Dear conference attendees,

I am fairly sure that my Android phone got pwned very recently.
I don't have any proof that this happened at LCA, except that
I have two data points from Tuesday and Saturday which lead me to
suspect that something happened in between.

It's a bit surprising, as I run a custom ROM without Google apps,
a firewall, and Xposed/XPrivacy, but I also notably left my phone
behind on two occasions, so the breach could have happened
physically.

Anyway, as I said, I don't have proof, and I certainly don't want to
stir the paranoia, but I guess it's still better to share.

My (previously rooted) phone has been modified the following ways:

  - /bin/su is gone, hence the phone is no longer rooted;
  - there are a few temporary files in /system;

I've noticed frequent reboots too. And no, I have not made any
changes myself lately.

Altogether, it looks like a cracking attempt gone wrong.

I have not done any further post-mortem analysis, because my phone
was due for replacement anyway (and is now out of service, yet still
existent), but if you witness similar problems, have a look, and let
me know…

Thanks for your attention,


---

I had an issue with my Nexus 7 Tablet running stock Lollipop throwing up adverts over the LCA 2016 website.

A reboot didn't solve the problem and malwarebytes reported the tablet as clean.

In the end I cleared the Chrome cache and everything returned to normal.

Anyone else had issues?

---

I used a stock Android 6 Nexus 7 quite a bit during the conference and did not notice anything out of the ordinary with the conference website or any other aspect of its operation.  The browser in use was firefox.  Another potential point of difference beyond the Android version is that I didn't have the device associated with any accounts (google or otherwise).  I don't know whether there is any reason to believe that this could be significant.

Regards
  jonathan

---

I also noticed a spate of frequent reboots on Friday night and then back at home over the weekend. Seems to have settled down now though.

I run similarly unusual phone build (Replicant) without proprietary wifi drivers, so only access data over the phone network.

---

Steven> I had an issue with my Nexus 7 Tablet running stock Lollipop
Steven> throwing up adverts over the LCA 2016 website.

I had the same issue on my phone, also running cyanogenmod lollipop.

Ads were only over the LCA website; other sites seemed OK.

Peter C

---

I'd be interested to understand what the adverts were - there was certainly no advertising loading natively from the LCA site - this sounds more like a browser hijack (as Steven suggested).  Knowing what the ads were might give some visibility to the issue, but likely not.

Certainly, we could have been of more assistance had we known about this during the conference, when the conference network was in place, and the delegates were still on site - at this stage the conference network is back in Canberra with Evil Steve, and the delegates are spread all over the world.  If anyone or anything was injecting ads or spreading malware, it is gone now.

It is of course disappointing such things have apparently happened, but given everything and everyone is now long gone, there's not really much we could investigate.

Thanks Martin for alerting everyone to your experience - we can only advise that anyone who feels their device(s) may have been compromised to take the action(s) appropriate to the operating system(s) and device(s) in question.

---

FWIW, I had no issues with my stock Nexus 5 or my rooted Nexus 9 tablet (oth running 6.0.1 mind you, so could have been an issue with older Android or devices without the latest Webview packages).

Used the conference network and visited the site regularly, and steadfastly avoided any of the other dodgy 'free wifi' APs all around Geelong :P

 - Ender

---

Hi Michael

I couldn't be sure if my issue was due to content viewed under Chrome before I arrived @ LCA. The advert pop-ups were largely blocked but I did get a couple of OZ Sports Betting sites come up.

Once I'd cleared the Chrome Cache the issue didn't re-occur, otherwise I'd have raised a ticket with the 2016 team.

Steve

---

Hi all

my HTC Eye running stock Android 5.0.1 did do a random reboot at LCA when no apps where in the foreground. I also did have one or two ads popup in Chrome but I had lca website and a few other tabs open

My phone has been turned off before the flight back to Perth.
Since then everything with my phone is back to normal

---


LCA has a large number of smart people in a small area, presumably some portion of those people are criminals so it would not be particularly surprising if an LCA delegate was responsible for hacking devices.  Also with a large number of target devices in one location someone who was in Geelong but unrelated to the conference could have taken advantage of that opportunity.  As an aside the Wifi password was not treated as a great secret and was also not difficult to guess.

However as there were maybe 800 Android devices being actively used it also seems almost certain that the usual issues with apps that are insecure will occur on some devices without being in any way related to the conference or it's network.

It is reasonable for someone who had a problem with their device at the conference to consider the possibility of an attack directly related to the conference.  It is good to share information on such things to try and discover the cause of the problem.  But I think we need to consider how many such issues with Android devices happen in the usual course of operation.  If you select a random group of ~500 people who use Android devices intensively for a time period of a week how many would you expect to have undesired  behavior that looks like security issues?