Database Users

Anyone heard of a android virus/trojan yet?

Sometimes I come across an app thats not on the Android market and you have to install it manually. Has anyone come across a virus/trojan on Android yet? Im curious how easy or hard it is to modify a legit applications and put a virus/trojan in it?

Lol have not seen one yet. Android isn't that big yet so doubt hackers would really spend time putting trojans to get stuff like your email password lol.

Take everything you know about microshaft windoze and forget it. The system architecture of android is almost completely invulnerable to viruses/worms/etc.
In a typical unix system, hacks can take one of very few possible approaches;
1) service bug targeting, i.e., if one were to discover a security vulnerability in the Apache HTTP server, one could theoretically compromise it. That particular service I mean.
2) user account targeting, i.e., one could convince a user to run something dangerous, which would infect that specific user's account, of course, this attack would limit itself to damaging that user's personal data and would not be able to take down the whole system unless it also targeted a kernel or X-server exploit.
Note specifically regarding #1, that in a well configured system, that targeting a particular service would be restricted to a specific user account just as in #2 since each service runs as its own username.
3) Targeting KERNEL defects; this is perhaps the most frightening possibility. It is also the least likely since it would also require #1 or #2. Any particular kernel attack, particularly in Linux is also very unlikely to work for long due to the open sourced nature of Linux. There are a LOT more people involved in monitoring the fundamental securities of the Linux kernel than any other OS because of its open nature. It is also a source of PRIDE for kernel HACKERS that they ALSO be responsible for openly providing the SOLUTION to any exploits that they discover. And they usually do this with their REAL NAME since it basically immortalizes them. The end result is that every time a kernel exploit is discovered, it tends to be patched within hours of its first application.
Now of course you want to know how this affects Android, since by all appearances, there is no user-level security. WRONG. The Android security level is actually on par with service level security on unix servers. EVERY SINGLE application installed is granted is own user account, which means that if any particular application is dangerous, its range of damage is restricted to that particular application's private data, as well as any permissions that the application is explicitly granted (i.e. when you install an application, it gives you the required security list). There is also the very slim possibility of a kernel exploit (though this is extremely unlikely), and it could damage the data on the sdcard (since it is an MS-crap filesystem with no security restrictions).
Of course you will note that older versions of the ADP1 system image came with an unregulated 'su' command (which you could also end up with using a "cat sh > su; chmod 4755 su" root approach) which basically can be used by any application to take over the whole system. Make sure that you don't have any such su command on your droid. Either use a password-protected su command (which will cause problems for trusted apps requesting root privileges), or the gui-supported su command. Subsequent ADP1 images came with an su command that was restricted to the debugging terminal user, which is fine.
In other words... you don't have much to worry about. Just don't do anything really stupid, like installing an untrusted application that wants a boat load of privileges that it shouldn't be asking for.

lbcoder said:
EVERY SINGLE application installed is granted is own user account, which means that if any particular application is dangerous, its range of damage is restricted to that particular application's private data, as well as any permissions that the application is explicitly granted (i.e. when you install an application, it gives you the required security list).
Click to expand...
Click to collapse
Might be worth pointing out that android apps are for the most part interpreted language apps, meaning the onus of security and stability (just from an apk standpoint) falls largely on the vm. All the lower level subsystems are pretty well protected by the Linux kernel, and these have been significantly tried in fire by decades of Linux server deployment.

lbcoder said:
The system architecture of android is almost completely invulnerable to viruses/worms/etc.
Click to expand...
Click to collapse
jashsu said:
Might be worth pointing out that android apps are for the most part interpreted language apps, meaning the onus of security and stability (just from an apk standpoint) falls largely on the vm. All the lower level subsystems are pretty well protected by the Linux kernel, and these have been significantly tried in fire by decades of Linux server deployment.
Click to expand...
Click to collapse
All the points about the protection offered from the Linux kernel and the VM are valid. Computer secuity is an ongoing battle between the software originators and the hackers trying to get in. I'm not saying it's remotely likely, particularly due to the market share, but rule one in my book is don't taunt the hackers.

lbcoder said:
Take everything you know about microshaft windoze and forget it. The system architecture of android is almost completely invulnerable to viruses/worms/etc.
Click to expand...
Click to collapse
Until the Android Dev team screw up again and lets any app run in the system process when requested (which was why cupcake was delayed in the US).

thanks for the post.
I was curious if someone could unpack a .apk file and modify a application easily, say have it send personal info to xyz server instead of the server the app was designed for or send it to both servers so the user doesnt think anything is wrong.
Are the files in the .apk editable, like an .exe is compiled for windows and the .exe cannot be edited (since its machine code).

androidmonkey said:
thanks for the post.
I was curious if someone could unpack a .apk file and modify a application easily, say have it send personal info to xyz server instead of the server the app was designed for or send it to both servers so the user doesnt think anything is wrong.
Are the files in the .apk editable, like an .exe is compiled for windows and the .exe cannot be edited (since its machine code).
Click to expand...
Click to collapse
Yes, apks are basically just zip files with cryptographic signatures. If you get your apks from Market then there is little to no risk of apks being tampered with. If you install your apks from any source other than Market, then you just have to trust the source that the apk hasn't been modified. Obviously if the apk itself doesn't ask for many permissions then it shouldn't be a problem. For example if you download a game apk from a developer's personal webpage and it asks for just permission to keep the screen alive, there's little risk to your data. However if you download an app that has read/write access to your contacts, or has root access, then you better be sure that the site you get it from is trustworthy.

jashsu said:
Yes, apks are basically just zip files with cryptographic signatures. If you get your apks from Market then there is little to no risk of apks being tampered with. If you install your apks from any source other than Market, then you just have to trust the source that the apk hasn't been modified. Obviously if the apk itself doesn't ask for many permissions then it shouldn't be a problem. For example if you download a game apk from a developer's personal webpage and it asks for just permission to keep the screen alive, there's little risk to your data. However if you download an app that has read/write access to your contacts, or has root access, then you better be sure that the site you get it from is trustworthy.
Click to expand...
Click to collapse
So the files in the .apk not executables, rather interpreted with the VM? Im curious if those files can be read and changed. For instance, can someone open the file in a Java SDK and change the code? Or are those files protected so they cant be modified? For instance, could you download soundboard app from the Market, "unzip" the .apk, and put your own sounds in it?

androidmonkey said:
So the files in the .apk not executables, rather interpreted with the VM? Im curious if those files can be read and changed. For instance, can someone open the file in a Java SDK and change the code? Or are those files protected so they cant be modified? For instance, could you download soundboard app from the Market, "unzip" the .apk, and put your own sounds in it?
Click to expand...
Click to collapse
Unless the classes are specifically performing security/sanity checks, there's nothing keeping you from replacing asset files (pngs, wavs, etc) and then resigning the apk with any key of your choosing. However, altering xmls and classes is more difficult as they are obfuscated/optimized by default.
For apps distributed officially through the Android market, the only way Google can provide assurance for the app producer against tampering is app-protected folder. Of course that assumes that root access is not provided, which is most likely a prerequsite for any phone to be branded "with Google" and have Market access. From the viewpoint of the consumer, apps are guaranteed by Google against tampering only if retrieved through Market. Once the app is on the device, it is protected via Android's use of Linux user access permission model (each app is its own user). The consumer may of course alter the file him/herself, unless it is a protected app, in which case root is required.

sounds buggy. i hope not. this reminds me of when Mozilla firefox became popular i slowly starte dto see code become available to make pop ups n my belloved browser

Virus found on Android phone...
Article 1:
NEWS
An employee at Spanish antivirus firm Panda Security received a new Android-based Vodafone HTC Magic with malware on it, according to researchers at Panda Labs.
"Today one of our colleagues received a brand new Vodafone HTC Magic with Google's Android OS," researcher Pedro Bustamante wrote on the Panda Research Blog on Monday.
"The interesting thing is that when she plugged the phone to her PC via USB, her Panda Cloud Antivirus went off, detecting both an autorun.inf and autorun.exe as malicious," he wrote. "A quick look into the phone quickly revealed it was infected and spreading the infection to any and all PCs that the phone would be plugged into."
Article 2:
Mariposa virus back on Vodafone Android smartphones
HTC Magic According to a Spanish blogger, around 3,000 memory cards supplied by Vodafone Spain were infected with the Mariposa bot client. The mobile network operator has now reportedly confirmed that these included HTC Magic Android-based smartphone models, as well as other devices. A spokesperson for the company has told CNET that it is a "local incident". Vodafone says it has identified customers that could potentially be affected and it will be sending them new memory cards. It has also offered to supply them with tools to restore the integrity of their devices.
Reports of an HTC Magic smartphone carrying the virus were first published less than two weeks ago, however the malware is not able to harm the Android smartphone itself. The bot only attempts to contact a command & control server when connected to a Windows PC. The virus should be detected by most up-to-date anti-virus solutions.
Personal take:
Interesting to note that the virus being carried on an Android phone and was used to infect PC's NOT other Android phones. It came straight from manufacturing with the virus on, so as of yet I still haven't heard of a virus that can infect an android phone.
Further more, I have seen Anti-virus software on the market place AND being offered by Norton. What do they protect against if there are no known virus threats? Do they just draw a nice pretty anti-virus logo on the screen to make you feel comfy? hehehe.

Trojans in the hacked up ROMs people are distributing
androidmonkey said:
Sometimes I come across an app thats not on the Android market and you have to install it manually. Has anyone come across a virus/trojan on Android yet? Im curious how easy or hard it is to modify a legit applications and put a virus/trojan in it?
Click to expand...
Click to collapse
I've found a trojan in at least one of the ROMs being distributed on here. Even reported directly from the developer's own file sharing site.
"Stock" ROM http://forum.xda-developers.com/showthread.php?t=2066023
Attached is a photo of the file scanned from the linked file sharing site for the KERNEL he wants you to INSTALL!!
Click the link to JB_KERNEL_3.17.841.2_EVITA_Init.d_Support_Installer.zip - 8.54 MB in that thread and see for yourself.
Be careful what you install on your device. ANDR.Trojan.GingerBreak takes full administrative control of your device and downloads more trojans to siphon out your private personal data.

Exchange Server - Security policy

I'm finding a lot of threads about changing from pin/password to pattern unlock, but not having any luck in completely disabling the security feature BS...
Is it possible to completely eliminate the password lock required by my exchange server? I have tried lockpicker and no lock, neither of which worked.
I would like to keep syncing but am not going to deal with this unlocking all the time (they JUST started enforcing it)...any help would be appreciated.
BTW, running Calkulin's EViO 2 v 1.7 (sense, so HTC mail)

Nope, this is tightly integrated down to the OS in order to pass MS requirements, and it reports the control level back to exchange so it can make sure it's in compliance with their mobile device policy.
In theory you can make an app that proxies the API and lies about what the phone can do ... but it wont be done with a simple APK/market app ... it's integration goes much deeper.
Honestly your best best: this is clearly a new policy. complain repeatedly to your IT staff. You're probably not the only one upset ... and noise will result in policy change ... because reality: IT staff hate dealing with people. They want to deal with servers.
Option 2: if you have a buddy on the exchange team he can put you on the same policy he undoubtedly created for himself and his team, that's 10x as lenient so he can mess with his little pet projects he plays with on the side.

Justin.G11 said:
Nope, this is tightly integrated down to the OS in order to pass MS requirements, and it reports the control level back to exchange so it can make sure it's in compliance with their mobile device policy.
In theory you can make an app that proxies the API and lies about what the phone can do ... but it wont be done with a simple APK/market app ... it's integration goes much deeper.
Honestly your best best: this is clearly a new policy. complain repeatedly to your IT staff. You're probably not the only one upset ... and noise will result in policy change ... because reality: IT staff hate dealing with people. They want to deal with servers.
Option 2: if you have a buddy on the exchange team he can put you on the same policy he undoubtedly created for himself and his team, that's 10x as lenient so he can mess with his little pet projects he plays with on the side.
Click to expand...
Click to collapse
Thanks...I figured it wouldn't be that easy but I had to ask.

Justin.G11 said:
Honestly your best best: this is clearly a new policy. complain repeatedly to your IT staff. You're probably not the only one upset ... and noise will result in policy change ... because reality: IT staff hate dealing with people. They want to deal with servers.
Click to expand...
Click to collapse
I get complaints all the time about policies. 99.999% of the time, the policies are created/approved by steering committees, the legal department or executive management. There is usually nothing IT can do about it as the policies are put into place for legal reasons or company security.
Additionally, if IT departments are not compliant in company policies there could be legal ramifications if the company has to comply with certain government guidelines.
And IT staff don't hate dealing with people...it sounds like your work environment is not like others.

Check out this thread to see if it does what you are looking for.
http://forum.xda-developers.com/showthread.php?t=775007
They modified the actual email.apk app to remove the security requirement that was hardcoded in it.
It was taken from CM7 which is AOSP, so I cannot say whether or not it will work on sense.
EDIT: After searching some more, droidforums has a modified email.apk file that you can install, that you use instead of the HTC mail, which tricks your exchange server into thinking that you have your security enabeled.
http://www.droidforums.net/forum/dr...onal-froyo-bypass-exchange-server-policy.html
Just download the zip, and extract the apk from it, then place the apk on your SDCard and install it just like a regular app.

Khilbron said:
Check out this thread to see if it does what you are looking for.
http://forum.xda-developers.com/showthread.php?t=775007
They modified the actual email.apk app to remove the security requirement that was hardcoded in it.
It was taken from CM7 which is AOSP, so I cannot say whether or not it will work on sense.
EDIT: After searching some more, droidforums has a modified email.apk file that you can install, that you use instead of the HTC mail, which tricks your exchange server into thinking that you have your security enabeled.
http://www.droidforums.net/forum/dr...onal-froyo-bypass-exchange-server-policy.html
Just download the zip, and extract the apk from it, then place the apk on your SDCard and install it just like a regular app.
Click to expand...
Click to collapse
Will look into that. Thank you very much!

I ended up using the modified email.apk from CM7...works like a charm!!! The Droid forums version kept coming up with security errors. THANKS AGAIN Khilbron!!!

awenthol said:
I ended up using the modified email.apk from CM7...works like a charm!!! The Droid forums version kept coming up with security errors. THANKS AGAIN Khilbron!!!
Click to expand...
Click to collapse
Can you please post a link to the one you used?
Sent from my PC36100 using XDA App

Justin.G11 said:
Nope, this is tightly integrated down to the OS in order to pass MS requirements, and it reports the control level back to exchange so it can make sure it's in compliance with their mobile device policy.
In theory you can make an app that proxies the API and lies about what the phone can do ... but it wont be done with a simple APK/market app ... it's integration goes much deeper.
Honestly your best best: this is clearly a new policy. complain repeatedly to your IT staff. You're probably not the only one upset ... and noise will result in policy change ... because reality: IT staff hate dealing with people. They want to deal with servers.
Option 2: if you have a buddy on the exchange team he can put you on the same policy he undoubtedly created for himself and his team, that's 10x as lenient so he can mess with his little pet projects he plays with on the side.
Click to expand...
Click to collapse
Yes..this reply really isn't correct. There have been some sqlite modifications that can be made or using the mail.apk from this link (http://forum.xda-developers.com/showthread.php?t=775007) works perfect, even with the new CM7-RC2

Bypassing Exchange security
I had this same issue with my work email. My way of bypassing it and still using the stock Mail app is by installing widgetlocker. Unfortunately the newest version does not bypass your encryption, but the older version before the most recent update does. Also it allows you to fully customize your lockscreen and add widgets and what have you. All in all pretty cool app.
widgetlocker.teslacoilsw.com/general/widgetlocker-1-2-9/
(unfortunately because i have never posted before i cannot post links so pm if the link does not work)

Amazing! So you guys have a device in your pocket that has complete access to your work mail server (something you don't own), and you apparently don't care if that falls into the wrong hands?
I don't want to get preachy but this is serious stuff:
1. Are you aware of the damage that can fall on an organization, its IP and reputation if a hacker/spammer has access to a mail account?
2. Your company's mail server is an assett of the company. Gaining access and leaving it unlocked is like borrowing something from work and leaving it on the street.
I understand that IT policies are annoying to the end user, but they are there for good reason.
Would you leave the company vehicle unlocked because it is annoying to get the key out? No.
Oh, and by the way, you can be held directly liable for damages for disabling/ hacking around policies. I have seen employees get fired for it.
Sent from my device.

ramiss said:
Amazing! So you guys have a device in your pocket that has complete access to your work mail server (something you don't own), and you apparently don't care if that falls into the wrong hands?
I don't want to get preachy but this is serious stuff:
1. Are you aware of the damage that can fall on an organization, its IP and reputation if a hacker/spammer has access to a mail account?
2. Your company's mail server is an assett of the company. Gaining access and leaving it unlocked is like borrowing something from work and leaving it on the street.
I understand that IT policies are annoying to the end user, but they are there for good reason.
Would you leave the company vehicle unlocked because it is annoying to get the key out? No.
Oh, and by the way, you can be held directly liable for damages for disabling/ hacking around policies. I have seen employees get fired for it.
Sent from my device.
Click to expand...
Click to collapse
The issue I have is with the idea that the company gets to dictate how my entire device functions. Your points are valid, but why not just require a password on the email app, not on the whole phone? Why do I have to consent to allowing them to order a full device wipe, instead of just a wipe of the company data?

bkrodgers said:
The issue I have is with the idea that the company gets to dictate how my entire device functions. Your points are valid, but why not just require a password on the email app, not on the whole phone? Why do I have to consent to allowing them to order a full device wipe, instead of just a wipe of the company data?
Click to expand...
Click to collapse
Those are some good points and questions:
If you just locked the mail app then the app would need to encrypt/decrypt all data, which would make it MUCH slower. However, the main reason is that the app lock approach is much more hackable..one simple example would be to load a proxy on the phone to intercept communication before it could be encrypted.
The idea behind the device lock is that it happens on a deeper level and is the most secure answer.
The question about having a choice with your device is actually a simple one to answer...if you don't agree with the work policy then don't use your personal device for work email.
The other thing is that, besides not having a choice, the forced answer is beneficial for everyone....if I lose my device then I definitely don't want strangers crank calling my family or getting personal info. I have read about some horrible stories.
The real question is...If your phone is lost why would you NOT want it to be secure and erased asap??
Sent from my "locked" device.

ramiss said:
Those are some good points and questions:
If you just locked the mail app then the app would need to encrypt/decrypt all data, which would make it MUCH slower. However, the main reason is that the app lock approach is much more hackable..one simple example would be to load a proxy on the phone to intercept communication before it could be encrypted.
The idea behind the device lock is that it happens on a deeper level and is the most secure answer.
Click to expand...
Click to collapse
Yes and no. There are approaches that are easier if you aren't securing the whole device, but that doesn't mean it can't still be hacked.
The question about having a choice with your device is actually a simple one to answer...if you don't agree with the work policy then don't use your personal device for work email.
Click to expand...
Click to collapse
Overall I agree with that, although I think at a company that offers mobile email, there's a sort of "peer pressure" to use it. Not to say that's a good reason. I'd imagine that it'd be hard for a company to actually require you to use mobile email on your personal device -- if your job truly requires it, I'd think they'd have to provide you a device if you don't have a compatible device or aren't willing to use it that way. So yes, you're probably right that you have the choice. It doesn't mean that we can't complain though.
The other thing is that, besides not having a choice, the forced answer is beneficial for everyone....if I lose my device then I definitely don't want strangers crank calling my family or getting personal info. I have read about some horrible stories.
The real question is...If your phone is lost why would you NOT want it to be secure and erased asap??
Click to expand...
Click to collapse
If it's really lost forever, yes. But what if:
- The exchange admin sends the wipe command to the wrong phone. ("Hi, I'm John Smith and I've lost my phone.")
- The "wipe after X invalid passcode" policy is enabled. A friend or a kid picks up the phone and tries to play with it. Whoops.
- Something else goes wrong...bottom line is that the company should have no right to wipe anything other than their own data.

I understand the need for locking the device...I really do. But, if someone does happen to find my phone (knock on wood but HIGHLY, HIGHLY unlikely, as I've never even almost forgotten any phone, anywhere, ever) they aren't going to find ANYTHING of value in my emails. I'm pretty low on the totem pole.
If I had sensitive data on my phone...no questions asked, I would keep it p-word locked.
matt2053 said:
Can you please post a link to the one you used?
Sent from my PC36100 using XDA App
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?t=775007

awenthol said:
I understand the need for locking the device...I really do. But, if someone does happen to find my phone (knock on wood but HIGHLY, HIGHLY unlikely, as I've never even almost forgotten any phone, anywhere, ever) they aren't going to find ANYTHING of value in my emails. I'm pretty low on the totem pole.
If I had sensitive data on my phone...no questions asked, I would keep it p-word locked.
Click to expand...
Click to collapse
Your Exchange Admin (or you depending on the version of Exchange you're using) has the ability to remotely wipe your device in the event it gets stolen/lost.

Could anyone give a brief possible explanation of why I can connect to my exchange server easily using Touchdown, but not using the Android integrated Exchange Account Sync?
Sent from my PC36100 using XDA App

Just found this thread as I've encountered the same issue on a HTC Sensation, just setup Exchange ActiveSync, and bam, have to set up the PIN lock on the phone.
However I've noticed that once you've done it, you can then go into Settings, Security and change the timeout before it locks up to 1 hour (I think that is dependent on your company setting). Mine was defaulting to every time the screen locked, but changing it to 1 hour I find I hardly ever have to unlock the phone now apart from first thing in the morning as I tend to use it regularly through the day.

Modded Exchange Server APK?

For the Rezound,and other phones I guess, there is a modified Exchange server app that does away with the Administrator Rights requirement when connecting to some Exchange Servers.
Here is the issue. Mind you, this security policy only applies if the device supports it. Meaning one Android device or iPhone can connect without enabling Admin rights, while another one does.
But what happens, is that if the Exchange Server sees that the device supports it, it enforces this policy in order to set up and allow access to the email account. It gives the IT department COMPLETE control of your device. They can lock you out, format it, etc... Also, it forces you to set up a PIN, and it disables the camera and encrypts the storage of the device. So you can see how this an be an issue with a personal device. ANy pics you take, files you download, etc... are encrypted and can ONLY be accessed from the device. You cannot copy them to your PC and access them. Huge pain in the ass!
On the various ICS ROMs for the Rezound(the phone I have), there is a file that I can install, a modified Exchange.apk file, that lets me set up the account, and while it will force me to use a PIN, it ignores the rest and doesn't force me to disable the camera or encrypt the storage.
So, is there such an app for this device? Can I use the one for ICS that I use for the phone?
Any idears?

Please don't do that. Many times there is a legal requirement for that policy. Feel lucky that you can use a personal device for work. Many people have to deal with the policy and carry a dedicated work phone.

ekinnee said:
Please don't do that. Many times there is a legal requirement for that policy. Feel lucky that you can use a personal device for work. Many people have to deal with the policy and carry a dedicated work phone.
Click to expand...
Click to collapse
There is almost never a legal requirement, it is a corporate policy. I am using this type of modded Exchange.apk right now, have been for months.
The irony of the "security policy", is that if your phone does not support the feature, then the Exchange Server ignores it and lets the device right in with full access. It only affects certain devices. If I had a DroidX, no problem, Exchange lets me in. I upgrade to a Rezound, now I have to encrypt my entire device.
Don't use it if you don't want to, but many of us do, as this file is available for many phones. I just need to locate one for the N7.

You can try it. At where I work it is not worth it since doing so will get you fired for violating company policy which every employee signs.
The policy they use however doesn't affect the use of the camera and most employee's have a company phone so it's not theirs to begin with. Those that need email and also want privacy, have two phones.
You might want to talk to the admins to see if they can remove the camera block as that may be something they turned on without thinking.

There was an offshoot of a modified APK and then it turned into Enhanced Email, and since then I've switched to Touchdown. Instead of forcing encryption and standards on your personal device, it handles it's own secure space. Also it handles High Importance messages with recurring alerts.

I can't dig up the case at the moment, but for the record, there is absolutely president (at least in the U.S.) if a company requires you use a personal device for work, they have no legal recourse to require factory wipe access and may face steep penalties if they fire you as a result of you circumventing them.
Definitely an area where it's worthwhile to know both:
A. Your companies policies, in and out.
B. Your rights as a citizen of whichever country you reside in.

krelvinaz said:
You can try it. At where I work it is not worth it since doing so will get you fired for violating company policy which every employee signs.
The policy they use however doesn't affect the use of the camera and most employee's have a company phone so it's not theirs to begin with. Those that need email and also want privacy, have two phones.
You might want to talk to the admins to see if they can remove the camera block as that may be something they turned on without thinking.
Click to expand...
Click to collapse
Guys, I really don't need lectures on whether I should do it or not. I currently do it. I will continue to do it. I won't get in trouble at work, it is just how they set it up and they are not going to change it for me, but it is an inconvenience.
I just need to be able to do it on THIS device.

DanielNTX said:
There was an offshoot of a modified APK and then it turned into Enhanced Email, and since then I've switched to Touchdown. Instead of forcing encryption and standards on your personal device, it handles it's own secure space. Also it handles High Importance messages with recurring alerts.
Click to expand...
Click to collapse
Tried that before, hated Touchdown.
The modded one on the Rezound is the stock app, just that part taken out and it works perfectly, That's what I am after here.

SquireSCA said:
Tried that before, hated Touchdown.
The modded one on the Rezound is the stock app, just that part taken out and it works perfectly, That's what I am after here.
Click to expand...
Click to collapse
I think any mod made for jelly bean would work for you since it's all based off of aosp. I'd try the one linked below (and making a backup beforehand).
http://forum.xda-developers.com/showpost.php?p=28246860&postcount=1
Sent from my Nexus 7 using xda premium

DanielNTX said:
There was an offshoot of a modified APK and then it turned into Enhanced Email, and since then I've switched to Touchdown. Instead of forcing encryption and standards on your personal device, it handles it's own secure space. Also it handles High Importance messages with recurring alerts.
Click to expand...
Click to collapse
mwalt2 said:
I think any mod made for jelly bean would work for you since it's all based off of aosp. I'd try the one linked below (and making a backup beforehand).
http://forum.xda-developers.com/showpost.php?p=28246860&postcount=1
Sent from my Nexus 7 using xda premium
Click to expand...
Click to collapse
Cool. I just got the thing a couple hours ago, so it is not unlocked or rooted yet, and you need that to install these.
The ones for the Rezound were made to install in the OS, not from Recovery, but once CM10 is out and stable, I will unlock and go to that and then I can use it. For now, my phone has it so I do have email on the go for work.
Thanks!

Developer Unlock your Windows Phone to sideload Apps to your device.

Just found this
http://albertjelica.co.de/Mac/Windows_Phone.html

hahaha try that and get in prison if MS catches you.

mcosmin222 said:
hahaha try that and get in prison if MS catches you.
Click to expand...
Click to collapse
I very much doubt that, morally wrong perhaps, but legally? and internationally?
im not a legal boff but I doubt it, although that doesn't mean its right still!

Copied it from the website. Because its offline now!
Step 1.)
Go to https://eims.maricopa.edu/MAW/MAW.html and click on „I am a new student and have never attended any Maricopa Community College or Skill Centers“, fill in the captcha an click on Next.
Step 2.)
Now you will be asked to fill in some personal information. Luckily there is Fakenamegenerator.com, where you can generate a fake-SSN.
For the ZIP-Code use the postal of Phoenix, Arizona: 85001.
Step 3.)
After you sign up, you will get a MEID, an email-adress and a password. Save that in a text-document, this is really important.
You will have to wait about 20 minutes now.
Now go to https://eims.maricopa.edu/MAW/lookup.pl?req=passwd, where you can reset your password. This is a little trick to get access to their systems.
Type in your MEID and the birthdate you provided before.
Now go to www.maricopa.edu/google/ and log in with your EDU-mail-adress.
Sometimes it takes about two days to activate your account, do not lose patience, it is totally worth it.
Part 2.)
Step 1.)
Visit Dreamspark.com and log in with a Microsoft-Account. I‘d recommend using the live-account that is connected to your Windows Phone.
Step 2.)
Now you will need to verify your account. Click on Verify with school and select:
„Chandler/Gilbert Community College“, state Arizona.
Use your EDU-mail from step one to activate your account.
Step 3.)
After this is done, you will get a verification-mail to your EDU-account. Open the link in the email and your Developer-Account is verified!
Part 3.)
Step 1.)
Now you can go to straight to the AppHub, dev.windowsphone.com.
Register your Microsoft-Account and sign-up as student.
It will ask for your verified Dreamspark-Account.
Step 2.)
Download the Windows Phone SDK from here and install it on your PC.
Step 3.)
Run the „Developer Registration Tool“, plug in your Windows Phone and sign in with the Microsoft-Account you registered at AppHub.
Make sure that the phone is not on the lockscreen, but on the homescreen.
Zune has to be installed and be opened while unlocking your phone.
Now you can download XAP files and install them on your phone.
To do so, run the „Application Deployment Tool“ and select the XAP-file.
During installation your phone must not be locked or you will get an error.
You can find great apps here:
http://wp.pandaapp.com
http://xda-developers.com/
Here‘s my favorite homebrew-app:
ScreenCapturer: http://forum.xda-developers.com/showthread.php?t=1316199
Click to expand...
Click to collapse

I did this but, the limit is to only 3 apps...

I was thinking to unlock my Lumia 920 too, being a student it isn't a problem for me.
But if I am not mistaken the unlock is only for 1 year?
And also, not so many wp8 app I want to side load at the moment.

What this mean to side load app? Sorry for noob question i am new to wp8
Sent from my RM-821_im_india_443 using Board Express

Did you guys read the legal acts you were supposed to read, understand and agree on when you made your developer account?
Those acts look very well written and I am pretty sure MS does them legally and it a legal contract.
What you guys do, is falsely declare that you are student at that university.
Declaring something false to be true in legal acts is a punishable offense in most countries in this world. DO not play around with this. It is dangerous.

mcosmin222 said:
Did you guys read the legal acts you were supposed to read, understand and agree on when you made your developer account?
Those acts look very well written and I am pretty sure MS does them legally and it a legal contract.
What you guys do, is falsely declare that you are student at that university.
Declaring something false to be true in legal acts is a punishable offense in most countries in this world. DO not play around with this. It is dangerous.
Click to expand...
Click to collapse
I read it and because I am a legit student in Italy, I asked that question: what's the purpose of dev unlock a wp8 when there are no interesting app around, except for the one I am supposed to write

For them it doesn't matter. Developer unlock is strictly for developing stuff, not side loadings apps.
If you got the unlock through unholy ways, it does not matter if you use it or not.

mcosmin222 said:
For them it doesn't matter. Developer unlock is strictly for developing stuff, not side loadings apps.
If you got the unlock through unholy ways, it does not matter if you use it or not.
Click to expand...
Click to collapse
who are you talking to?

No one apparently.

mcosmin222 said:
No one apparently.
Click to expand...
Click to collapse
Unless you can truly unlock these devices and unleash them to their full potential I'm not going to upgrade to Windows Phone 8 unless there are features like Skype baked into the platform that perform as well as T-Mobile's W-Fi Calling or Bobsled app; maybe. It is my understanding bluetooth compatibility is no different with 8 than it was with 7.x and if I can't use a bluetooth keyboard, I'm not going to waste my time with it. I'm sick to death of the folks who make decisions on this sort of stuff who are completely out of touch with regular folk or think they can "drive" us to use what they think we want.

WP8: change marketplaces (glitch found) ?

Possable hack or glitch, that is why I am posting here.
According to a few sites, a glitch has been discovered by setting a proxy, you can make your non-nokia phone be able install apps from Nokia's apps.
Sites for info...
http://www.microsofttranslator.com/...n&a=http://www.wpdang.com/archives/98835.html
http://www.wpdang.com/archives/98835.html
http://www.wpcentral.com/glitch-spotted-windows-phone-store-lumia-apps
Does anyone have clear directions on this so everyone knows how to do it?
Also, I am hoping this would allow us to get to the point of a Marketplace Changer like we used to have for WP7 devices.. I personally would like some HTC apps on my Nokia...and a LG app too.
Figured this would be a great place to start a discussion on this.

The basic "hack" is dead simple, actually. In a way, this is easier than the old Marketplace Switching apps; those worked by changing some configuration files on the phone; this works by editing the communication between the phone and the Marketplace servers *as if* those files had been changed.
It's probably worth the time to write up a small utility to do this yourself, rather than relying on a third party proxy (never a good plan if you don't have to do it). It might even be possible to make the proxy run as an app on the phone itself (it would need to be sideloaded, since there's no way MS would permit such a thing, and you'd probably still need to be on WiFi, but it might be possible).

DavidinCT said:
Possable hack or glitch, that is why I am posting here.
According to a few sites, a glitch has been discovered by setting a proxy, you can make your non-nokia phone be able install apps from Nokia's apps.
Sites for info...
http://www.microsofttranslator.com/...n&a=http://www.wpdang.com/archives/98835.html
http://www.wpdang.com/archives/98835.html
http://www.wpcentral.com/glitch-spotted-windows-phone-store-lumia-apps
Does anyone have clear directions on this so everyone knows how to do it?
Also, I am hoping this would allow us to get to the point of a Marketplace Changer like we used to have for WP7 devices.. I personally would like some HTC apps on my Nokia...and a LG app too.
Figured this would be a great place to start a discussion on this.
Click to expand...
Click to collapse
Guyz, I've tried this on my Huawei W1 but its says, cannot connect,,,,,,,,,, ive also tried changing the region but nothing happens, does anyone tried this already, and successfully installed those nokia exclusive apps?
Thank you,

jakelq said:
Guyz, I've tried this on my Huawei W1 but its says, cannot connect,,,,,,,,,, ive also tried changing the region but nothing happens, does anyone tried this already, and successfully installed those nokia exclusive apps?
Thank you,
Click to expand...
Click to collapse
it is time based. I mean, sometimes it happens. sometime it doesnt. keep trying is all I can say.

GH0ST DR0NE said:
it is time based. I mean, sometimes it happens. sometime it doesnt. keep trying is all I can say.
Click to expand...
Click to collapse
yup, i tried this at home and it worked..
It runs smooth with huawei w1 and i dont experience any missed swipes.
Why does it wasnt released for 512 mb ram?
tnx.

GoodDayToDie said:
The basic "hack" is dead simple, actually. In a way, this is easier than the old Marketplace Switching apps; those worked by changing some configuration files on the phone; this works by editing the communication between the phone and the Marketplace servers *as if* those files had been changed.
It's probably worth the time to write up a small utility to do this yourself, rather than relying on a third party proxy (never a good plan if you don't have to do it). It might even be possible to make the proxy run as an app on the phone itself (it would need to be sideloaded, since there's no way MS would permit such a thing, and you'd probably still need to be on WiFi, but it might be possible).
Click to expand...
Click to collapse
I would gladly test (I am dev unlocked) anything you can come up with here.
Anything that could help progress towards a hack on WP8, even if it's a marketplace changer of some type
aclegg2011 said:
Man, we really need to find a way to dev unlock our phones. :/
Sent from my RM-917_nam_usa_100 using XDA Windows Phone 7 App
Click to expand...
Click to collapse
The same process (dreamspark EDU account, etc) that worked for WP7 works on WP8 but, the limits of 3 apps are still there... So I can sideload 3 apps..

DavidinCT said:
The same process (dreamspark EDU account, etc) that worked for WP7 works on WP8 but, the limits of 3 apps are still there... So I can sideload 3 apps..
Click to expand...
Click to collapse
I have an edu account activated since december 2011. I had on my Omnia W (WP 7.5) only the possibility to sideload 3 apps, but now on my lumia 820 i DONT have this limit of 3 apps..

gipfelgoas said:
I have an edu account activated since december 2011. I had on my Omnia W (WP 7.5) only the possibility to sideload 3 apps, but now on my lumia 820 i dont have this limit of 3 apps..
Click to expand...
Click to collapse
I have a Lumia 928, and I dev unlocked it(got one of those free EDU accounts that was going around, I log in 2 times a year), I put on 3 apps and it gives me an error if I try to add more.
I would like to add more but, No biggie because there is not 3rd party tools or hacks for WP8....YET.

DavidinCT said:
I have a Lumia 928, and I dev unlocked it(got one of those free EDU accounts that was going around, I log in 2 times a year), I put on 3 apps and it gives me an error if I try to add more.
I would like to add more but, No biggie because there is not 3rd party tools or hacks for WP8....YET.
Click to expand...
Click to collapse
I dont mind but it seems that my account has a bug..?!?

GoodDayToDie said:
The basic "hack" is dead simple, actually. In a way, this is easier than the old Marketplace Switching apps; those worked by changing some configuration files on the phone; this works by editing the communication between the phone and the Marketplace servers *as if* those files had been changed.
It's probably worth the time to write up a small utility to do this yourself, rather than relying on a third party proxy (never a good plan if you don't have to do it). It might even be possible to make the proxy run as an app on the phone itself (it would need to be sideloaded, since there's no way MS would permit such a thing, and you'd probably still need to be on WiFi, but it might be possible).
Click to expand...
Click to collapse
Here is a question on this. Is there a list of "proxies" for different carriers/OEMS ? I could not find anything besides this one. Do you know how I can access HTC, Samsung, LG, etc list ?
How does one access the marketplace of another OEM than Nokia ? (I have a Nokia so that is not an issue for me)

It's just a matter of changing the ID string for the phone when it's talking to the Marketplace servers. I'll look into writing a tool to do it.

GoodDayToDie said:
It's just a matter of changing the ID string for the phone when it's talking to the Marketplace servers. I'll look into writing a tool to do it.
Click to expand...
Click to collapse
Awsome, I look forward to something ! Thanks !

GoodDayToDie said:
It's just a matter of changing the ID string for the phone when it's talking to the Marketplace servers. I'll look into writing a tool to do it.
Click to expand...
Click to collapse
Hi ,GoodDayToDie
Try fiddler2 to modify the request send by the phone when talking to the Marketplace servers.
I have made some research and it's intresting.....

@Mattemoller90: Yes, but I can't promise that the app will install correctly afterward. Apps identify, in their manifests, the resolutions they support. If the app requires resolution that the phone doesn't have, the phone will most likely simply refuse to install it.

@GoodDayToDie
How can I cheat the Marketplace with Fiddler2 (for change the resolution) I want try
You are the best

Eh, I'm not going to write a full tutorial right now. Short version is install Fiddler, set it to proxy external connections (will need to be let through your firewall), set your phone to use your PC's IP address and Fiddler's listening port as the proxy, set Fiddler to intercept requests, and then open the Marketplace. You'll see an HTTP GET request from the phone to Microsoft's servers, and the URL will contain a bunch of details about your phone (manufacturer, model, version info, region, etc.) including resolution. Replace the resolution string with the one you want to pretend to have, then have Fiddler "Run to completion".
Note: You'll probably have to do this multiple times. It's OK to not do it for things like partial searches, but you'll of course need to do it for the final search query. It can be scripted, but that's outside the scope of what I'm going to tell you to do here. Look at how @xdevilium does it in his app: http://forum.xda-developers.com/showthread.php?t=2362165

Can fiddler be used for other things? Like seeing where server updates are coming from, and how are phones interacts with developer registration?
Sent from my RM-917_nam_usa_100 using XDA Windows Phone 7 App

In theory, yes it can (or any other HTTP/HTTPS proxy; there are several of them available). However, the functions you describe use HTTPS. To intercept SSL traffic, the proxy needs to forge certificates for the sites you connect to (unless it somehow got ahold of the site's private key). To have your phone trust the forged certificates, the proxy (including Fiddler, if you choose to enable it) can sign the forged certificates using its own private key; if the corresponding public key is trusted by the phone (which can be done just by sending the public key to the phone using email or bluetooth or something, and installing it) then the forged signatures will be trusted.
However, that's only true for the general case. For specific OS functionality, Microsoft (and all the other big mobile vendors) use a technique called "certificate pinning" where the SSL certificate must either exactly match a known certifiacte, or must be signed by an exact match. In this case, it doesn't work to install your proxy's certificate and have it be trusted; a feature using cert pinning doesn't even check the OS's trust store. Therefore, we can't intercept those specific communications.
It's frustrating.

I've never scripted Fiddler, I just re-wrote the requests by hand. It's easy enough; there aren't very many. I could tell you how to do it in a couple other proxy programs.

GoodDayToDie said:
I could tell you how to do it in a couple other proxy programs.
Click to expand...
Click to collapse
I Really Appreciate That