/e/OS: unwanted connections

/e/OS Smartphone Operating System
,
1

Hello. I’m planning to write a little research article about /e/OS’s privacy. I’ve analyzed traffic, generated by /e/OS and found some interesting requests to unknown hosts:

DNS-name IP-address Protocol Data
cloud(.)blazing(.)de 85.220.190.246 QUIC Protected payload
app(.)goo(.)gl 142.250.185.142 TLS Protected payload
path2(.)xtracloud(.)net 54.70.12.181 TLS Protected payload
xtratime(.)xboxprod(.)xtracloud(.)net 35.91.218.188 QUIC Protected payload

This connections aren’t appear, when I add my custom CA to system. All another connections decrypted and seems to be valid.

I’ve read docs about /e/OS connections described here:

But there are no any information about described connections. Please, give me any information about sending data to this domains and why it happens. Thank you.

Environment:

Phone: OnePlus Nord(AC2001)
OS: /e/OS 2.2-s-20240715417774-stable-avicii (Official)

Update Sep 12/2024:
Niktrokey Qualcomm research: www(.)nitrokey(.)com/news/2023/smartphones-popular-qualcomm-chip-secretly-share-private-information-us-chip-maker

5 Likes
2

Thanks for sharing this information. Will pass it on to the development team to check and get back with the response.

3 Likes
3

xtracloud.net is a service used as part of A-GPS from Qualcomm. Are Qualcomm chips snooping on you? No, not quite • The Register

3 Likes
4

I’m waiting for your response. Thank you.

5

Is there any way to disable this(for example, delete some part of firmware)?

6

I don’t know. Turning off GPS will probably stop it.

1 Like
8

Thank you for your reply

9

Pl raise an issue with these details in Gitlab. Some calls were detected and removed earlier. With an issue, the developers can contact you for additional details regarding these calls.

1 Like
10

Done: /e/OS: unwanted connections (#8256) · Issues · e / Backlog · GitLab

5 Likes
11

i also have these connections. for 2 devices it is transmitted data at different times.

22:40:20] GPS (TCP) → path3(.)xtracloud(.)net → path3_new(.)qcomgeo2(.)com → xtrapath6(.)xboxprod(.)izatcloud(.)net → 108.138.192.82
[22:40:20] GPS (TCP) → path1(.)xtracloud(.)net → path1_new(.)qcomgeo2(.)com → xtrapath4(.)xboxprod(.i)zatcloud(.)net → 18.239.69.27
[22:40:20] GPS (TCP) → path2(.)xtracloud(.)net → path2_new(.)qcomgeo2(.)com → xtrapath5(.)xboxprod(.)izatcloud(.)net → 18.239.94.40

is correct, it is the GPS service with UID 1021. hope the developer team can work with it. :slight_smile:

Unfortunately you can’t find it in e/os under system apps!
and since it is a system service, deactivation of GPS in my opinion will not lead to success.

12

Try in Settings > Location > Use assisted GPS.

13

i know that, :slight_smile: but I meant the GPS service.

in then setting then apps and systemapps. (GPS UID 1021). these services are not visible as users perhaps over adb.

If you block this service the internet permission, nothing can be sent anymore. that was what i meant. :slight_smile:

netguard, for example, can block this service. he calls himself GPS deamon. the uid is the same.

but the VPN is blocked for other apps. at system level would be better, then the VPN is not blocked.

14

i currently do a test on deactivated GPS to see if any data is still being sent.

15

Perhaps my post was too cryptic. I think and apparently confirmed further up the thread …

… A-GPS causes the leak. Pure GPS should not leak … but are you suggesting pure GPS fails on this device? Network location is alternatively important to provide a “quicker start” for some GPS jobs / apps.

1 Like
16

yes, of course, is absolutely right. :slight_smile:

we wait to see if there will be a fix of the bug.

maybe at e/os 2.4…

17

On previous devices and previous Android versions (Q+R) A-GPS was off by default, I seem to remember. But users tended to complain that GPS did not work.

“Remember GPS” in microG > location stores data on device and also helps GPS to become productive quicker. Many devices should work without A-GPS, imo.

Ofc I am only talking of a small part of the issues raised in Post #10

18

yes it takes longer if you deactivate a-GPS. but under the open sky it works. :slight_smile:

I’ve tried it.

I already had microG disabled and only GPS and it works.

but as already said, it sometimes takes very long for a GPS signal.

19

Stop right there.

It is absolutly not a bug. Possible the “bug” is that it possibly should have been disclosed.

However, the device is a smartphone, data absolutly will be transferred in and out to external systems, on the public internet. It is it’s whole job. You can’t stop it and still claim to have a useful device.

As it says at the end of the article I linked to

“If your life depends on not being tracked through your phone, don’t use a phone.”

20

Of all the unwanted connection you mention, I only find the path.xtracloud after a week using RethinkDNS logging my connections.

When I block xtracloud with Rethink, I don’t see any impact whatsoever on my GPS performance…

21

It probably dependa on how long the already-downloaded a-gnss almanac is valid for, and if you’re using othe methods of location determination. Having done some gps work on the pinephone it can take 15 mins to get a location reading when trying to gather information from the sattelites alone.

I also don’t know if your phone supports the other gnss constalations. They have their own almanacs I think.