや、ロイス 
神? 選ばせろ 
主よ?いや、キリスト 
ピーターパンも 
フランケンシュタインも スーパーマンも 
ボクは信じない

自転車 自転車 自転車 
ボク乗りたいなボクの 
自転車 自転車 自転車
自転車 自転車 自転車競争

------------------

3)
[殺し屋女王]
上等な発泡酒を おしゃれなタンスに入れといたり 
「ケーキでも食わしとけば」なんて まるでマリー・アントワネット 
ケネディの招待も フルシチョフのそれも 「いつ来てもよくってよ」 備え万端 
蝶鮫の卵と煙草 お上品なしぐさ もうホントすげー

彼女は 殺し屋 女王 
火薬 寒天爆弾 
上手な光線銃で 
男をいちころ いつでも

うー お薦めするぜ 
寝かしてもくれないかもよ 
その気になったかい?

------------------

4)
[ひらめき]
ひらめき ああ
宇宙の救世主
ひらめき ああ
彼は奇跡そのもの

------------------

5)
[いつかおまえを揺さぶる] 
うるせえ ガキ共騒いでいやがる いつか大物になんのかね 
泥を頬に付けみっともねえ 
缶蹴りしながら歌ってる 
ほら! 
いつかおまえを揺さぶる 
ビビらせてやるぜ必ず 
ビビらせてやるぜ必ず

------------------

6)
[もう一人死ぬ]
スティーブは用心深げに 通りを歩く
靴音が響くそのとき 機関銃が狙ってる
いいすか? ねえ、準備いいすか? 命ぎりぎりでしょ
外に出りゃ弾が飛んでくる びしびしばしばし うわーい
もう一人死ぬ ぶっ倒れて死ぬ
またおっちんだ またくたばった 地面に倒れた それ
ねえねえ 君も殺っちゃうよ だからもう一人死ぬ

------------------

7)
[愛と呼ばれるいわゆる一つのちんちくりんな事]
これは愛 ボクには扱いにくい
これは愛 ちゃんと取り組まなくっちゃ
準備できてない ちんちくりんな愛ってやつに
そこいくボクのかわいこちゃん 根っからゆらゆら ぐるぐる
ボクをむちゃくちゃ運転する 緊張感と興奮
でも汗も引かぬ間に アバヨー

------------------

8)
[我ら横綱]
鳴りやまない拍手の中 おじぎした
富と名声 それにまつわる色々ないいこと
おかげさま
でもそれは楽ではない 調子のいい船旅でもない
いうなれば 挑戦だ!
みすみす恥を晒すわけにゃいかねぇーっす
勝ち進むのさ ずーっとずーっとずーっとずー

我ら横綱っす 友達よ
千秋楽まで闘おう
我ら横綱っす 我ら横綱っす
負け越し野郎に用はない
だって我ら横綱っす 世界の