• Re: Tutorial: How to use a PC to find (& kill!) a rogue Android activity & its offending package

    From Ivano Rossi@Ivano.Rossi@nospam.tin.it to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Fri Jun 20 20:53:28 2025
    From Newsgroup: alt.os.linux

    On Fri, 20 Jun 2025 11:09:23 -0000 (UTC), Dan Purgert wrote:

    HOWEVER -- the "free(tm)" phones from carriers tend to get the "carrier updates" which certainly can push crap into your phone (even after the lease-to-own period ends).

    I don't think it matters if it is a free phone or not as the carrier is who pushes the updates to the phone so they can include what they want into it.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Marion@marion@facts.com to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Fri Jun 20 18:57:19 2025
    From Newsgroup: alt.os.linux

    On Fri, 20 Jun 2025 10:39:43 +0100, Jeff Layman wrote :


    If you hadn't seen an ad, how would you have known that "something" had
    been uploaded and was running? Anyway, tutorial saved for future
    reference, just in case...

    Hi Jeff,

    I agree that "most people" wouldn't know how to figure out where it came
    from, and, truth be told, I had to *think* how to figure it out once I
    realized it didn't show up in my "Recently Used" list nor in "recently installed" nor in my Activity Inspector app. So it was kind of sneaky.

    But now that I know what to look for, I can find the activity on any phone. Also I know now that T-Mobile adds back some of the bloat I removed.

    So periodically I'll run adb to find all the tmobile bloatware packages. Particularly after a known update of the system by the carrier.

    Since this is 95% a Linux/Windows thread (because all the commands are run
    on Linux and Windows - that's why) here are the related adb commands:

    Linux: $ adb shell pm list packages | grep 'tmobile'

    Cmdline: C:> adb shell pm list packages | findstr "tmobile"

    PowerShell: PS> ./adb shell pm list packages | Select-String -Pattern 'tmobile'


    BTW, it wasn't actually an "ad", per se, it was a "news story" of current
    news (perhaps based on my clicks as it was about Israel:Iran where I keep
    up intensively on world news in a global political sense), but it was "something" nonetheless that I did not pop up. It came up on its own.

    Since it was unexpected, I didn't screenshot it (I wish I had), but it
    seems to have come up once a day (or so). The funny thing it was super easy
    to get rid of (tap x in the top right) where I would think real malware
    isn't that polite. It was also potentially useful too, in that it was
    something I certainly would have looked up on my own had I done it.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Jan K.@janicekoziol@nie.ma.spamu.prosze.com to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Fri Jun 20 19:00:11 2025
    From Newsgroup: alt.os.linux

    W Fri, 20 Jun 2025 20:53:28 +0200, Ivano Rossi napisal:

    HOWEVER -- the "free(tm)" phones from carriers tend to get the "carrier
    updates" which certainly can push crap into your phone (even after the
    lease-to-own period ends).

    I don't think it matters if it is a free phone or not as the carrier is who pushes the updates to the phone so they can include what they want into it.

    Also keep in mind any android on the internet is updated every month by
    Google for the kernal modules no matter how old the android phone is.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Jan K.@janicekoziol@nie.ma.spamu.prosze.com to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Fri Jun 20 20:34:50 2025
    From Newsgroup: alt.os.linux

    W Fri, 20 Jun 2025 21:39:33 +0200, Carlos E.R. napisal:

    HOWEVER -- the "free(tm)" phones from carriers tend to get the "carrier >>>> updates" which certainly can push crap into your phone (even after the >>>> lease-to-own period ends).

    I don't think it matters if it is a free phone or not as the carrier is who >>> pushes the updates to the phone so they can include what they want into it. >>
    Also keep in mind any android on the internet is updated every month by
    Google for the kernal modules no matter how old the android phone is.

    But this kinds of updates are updates by the manufacturer. These can
    include apps in the firmware.

    There are many kinds of updates but the only kernal updates which happen
    every month to every android phone over the internet (no matter who makes
    the phone & no matter who is the carrier) are from google alone https://source.android.com/docs/security/bulletin/asb-overview https://www.androidauthority.com/pixel-phones-kernel-upgrade-march-update-3532360/
    although the carrier also does updates when they feel like doing them https://source.android.com/docs/core/connect/carrier
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Jan K.@janicekoziol@nie.ma.spamu.prosze.com to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Sat Jun 21 02:20:29 2025
    From Newsgroup: alt.os.linux

    W Sat, 21 Jun 2025 00:43:25 +0200, Carlos E.R. napisal:

    HOWEVER -- the "free(tm)" phones from carriers tend to get the "carrier >>>>>> updates" which certainly can push crap into your phone (even after the >>>>>> lease-to-own period ends).

    I don't think it matters if it is a free phone or not as the carrier is who
    pushes the updates to the phone so they can include what they want into it.

    Also keep in mind any android on the internet is updated every month by >>>> Google for the kernal modules no matter how old the android phone is.

    But this kinds of updates are updates by the manufacturer. These can
    include apps in the firmware.

    There are many kinds of updates but the only kernal updates which happen
    every month to every android phone over the internet (no matter who makes
    the phone & no matter who is the carrier) are from google alone
    https://source.android.com/docs/security/bulletin/asb-overview
    https://www.androidauthority.com/pixel-phones-kernel-upgrade-march-update-3532360/
    although the carrier also does updates when they feel like doing them
    https://source.android.com/docs/core/connect/carrier

    No. Some years ago I had a Motorola, that had installed (forced)
    Facebook and something else, Linkedln perhaps. I removed them, and every time I got the periodic update from Motorola, they were back.

    We agree. There are many kinds of android updates.

    Some are from the oem. Some from the carrier. Some from google.
    And some from google are security updates. Others are system updates.
    And there's even more than that because android gets updated a lot of ways.

    Windows and linux also get updated a lot of ways so it's complex
    in both the desktop pc platform and the server platform and the phone.

    Google play system updates has been updating every android over the
    internet if that android phone was released after around 2019 but if your
    phone doesn't run android 10 then it's not getting those system updates.

    So this process of monthly updates for all android has been going on for a
    long time where most phones that are six years old or younger are updated.

    Google insists on grouping google play system updates under the broader umbrella of google system services updates in their official help documentation. This link is a changelog but it explains google system
    services updates, which is the umbrella term that includes google play
    system updates, google play store and google play services. https://support.google.com/product-documentation/answer/14343500

    Since there isn't anything from google that doesn't mix all three together
    you have to look outside of google to find information about the updates. https://www.howtogeek.com/686927/what-are-google-play-system-updates-on-android-and-are-they-important/
    https://www.androidpolice.com/february-google-play-system-update-landing-now/

    Even the howtogeek writer gets the google play security updates mixed up
    with the google play system updates though so you have to look to reddit to break them apart since both do security updates but they do them different. https://www.reddit.com/r/GooglePixel/comments/evc6jf/security_update_vs_google_play_system_update/
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Jan K.@janicekoziol@nie.ma.spamu.prosze.com to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Sun Jun 22 14:00:24 2025
    From Newsgroup: alt.os.linux

    W Sat, 21 Jun 2025 14:23:03 +0100, J. P. Gilliver napisal:

    Also keep in mind any android on the internet is updated every month by
    Google for the kernal modules no matter how old the android phone is.

    Did that start at some specific version of Android? I'm pretty sure my Android 4.3 - it was a Doogee - never received a single update.

    Android 10.

    Google did such a good job of updating every android on the internet that
    you won't notice the updates every month unless you actually look for them. https://support.google.com/product-documentation/answer/11412553

    The monthly updates also include new features but they're mostly bugfixes. https://www.androidheadlines.com/2022/01/google-monthly-changelog-play-system-updates.html

    They've been doing this since 2019 and most people didn't even notice. https://www.esper.io/blog/building-a-google-play-system-update-changelog

    https://source.android.com/docs/core/ota/modular-system https://support.google.com/product-documentation/answer/14343500 https://9to5google.com/2022/01/10/whats-new-android-google-play-system-updates/ https://www.howtogeek.com/686927/what-are-google-play-system-updates-on-android-and-are-they-important/
    https://www.androidpolice.com/february-google-play-system-update-landing-now/ https://www.reddit.com/r/GooglePixel/comments/evc6jf/security_update_vs_google_play_system_update/
    https://www.intuneirl.com/why-your-android-device-reboots/
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Victor@victorheyne@notreal.org to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Sun Jun 22 09:07:07 2025
    From Newsgroup: alt.os.linux

    On Sun, 22 Jun 2025 14:00:24 -0000 (UTC), Jan K. wrote:

    Also keep in mind any android on the internet is updated every month by
    Google for the kernal modules no matter how old the android phone is.

    Did that start at some specific version of Android? I'm pretty sure my
    Android 4.3 - it was a Doogee - never received a single update.

    Android 10.

    The whole process actually started earlier, with Android 8.0 (Oreo).

    Treble: Android 8.0 https://android-developers.googleblog.com/2017/05/here-comes-treble-modular-base-for.html

    Mainline: Android 10 https://www.hexnode.com/blogs/android-project-mainline-everything-you-need-to-know/
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Victor@victorheyne@notreal.org to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Mon Jun 23 10:39:22 2025
    From Newsgroup: alt.os.linux

    On Sun, 22 Jun 2025 20:50:57 +0100, J. P. Gilliver wrote:

    Also keep in mind any android on the internet is updated every month by >>>>> Google for the kernal modules no matter how old the android phone is. >>>>
    Did that start at some specific version of Android? I'm pretty sure my >>>> Android 4.3 - it was a Doogee - never received a single update.

    Android 10.

    The whole process actually started earlier, with Android 8.0 (Oreo).

    Treble: Android 8.0
    https://android-developers.googleblog.com/2017/05/here-comes-treble-modular-base-for.html

    Mainline: Android 10
    https://www.hexnode.com/blogs/android-project-mainline-everything-you-need-to-know/

    Does that mean, should I ever buy another Android 'phone, I needn't
    worry about ensuring it's later than 10 (or possibly 8), as it'll automatically update? (Obviously I'd have to check processor, memory,
    and so on.) What are they up to now?

    (And have they stopped naming versions after confectionery? I think it
    was something like toffee-apple when I got mine.)

    https://www.esper.io/blog/what-is-project-mainline

    No. It doesn't mean that the phone is fully and completely updated.
    Because there are other components on a phone other than core modules.
    Although it does mean dozens of core modules are fully updated monthly.
    For any Android 10 and up phone that connects itself to the Internet.
    The list of core modules grows appreciably with each Android release.
    There are currently about 40 Project Mainline modules updated monthly.
    They are the core components that Google updates (not oems or carriers).

    And Google stopped the candy naming convention back around Android 10.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Jan K.@janicekoziol@nie.ma.spamu.prosze.com to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Mon Jun 23 16:08:06 2025
    From Newsgroup: alt.os.linux

    W Sun, 22 Jun 2025 19:41:07 +0200, Carlos E.R. napisal:

    Also keep in mind any android on the internet is updated every month by >>>> Google for the kernal modules no matter how old the android phone is.

    Did that start at some specific version of Android? I'm pretty sure my
    Android 4.3 - it was a Doogee - never received a single update.

    Android 10.

    Google did such a good job of updating every android on the internet that
    you won't notice the updates every month unless you actually look for them. >> https://support.google.com/product-documentation/answer/11412553

    I do notice.

    The automatic monthly update requires a reboot to be applied. After a reboot, I have to enter the PIN to the SIM. As the update and reboot
    were automatic, I don't notice them and do not know that the phone is waiting for the PIN, meaning that the phone is out of service, and I am effectively disconnected from the world.

    Clever, ain't it? :-/

    So I had to disable automatic updates. Thus I do notice them, when I see
    the prompt to reboot at my convenience.

    Generally the kernal modules in mainline don't ask for a reboot but some of them do when they deal with low-level system components like the art
    runtime, the dns resolver, media frameworks, security libraries and other
    core components which are deeply integrated into the operating system.

    These reboots are generally much faster than a full Android OS update, especially on devices with a/b seamless updates, because the new components
    are already prepared on an inactive partition before the update happens.

    However you can't disable google play system updates (mainline updates)
    since these aren't updated by the oem or carrier and they're not like
    regular packages that you can update manually. Google controls it. Not you.

    You probably updated automatic system updates in developer options which
    turns off the full android os updates but doesn't affect the kernal updates
    of project mainline. Even if you're rooted, you can't turn off the mainline updates so what you're disabling is something else than project mainline.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Victor@victorheyne@notreal.org to comp.mobile.android,alt.comp.os.windows-10,alt.os.linux on Mon Jun 23 21:50:49 2025
    From Newsgroup: alt.os.linux

    On Mon, 23 Jun 2025 23:26:11 +0100, J. P. Gilliver wrote:

    No. It doesn't mean that the phone is fully and completely updated.
    Because there are other components on a phone other than core modules.

    So what version of Android _should_ I go for (assuming I went for one at all) to be reasonably sure it will update? (And/Or, what else should I
    look for?) What version are they up to now?

    It used to be that Google promised 3-1/2 years of full support to the OEMs
    and then the OEMs (and carriers) had the option to promise more than that.

    But now with the compartmentalizing of Android, all that has changed.
    In addition, EU/UK regulatory agencies are asking for promises, in writing.

    The UK made OEMs promise how long their minimum full support will be.

    Samsung first promised 7 years for the high end and 6 for the lower end.
    Then Google upped their 5 year Pixel promise to match that of Samsung.
    Apple kept their promise of only 5 years.

    With that in mind I would recommend the lower end Samsung A-Series phones, which are perfectly good phones and most come with normal ports & chargers.

    Although it does mean dozens of core modules are fully updated monthly.
    For any Android 10 and up phone that connects itself to the Internet.

    That would presumably include connection via home wifi, rather than the mobile/cellular network?

    It works over the google play services package and can not be disabled.

    Doesn't matter how you connect to the Internet although you can set the
    phone to not download from the google play services package over cellular.

    People do that to save bandwidth costs, not for security reasons.

    The list of core modules grows appreciably with each Android release.
    There are currently about 40 Project Mainline modules updated monthly.
    They are the core components that Google updates (not oems or carriers).

    Would, say, an overnight connection to wifi cover 40 modules? Or are we talking many days, or weeks, or impractically long?

    Google has a web page where it publishes exactly which of the 40 modules
    are updated at any given month. Also there are fewer modules in the older releases. They started with about a dozen and each release they increase
    how much is under the control of Google versus under the OEMs & Carriers.

    I'm guessing half a dozen modules are updated at any given time but I would have to actually look but it doesn't matter much as its totally seamless.

    Rarely the update asks you to reboot as most of the time it's invisible.

    And Google stopped the candy naming convention back around Android 10.
    Thanks. (Any idea why?)

    The news said Google recognized that dessert names, while fun, were not universally understood across different cultures and languages and that
    Google wanted its branding to be more straightforward and professional.

    While Google no longer uses dessert names publicly, they still use internal codenames based on desserts during the development process. For example, Android 10 was internally codenamed Quince Tart, Android 11 was Red Velvet Cake, Android 12 was Snow ACone, Android 13 was Tiramisu, Android 14 was
    Upside Down Cake, Android 15 was Vanilla Ice Cream, Android 16 is Baklava.

    I'm going to change the f'up because this thread started with the PC in
    mind but it has moved to mostly Android topics so apologies to the OP.
    --- Synchronet 3.21a-Linux NewsLink 1.2