Security and Optimizations Analysis 25/07/14

[Lokifish Marz]

All checks and analysis were done to fresh installs only. No additional apps were installed except for those required for the security checks. The analysis is of currently active projects ONLY.

[ROM] Stock official firmware 20140513

Security Check Results;
CVE-2013-6271
CVE-2013-7373
CVE-2014-1939
CVE-2013-7372
CVE-2014-1600
Masterkey 9950697
Masterkey 10148049
USSD

Optimizations;
CPU Governor- Stock
SDCard Cache- Stock
OOM- Stock
SYSCTL- Stock
Network- Stock
Build.prop- Stock

BT Tether (watch>phone>internet);
Not working

BT Companion;
Not working

Kernel
Whatever kernel is provided.


[ROM] monxDIFIED™ SMART ROM ? SECURE + BT TETHERING v01-04

Security Check Results;
CVE-2013-6271
CVE-2013-7373
CVE-2014-1939
CVE-2013-7372
CVE-2014-1600
Masterkey 9950697
Masterkey 10148049
USSD

Optimizations;
CPU Governor- Stock
SDCard Cache- Stock
OOM- Stock
SYSCTL- Stock
Network- Stock
Build.prop- Minimal edits (Density config, Enable USB debugging, Disable debugging notify, Disable Bytecode, Disable sending data and logging)

BT Tether (watch>phone>internet);
Not properly working. Blue icon, no connection. Browser, Play Store, Voice Search, Google Now, Maps, etc., all fail to find a connection.

BT Companion;
Not properly working

Kernel
Whatever kernel you have prior to flashing is what you get.


[ROM] 07.06 EnSec STOCK Secure
(Continuation of the, Omate officially supported and approved, EnSec Project by Adam Outler, ClearD , Dees Troy, kuronosan and others.)

Security Check Results;
CVE-2013-6271
CVE-2013-7373
CVE-2014-1939
CVE-2013-7372
Masterkey 9950697
Masterkey 10148049
USSD

Optimizations;
CPU Governor- Tuned for lower CPU clocks under load to save battery
SDCard Cache- Tuned for optimal R/W speeds
OOM- Stock
SYSCTL- Tuned
Network- Tuned
Build.prop- Multiple edits (Density config, Network, playback, etc....)

BT Tether (watch>phone>internet);
Not working

BT Companion;
Not working

Kernel
Device specific matched kernel.


[ROM] mystery companion ROM
(if you don't know, don't ask. If you do know, don't tell)

Security Check Results;
CVE-2013-6271
CVE-2013-7373
CVE-2014-1939
CVE-2013-7372

Optimizations;
CPU Governor- Tuned for lower CPU clocks under load to save battery
SDCard Cache- Tuned for optimal R/W speeds
OOM- Tuned
SYSCTL- Tuned
Network- Tuned
Build.prop- Multiple edits (Density config, Network, playback, etc....)

BT Tether (watch>phone>internet);
Not properly working

BT Companion;
Mostly functional. Working notifications, working contacts sync, working remote app management, working speaker phone. Remote camera control not working,

Kernel
Whatever kernel you have prior to flashing is what you get.

 

[gentoolkit]

How did you perform these security checks? I would like to check my own device.

 

[Lokifish Marz]

Belarc
Bluebox
Dou Security XRay
Eeye
Secunia
SRT App Integrity
(all in attached zip)

USSD can be checked by going to ESET. You can also create your own page to check USSD and have it issue more aggressive codes, that what I've done. CVE-2014-1600 has to be checked by hand.

 

[kilroo]

I'm still running EnSec + Operative Casual Edition 20140318 20140120 firmware ONLY!

It suits my purposes. The watch does what it's supposed to do. Tethering would do me no good unless I could tether to Maemo 5 or Meego Harmattan, which seems singularly unlikely.

Should I be worried and reflashing to something else, or is there no real point in a change from what I'm running right now?

 

[Lokifish Marz]

EnSec STOCK Secure is a continuation and is based on newer firmware. There may be some sensor fixes and a couple of other things but other than that is very close to the original EnSec. Even though neither are perfect, both are still the best choice for security at this time. I personally would suggest flashing kuronosan's EnSec simply because it is a current and active release.

 

[Lokifish Marz]

I have not tested the current version of monx ROM as every dev that was here prior to monx has quit releasing on xda for this device. I have quit dev support for the device on xda as well. You can pretty much thank monx for that.

So ClearD is gone, kuronosan is only providing support, and Dees wasn't surprised at what happened. Adam Outler is off on other projects. Any other dev I've talked to also found monx's kanging, games and insults a bit offensive. Enjoy your monx flavored icing as, from what we can tell, there is almost no real ROM work and mostly themeing. But what do we know, we are nothing but wannabe devs according to monx anyway.

 

[xcooling]

You guys are so pathetic, NO ONE CARES ABOUT YOUR ISSUES

Focus on your own roms and ignore the rhetoric, because no one actually cares.

 

[Lokifish Marz]

You guys are so pathetic, NO ONE CARES ABOUT YOUR ISSUES

Focus on your own roms and ignore the rhetoric, because no one actually cares.

If you want to support somebody that stole Adam Outler, Dees Troy, kuronosan, ChiefzReloaded, ClearD and my work then calls the very same people whose work he stole fakes and wannabe's go ahead. Enjoy your easily hacked, unoptimized theme being passed off as a ROM.

And it wouldn't have been a problem if he had simply done the proper thing and asked and credited and not called everybody else a fake and wannabe. Not a problem though as of 8/7/2014 I have rescinded any and all permissions for xda and it's members to use my works, reference my works and mirror my works.

 

[xcooling]

awesome, what a helpful person.

Thanks for standing by the community.

 

[Lokifish Marz]

awesome, what a helpful person.

Thanks for standing by the community.

Adam Outler, Dees Troy, kuronosan, ChiefzReloaded, ClearD and myself all work(ed) together on the TrueSmart/x201. Almost all work released on xda and any other forums, English or otherwise, is either based on our work, or authorized mirrors of our work. Some of our work is even in official firmware as we have worked with Omate since October of last year on issues.

I maintained an updated archive of almost every firmware and ROM released for not only the TrueSmart but the entire x201 platform and did security checks on all of it as well as look for any changes that may benefit all x201 users. I was also responsible for the core ROM work as well as being part of the early TWRP development and assisting the other devs with their work. Adam Outler, Dees Troy and kuronosan have all referenced my work at one point or another for their own works. In fact my work was called "amazing" by Adam Outer and "required" buy multiple other devs.

monx STOLE the work of at least five other devs and never even so much as apologized, then have repeated called other devs wannabe's.

And as far as the security and optimizations analysis, those results are after a peer review in which all the results matched. monx has called it b$ and and yet again called multiple devs wannabes.

I have better things to do than be part of a community that allows an ass like monx to kang, distribute an admitted trojan infected ROM and call multiple devs that came before him wannabe's and be a general ass with little repercussions.

In short. This section would not even be here if it was not for myself and a couple others. Also, the vast majority of the work, support and info would not even exist. This is not the first device I've done this for either. I did my part, and more.

 

[kuronosan]

awesome, what a helpful person.

Thanks for standing by the community.

When several MTK developers (who have coded custom ROMs, kernels, and firmwares for MTK devices) tell you that your ROM has issues and you call them wannabes or haters, you really don't deserve any sort of adulation.

Besides, I'm still here providing support. Much of what I've discovered while working with other developers has become commonplace on future firmwares. I don't appreciate being called a "wannabe" or "hater" when calling people out on stupid mistakes.

XDA is not a place for Solid Snakes. It's a place for developers to work together. Not helping others is the peak of asshole-i-tude and accepting contributions to your work while not contributing to that of others is the antithesis of XDA.

 

[xcooling]

Loosers attitude: give up and run away, complain because you were not given enough credit or fame

Winners attitude: would be to make your rom better, keep helping the community as you have done.

 

[kuronosan]

Loosers attitude: give up and run away, complain because you were not given enough credit or fame

Winners attitude: would be to make your rom better, keep helping the community as you have done.

Cool story bro

 

[Lokifish Marz]

So you support lying, theft of intellectual property and copyrights and acting like an 3 year old by calling people names? If that's the case then let me steal his work, improve it and call it my own vs trying fixing real problems like the ability to erase the IMEI with nothing more than a webpage or destroy the partition map with an email. Themes are the least of this devices problems.

 

[speedyink]

Awesome. This device already had a bad rep with the devs for various reasons, then this monx guy swoops in to crush any remaining hope we had. Oh well, I'm thankful for what you guys have done, I actually enjoy my TS because of you guys, and that's all I could have asked for.

 

[kuronosan]

Awesome. This device already had a bad rep with the devs for various reasons, then this monx guy swoops in to crush any remaining hope we had. Oh well, I'm thankful for what you guys have done, I actually enjoy my TS because of you guys, and that's all I could have asked for.

I'm still working on quite a few projects. Stay tuned. They likely won't end up here, but you never know.

 

[speedyink]

Glad to hear kuronosan! I understand if you don't want to release it here, maybe you could PM me where you plan to release it or something? I've been interested in what you've been doing, and you have said some things in the past that sound promising (like news of KK and the like).

Thanks for sticking with it, and again to all the devs for all the previous work that helped us get as far as we are.

 

[death_entry]

Adam Outler, Dees Troy, kuronosan, ChiefzReloaded, ClearD and myself all work(ed) together on the TrueSmart/x201. Almost all work released on xda and any other forums, English or otherwise, is either based on our work, or authorized mirrors of our work. Some of our work is even in official firmware as we have worked with Omate since October of last year on issues.

I maintained an updated archive of almost every firmware and ROM released for not only the TrueSmart but the entire x201 platform and did security checks on all of it as well as look for any changes that may benefit all x201 users. I was also responsible for the core ROM work as well as being part of the early TWRP development and assisting the other devs with their work. Adam Outler, Dees Troy and kuronosan have all referenced my work at one point or another for their own works. In fact my work was called "amazing" by Adam Outer and "required" buy multiple other devs.

monx STOLE the work of at least five other devs and never even so much as apologized, then have repeated called other devs wannabe's.

And as far as the security and optimizations analysis, those results are after a peer review in which all the results matched. monx has called it b$ and and yet again called multiple devs wannabes.

I have better things to do than be part of a community that allows an ass like monx to kang, distribute an admitted trojan infected ROM and call multiple devs that came before him wannabe's and be a general ass with little repercussions.

In short. This section would not even be here if it was not for myself and a couple others. Also, the vast majority of the work, support and info would not even exist. This is not the first device I've done this for either. I did my part, and more.

Could just not ignore him,,, I only flashed the rom to see what the BT tethering was like out of curiosity (its very slow and useable)... will be ditching the ROM when I can get round to it... been annoying me all week I can't wear my watch has it just drains flat with this ROM....

 

[kuronosan]

Glad to hear kuronosan! I understand if you don't want to release it here, maybe you could PM me where you plan to release it or something? I've been interested in what you've been doing, and you have said some things in the past that sound promising (like news of KK and the like).

Thanks for sticking with it, and again to all the devs for all the previous work that helped us get as far as we are.

I've personally approached monx about sharing work and ideas but he clearly has no intention of doing so; he has not responded but he continues to post in his topics.

That's fine. I'm only interested in continuing to better this watch and I have my own things to work on. As far as battery tweaks, I've managed to stabilize that (one of my users mentioned battery life 4-5 days with regular use) and I've managed to make quite a few gains.

Some of the things I would like to share involve making BT more stable and accessible across all ROMs, but again... he has no interest in sharing.

So while some of you hang from his beard as though Loki is the bad guy here, remember the ROM you love so much came from Loki's work and from the relationship I continue to foster with the CEO of this company.

But hey, no worries. Keep on praising a glorified themer who won't share his work with anyone else.

I'll be back here when I get my hands on the KK build.

 

[sirocyl]

Well, I'm gonna stick to my MotoACTV for a little longer. Planned on buying a TS secondhand, but hardware issues, software issues, and the current bout of drama, are very well keeping me from upgrading.

I understand your (TS devs) positions and motives. I know that there's a reason why you left the development on this device, and I'm glad you've simply quit development, rather than fighting and starting a riot.

However, with nearly all of the developers having abandoned the device, I don't see a good future coming from this.
I was hopeful through the kickstarter phase, and it's a pretty cool piece of tech, but, chances are, Omate will support it better than the community, until someone stands up, starts their own thing, and isn't afraid of getting their work ripped off.

Anyway, thanks for the development it did get, and all the cool things you guys do. If it weren't for you, this device would probably be dead in the water unless the OEM goes above and beyond to support it for a while.