So I got Fairphone 4, with /e/ os, a couple of days ago. When I connected it to my NextDNS I saw that it was trying to connect to some weird addresses, like every 5-10 minutes. I searched Internet a bit and found out that it was something with snapdragon cpu and location services. I travel a lot and use Organic Maps for navigation, so location was enabled almost all day on the phone. I turned off location services and connections stopped, and everything was fine for a couple of days.

Today I came home, checked logs in NextDNS and saw that phone started doing the same connections almost constantly even with location turned off.

Can I do something about this, other than allowing these connections? These connections are probably so numerous because they are getting blocked. If I allowed them, phone would maybe call home once in a couple of hours. I would rather not allow them, but I don’t want 20% of battery to be eaten by this.

  • MigratingtoLemmy@lemmy.world
    126·
    1 year ago

    I found a few links summarising this:

    On 4th and 5th generation Pixels (which use a Qualcomm baseband providing cellular, Wi-Fi, Bluetooth and GNSS in separate sandboxes), almanacs are downloaded from https://qualcomm.psds.grapheneos.org/xtra3Mgrbeji.bin which is a cache of Qualcomm’s data. Alternatively, the standard servers can be enabled in the Settings app which will use https://path1.xtracloud.net/xtra3Mgrbeji.bin, https://path2.xtracloud.net/xtra3Mgrbeji.bin and https://path3.xtracloud.net/xtra3Mgrbeji.bin. GrapheneOS improves the privacy of Qualcomm PSDS (XTRA) by removing the User-Agent header normally containing an SoC serial number (unique hardware identifier), random ID and information on the phone including manufacturer, brand and model. We also always fetch the most complete XTRA database variant (xtra3Mgrbeji.bin) instead of model/carrier/region dependent variants to avoid leaking a small amount of information based on the database variant.

    Note sure if e/OS/ has taken as much care as Graphene has to make the requests more private. Then again, they don’t claim to be the most private OS, just De-Googled.

    Edit: this is also a good read for further attempts to make your device more private: https://grapheneos.org/faq#other-connections

    • Cossty@lemmy.worldOP
      2616·
      1 year ago

      Android is so troublesome, I am tempted to just install Ubuntu Touch and be done with this.

      • Deckweiss@lemmy.world
        461·
        1 year ago

        I have a linux phone on the shelf, because in real life I need apps that are only available on android …

      • MigratingtoLemmy@lemmy.world
        17·
        1 year ago

        Ah, it’s just a quirk of e/OS/. Nothing much - and you can run a DNS filter on your mobile to get rid of this problem (Bonus: won’t take too much of battery since it’ll not be operating a VPN since you’re root)!

        I haven’t heard much about Ubuntu Touch - does it work well?

        • Cossty@lemmy.worldOP
          42·
          1 year ago

          I am kind of new to all these privacy things. So what do you exactly mean by getting rid of this problem? I have DNS which blocks these connections but phone is still making them. How can I make the phone stop doing that?

          Ubuntu Touch is just a linux distro for your phone. I actually haven’t used it yet, but according to their website, the Fairphone 4 has really good support. So I might try it.

          • MigratingtoLemmy@lemmy.world
            81·
            1 year ago

            Ah, I didn’t manage to recollect your mention of NextDNS in your post. There’s no need to change anything regarding your DNS settings in such a case; it won’t take much of your battery.

            Here’s a related discussion on the /e/OS forum: https://community.e.foundation/t/qualcomm-chipsets-data-collection-linked-to-the-a-gps-service-in-e-os/48982. Note that the domain mentioned in the discussion is izatcloud.net, however, for your purposes you can consider it the same as the domains you’re seeing.

            What can /e/OS do?

            The SUPL-A/GPS case is well-know for a long time. Though it’s probably a low impact case in term of user’s privacy, we are evaluating how to prevent or mitigate it in /e/OS.

            Options we have today:

            1. Block SUPL requests using /e/OS’ Advanced Privacy tracker control. But that would probably kill the A/GPS service, making the GPS location service very, very slow.
            2. Proxy SUPL requests to anonymize their originr. That’s an option but it can be blocked if we send too much traffic to the SUPL servers. This would likely happen because /e/OS has a lot of users, and would have an impact in term of service continuity.
            3. Figure out how /e/OS users can use Advanced Privacy IP scrambling features to fake SUPL calls origin IP address.
            4. …?

            You might want to try option 1 and check. Please revert back to this comment after attempting to do so, so that others can benefit from this idea.

            XTRA uploads the following data types: a randomly generated unique ID, the chipset name and serial number, XTRA software version, the mobile country code and network code (allowing identification of country and wireless operator), the type of operating system and version, device make and model, the time since the last boot of the application processor and modem, and a list of our software on the device

            They just forgot to mention that this data is sent with no encryption (except in the xtra3grc.bin format, hope that they’re exclusively using that now…). Of course it should be blocked. But it’s necessary to allow one of those 3 domains in order to make the GPS work properly.

            And here’s the Wikipedia article on what is it that the Qualcomm chip is trying to gather: https://en.wikipedia.org/wiki/Assisted_GNSS

            • Cossty@lemmy.worldOP
              51·
              1 year ago

              Thx for very detailed reply. I was trying to do the option 1, but I couldnt find how to do that. I am guesing that because dns is blocking the requests they dont show in the app. That would mean the app and dns are doing the same thing, so it doesnt really help.

              I might just allow them, because I need the gps to work properly.

              • MigratingtoLemmy@lemmy.world
                2·
                1 year ago

                I don’t have experience with e/OS/, I can only really say what I gather from their documentation.

                Note that:

                when I activate fake location in AP but keep location turned off in system settings the app organic maps does not show my fake location but asks me to enable location. Therefore I presume: Yes, location off in system settings means no location for any app.

                The thing about modern android and location settings is that when it is turned off that also means the GPS. So probably correct, no location for any app.

                Link to discussion: https://community.e.foundation/t/advance-privacy-fake-location-with-location-turned-off/50052

                I would suggest utilising the Fake my location toggle for when you would not like apps to access your location, however, I am not sure if it will work against requests from low-level firmware such as directly from a Qualcomm chip. That’s a question for the developers.

                Another point that is mentioned in this post is the fact that tracker detection and blocking (which is now native to e/OS/) can’t work with DoT providers like NextDNS. Indeed, the app and the DNS filters you’re using with your DNS provider attempt to do the same thing here.

                Note that the “tracker manager” of Advanced Privacy can’t work with DNS over TLS (DoT).

                • Cossty@lemmy.worldOP
                  1·
                  1 year ago

                  I use location only for/with Organic Maps, otherwise it is turned off, so using fake location seems pointless.

                  It looks like if I want to use gps without problems I have to allow these connections. Or switch to pixel and GrapheneOS. Other chip makers like mediatek, samsung probably have something similar, so that isnt option either. I just got this FP4 and I like it alot, so I guess I’m stuck with qualcomm getting some telemetry.

                  Thank you very much for your help.

          • codenul@lemmy.ml
            1·
            1 year ago

            Just a heads up - Been following UT for some time and the major for me is that there is currently no VolTe support. Major bummer for US folks. There’s workarounds, at least for pixel3a but its not 100% reliable.

            Also SMS / MMS can be troublesome as well. Can’t download images while on WiFi??? Group MMS doesn’t work.

            Great system, works well but I can’t make it my daily driver

        • 0x2d@lemmy.ml
          1·
          1 year ago

          i tried it on my pixel 3a, its neat, and i can run android apps in waydroid, but I don’t like the navigation

      • whale@lemm.ee
        21·
        1 year ago

        Is that still being developed?

        I guess if it’s not, you can always go back to… Umm… Well KaiOS is a smart disaster. We don’t even have dumb phones anymore

          • whale@lemm.ee
            2·
            1 year ago

            KaiOS really peaked in 2018; since then, major companies including Google, Facebook, and Microsoft have backed away from it. For example, there is no more speech to text because Google ran away, and there is no more WhatsApp in KaiOS 3.0.

            Despite it being mostly closed source, I do hate to say that.

    • Pantherina@feddit.de
      45·
      1 year ago

      GrapheneOS really is the only Android that should be used. I hope e/OS and others just fork it, add a nicer UI and all.

  • 𝒍𝒆𝒎𝒂𝒏𝒏@lemmy.one
    481·
    1 year ago

    The Qualcomm chipset is making these requests, most likely for GPS almanac data (satellite positioning).

    Older chipsets send these almanac requests to izatcloud.net, unencrypted, containing your IMEI. No idea if newer chipsets have improved things though.

      • noride@lemm.ee
        184·
        1 year ago

        That really isn’t entirely true anymore since the TPM ecosystem came into existence. I can remotely wipe any pc at my company even if it’s stolen and reformatted because a hardware chip will phone home the second a compatible os is installed and internet access is available.

        • Skull giver@popplesburger.hilciferous.nl
          172·
          1 year ago

          The TPM can’t do anything. The Intel Management Engine and AMD Platform Security Processor can, but the TPM is just key storage.

          That stuff is disabled unless you buy expensive business options, though. Intel makes a lot of money not putting the fancy smart stuff into their desktop platforms.

          For remote wipe you also need to get lucky because if the thief doesn’t install the necessary drivers. Enabled encryption should prevent your company’s data from falling into the wrong hands, of course.

          • MigratingtoLemmy@lemmy.world
            4·
            1 year ago

            I think unless the HAP bit is specifically set to 1, Intel ME is still active on consumer boards, just without an interface for the OS to interact with it. Not sure if someone has hacked an OEM UEFI/BIOS to interact with it, but I have seen a different MAC address from my PC on my network before, and this is without any virtual adapters. This is the only explanation I can come up with.

              • MigratingtoLemmy@lemmy.world
                2·
                1 year ago

                Thanks for your comment, much appreciated! Could you provide a source for someone who has reverse-engineered a recent version of ME and has found not much incriminating behaviour for consumer motherboards?

                Unfortunately, me_cleaner doesn’t seem to work too well with newer chips. Fortunately for me, I’m planning to purchase older computers, but for people who aren’t, this doesn’t help much (as far as I can see).

                Thank you for the idea of extracting the BIOS to enable the HAP bit. Won’t it require some serious reverse-engineering chops to find the HAP bit and enable it inside of such a binary blob? I’m not really used to Ghidra yet haha.

                If I remember correctly, ME uses its own MAC address, but the same IP address of the host. Or maybe this is no longer the case. How would it extract packets though? Won’t that require serious compute power? Or does it look for packets with specific labels identifying them?

                Thanks for letting me know about MEinfoWIN. I’ll try and find it!

                • Skull giver@popplesburger.hilciferous.nl
                  3·
                  1 year ago

                  Could you provide a source for someone who has reverse-engineered a recent version of ME and has found not much incriminating behaviour for consumer motherboards?

                  It’s hard to prove a negative, but with people doing deep dives like these not finding any malicious behaviour yet, I doubt there’s anything of note happening in the ME on consumer hardware.

                  Theoretically the NSA could backdoor the IME, but if they can backdoor the ME firmware, they can also backdoor the tiny Pentium processor inside every Intel CPU, or the UEFI ROM, the microcode, or any other firmware really. In practice they plant tiny their own chips onto existing motherboards, which can be easily removed so they don’t leave a trace.

                  Won’t it require some serious reverse-engineering chops to find the HAP bit and enable it inside of such a binary blob?

                  It looks like the HAP bit has changed location (someone already found out the new offset) but me_cleaner has built in support for setting the bit in many cases; this commit from this PR seems to implement that. Disabling the firmware does, as you would expect, disable the firmware loading process though, meaning Intel Audio won’t work right and booting becomes weirdly slow. You also lose fTPM support and modern sleep (S0ix).

                  How would it extract packets though? Won’t that require serious compute power? Or does it look for packets with specific labels identifying them?

                  The packets enter the Intel network card, and the network card pre-processes them in a bunch of ways (validating checksums, sometimes even reassembling fragmented frames). Modern network cards are fully aware of IP and in limited fashion TCP, so “extract traffic towards port 664/16993/16995 and do not notify the OS” isn’t that hard to accomplish.

                  A separate MAC with the same IP would cause tons of conflicts on the network, I don’t think Intel would (intentionally) use that approach.

          • noride@lemm.ee
            32·
            1 year ago

            For what it’s worth, I did specifically say ecosystem because the TPM is just one component, which is required to authenticate the remote wipe. Also the drivers are installed automatically with most modern operating systems, it’s not like you install your own south bridge driver, for example. Linux of course notwithstanding.

            I’ve seen it used successfully numerous times. Someone steals one of our laptops, rips the drive out, installs vanilla windows, and boom it reboots and performs a wipe.

            Regardless, system-on-a-chip are just that, systems; they can absolutely make remote calls without user interaction, just as intimated by the comment you originally replied to.

            • Skull giver@popplesburger.hilciferous.nl
              21·
              1 year ago

              Ah, in that case I suspect this has less to do with the TPM or firmware and more with a weird feature Microsoft provides (that I permanently turned off on my laptop).

              Windows provides the option for the BIOS to place or replace files on the file system. A bunch of anti-theft tools replace chkdsk.exe, which gets executed on every boot, with a daemon or installer for their service. You can clean install Windows all you want, the moment Windows boots, injection takes place and the payload gets executed. You don’t need TPMs or even encryption or Intel ME/AMD PSP for this.

              I believe MS added this API because they noticed motherboard manufacturers messing with the kernel’s memory, and decided to expose a less batshit insane API rather than risk customers blaming Windows for their laptops crashing on boot because the memory layout changed.

      • 𝒍𝒆𝒎𝒂𝒏𝒏@lemmy.one
        6·
        1 year ago

        I don’t ☹️

        There is a hidden LocationServices system app from Qualcomm that proxies the communication on some devices - however removing this causes a bootloop from what I’ve read, and would prevent Android from being able to identify your location even if it didn’t cause a bootloop.

        I use a Fairphone 3 though with a bunch of Google services in the stock OS disabled, so I’ve settled for just keeping my location data out of Google’s hands

        Edit: add info

        • Cossty@lemmy.worldOP
          3·
          1 year ago

          I actually wanted to get a Fairphone 3 because of headphone jack but I got really good deal on a Fairphone 4 so I took it instead.

            • SpaceNoodle@lemmy.world
              1·
              1 year ago

              You get pretty good at it after you do a couple. I also came up with a way to manually start a platform service with strace and a custom SELinux context, but that was a few years ago and I left all of that work with my previous employer.

        • MigratingtoLemmy@lemmy.world
          2·
          1 year ago

          however removing this causes a bootloop from what I’ve read

          Is this document for every Qualcomm device? I’d be interested to remove such calls from my system if possible, but I’m no systems expert, and unlike the other commenter I don’t think I’ll be able to decompile Qualcomm’s platform service just to remove a few system calls.

  • Skull giver@popplesburger.hilciferous.nl
    15·
    1 year ago

    GPS almanac data. /system/etc/gps.conf and /system/vendor/etc/gps.conf will control how these connections work. There is a Magisk module that can override the config file, though you may need to edit the file to your liking, i.e. set the remote server to localhost.

    Disabling this will make GPS slow to get a fix, though. Basic GPS can take minutes to get a fix.

    • Cossty@lemmy.worldOP
      71·
      1 year ago

      I use gps a lot, I don’t think turning it off is an option then, I will just have to allow it and live with this.

      • whale@lemm.ee
        1·
        1 year ago

        Do you find yourself turning it on and off a lot, or just using it for long stretches? If it’s the latter, you might be able to skip it.

  • 0x2d@lemmy.ml
    101·
    1 year ago

    you can get calyx os for it (graphene isn’t supported)

    • Cossty@lemmy.worldOP
      131·
      1 year ago

      I don’t really blame fairphone for this. They would probably have to make their own chips, if they wanted control over that. Almost nobody has money for that.

        • Cossty@lemmy.worldOP
          51·
          1 year ago

          After looking into it more, I don’t think I would use Graphene OS even if it was supported on FP4, main dev seems like a lying man baby.

          On the other hand, I didn’t know Calyx OS has support for FP4, I might try it out.

    • Cossty@lemmy.worldOP
      10·
      1 year ago

      Oh man, you seem lost. Do you need help? Did you take a wrong turn when looking for c/boobs?