Knigu Dancig Baldaev Tatuirovki Zaklyuchennih
Aljternativnoe menyu dlya wince 6 0 800x480 2013. As of 12/2015 (update: 07/2018: the bug is still there), the default configuration of Stardict in Debian Sid uses dict.cn as the default dictionary. Additionally, as clipboard scanning is enabled by default, this means that as you start Stardict, your clipboard contents gets sent in the following HTTP (unencrypted) request: GET HTTP://dict.cn/ws.php?utf8=true&q=clipboard_content HTTP/1.1 r n It has been confirmed that if you use KeePassX, which by default uses “copy password to clipboard”, this password is immediately sent by Stardict in plaintext to this.cn server. A stock CM 12.1 was installed. During installation, all possible spy settings were turned off.
It is a common trend today that applications are leaking data to the network. This is an open-source and linux-oriented list of such applications.
Upon each boot, the device connects to android.pool.ntp.org despite having time synchronization disabled in settings. Additionally, the following HTTP request was observed: GET /generate_204 HTTP/1.1 User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; Nexus 4 Build/LMY48B) Host: connectivitycheck.android.com Connection: Keep-Alive Accept-Encoding: gzip This request has been disabled by “settings put global captive_portal_detection_enabled 0”. The NTP thing does not seem to be possible to disable. Strangely, we find no users solving this in public forums.
Please note that the sniffing was carried only on wifi. We don't have equipment to sniff mobile data at the moment. Api.samsungosp.com:443 despite all services are disabled in system settings and the phone has never been connected to any Google service. Brief sniffing on one popular network reveals similar patterns and requests are exposed by many other mobile phones too. Sometimes such requests apart from tracking.
I have hotfixed the problem using the following netfilter rules to allow only my favorite sites. Of course malware with sufficient privileges can add an exception to the firewall itself. Iptables -N CHECKALLOWED for ip in 46.167.245.0 / 24 77.87.241.0 / 24 77.240.96.0 / 24 37.46.80.0 / 24 91.213.160.0 / 24 90.183.101.0 / 24 192.168.0.0 / 16; do iptables -I CHECKALLOWED -d $ip -j ACCEPT done iptables -I OUTPUT -j CHECKALLOWED iptables -I OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A CHECKALLOWED -j REJECT Windows.