Motorola cell phones are regularly phoning home

This seems related to Motorola&#x27;s MOTOBLUR system: <a href="http://en.wikipedia.org/wiki/Motoblur" rel="nofollow">http:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Motoblur</a><p>In all fairness, it seems that the implementation uses a middle server (pretty common in big companies where good engineering isn&#x27;t a requirement) where log in data is sent, is stored in the users&#x27; profile and where timelines and other content is parsed before being sent back to the user&#x27;s device, in a &quot;dumb&quot; format that the BLUR system can understand.<p>Nokia has a bit of the same for their low-end phones (understandably) and BlackBerry used to do much of the same. Yet, in those days, and in an Android phone that can easily connect to social networks on its own, this seems like a very unfortunate techncial decision.<p>In other words: the official Gmail app, Twitter or Facebook apps are unlikely to be &quot;compromised&quot;.

I noticed that my Droid 4 running 4.1.2 was opening an XMPP connection to Motorola servers a month ago. I was watching the logs trying to diagnose another problem, and the XMPP connection happened to be failing at the time. The XMPP connection is no longer failing.<p><pre><code> D&#x2F;CheckinProvider( 507): insertEvents Process tag not allowed: XMPPConnection I&#x2F;XMPPConnection( 772): Preparing to connect user XXXXXXXXXXX to service: jabber1.cloud2.sdc100.blurdev.com on host: jabber-cloud2-sdc100.blurdev.com and port: 5222 E&#x2F;PacketReader( 772): at org.jivesoftware.smack.PacketReader.parseXMPPPacket(PacketReader.java:503) D&#x2F;CheckinProvider( 507): insertEvents Process tag not allowed: XMPPConnection I&#x2F;XMPPConnection( 772): Shutting down connection for user XXXXXXXXXXX to host jabber-cloud2-sdc100.blurdev.com W&#x2F;System.err( 772): at org.jivesoftware.smack.PacketReader.parseXMPPPacket(PacketReader.java:503) E&#x2F;XMPPConnectionManager( 772): Failed to connect user &#x27;XXXXXXXXXXX&#x27; to host &#x27;jabber-cloud2-sdc100.blurdev.com on port 5222: Connection failed. No response from server.:</code></pre>

Since lots of this data is sent through not encrypted HTTP, this means that NSA (and any other intelligence agency) can also get all this data...<p>Then people wonder the &quot;nothing to hide&quot; well, you might not, but will everyone you know be bothered you are sending their e-mails around to intelligence agencies?

Wait, am I understanding correctly that your Facebook password (for example) is being shared with Motorola?

If true, it&#x27;s surprising that it took so long for someone to find this. Isn&#x27;t it trivial to check on what your phone is sending off if you use wifi with a network scanner?<p>With that said I bet this is all for their social networking integration, some engineer thinking it would be cool for them to aggregate all your social data in the cloud, with no concept of the privacy implications.

Why did it take someone 2 years to spot this????? Doesn&#x27;t anybody care to watch what&#x27;s going in&#x2F;out of their appliances any more?<p>Furthermore, if this report is true: why aren&#x27;t there more tools out there so that there are more eyes watching this stuff? Or is everyone just too busy being &quot;social&quot; ??

Small nit to pick: IMSI + IMEI aren&#x27;t enough to clone your phone - the SIM card stores a shared secret used for challenge-response authentication with the network, and the device (theoretically) can&#x27;t read the secret, only send the SIM a challenge and get the response to send to the network.

I thought this is well know information. Motoblur always restores your accounts with passwords after factory reset. It is not even possible to start phone without logging in to your Motoblur account.<p>Anyway Cyanogen solved problem on my Defy.

Isn&#x27;t that the whole point of the Blur service...it logs into all these social services and combines them to produce a unified presentation? How else could it work?

I&#x27;m sure the servers that this data is stored on are completely locked down from malicious employee access, are protected by a diligent legal department from overzealous government access and above all completely safe from malicious external threats. Oh and I bet the logging is water tight.

Basically, I need to make all of my technological tools out of raw steel, silicon and wood and then I&#x27;ll be OK, but otherwise, somebody&#x27;s monitoring me. Right?<p>* sigh *<p>Well, if I must...

The author seems perplexed that Motorola is not collecting information from Google or Gmail accounts. This is probably because they already have the information: remember that Motorola is owned by Google.

Account passwords?! WTF?<p>Just curious, were these devices manufactured before or after Google acquisition?

This is unacceptable!

Further evidence that no matter how &quot;free&quot; and &quot;open&quot; Android may be in theory, manufacturer and carrier modifications make it no better (and in this case worse) than the iPhone in practice.

My next phone probably won&#x27;t be a Motorola then.<p>Does anyone know if this is a part of the Android Kernel? If it is it means they&#x27;ve modified the source code and they&#x27;re obligated to share their changes.

Fuck you, Motorola. Why do you want my login and password information for?? Your EULA is nothing but a fraud. I smell lawsuit.<p>Wait, isn&#x27;t Motorola owned by Google now???

Is this not grounds for a major investigation? I&#x27;m not familiar with the law, but I know that there&#x27;s been a number of cases of people that added RATs to their applications they created to monitor all traffic on that computer and email them passwords.<p>That&#x27;s pretty much the exact same thing. Although: &#x27;Never attribute to malice that which is adequately explained by stupidity.&#x27;

Motorola has never been one of my favorite cellphone brands but after this I am never buying a Motorola phone.

I&#x27;ve been wondering if there&#x27;s any reason to actually keep the original OEM modified operating system instead of replacing it with a vanilla Android installation. I haven&#x27;t found any but it seems that there are now compelling reasons to <i>not keep</i> it in any case.

Question - Can I trust cyanogenmod binary? Compile the rom from source. Question - Can I trust cyanogenmod source? ????, no idea, have to trust some one. (Remembering an argument from GEB about uncertainty).

[from the article]<p><pre><code> *&quot; I was using my personal phone at work to do some testing related to Microsoft Exchange ActiveSync. In order to monitor the traffic, I had configured my phone to proxy all HTTP and HTTPS traffic through Burp Suite Professional - an intercepting proxy that we use for penetration testing - so that I could easily view the contents of the ActiveSync communication. Looking through the proxy history, I saw frequent HTTP connections to ws-cloud112-blur.svcmot.com mixed in with the expected ActiveSync connections.&quot;* </code></pre> Whoever said that this has nothing to do with ActiveSync; You are being disingenuous.

What are some of the good tools on Android to monitor all network traffic incoming or outgoing of the phone? Like a super sniffer app for TCP, SMS, 3G&#x2F;4G data.

This reminds me of the Nokia HTTPS proxy incident.

Samsung must be rubbing their hands with glee :-)

Everyone should immediately install CyanogenMod upon booting up their Android phone.<p>Spyware like this is depressingly universal among carriers.

I believe that the keyword here is &quot;ActiveSync,&quot; which is another Microsoft product.<p>Since I made a conscious effort (years ago) to remove all Microsoft products from my life, ActiveSync is another app which I have never used.<p>Who needs it?