• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root [Boost Mobile] I smell a RAT!

mercury0x000d

The ultra-modern operator
Nov 24, 2011
1,639
1,213
Penn's Woods
www.mercurycoding.com
So I've been doing testing of my ROM for the majority of the time I've had my Warp. During the development of my build.prop tweaks, I noticed the following lines:

Code:
#
# system props for the cne module
#
# modify the data config wangcheng_ril_20110120
persist.cne.UseCne=false
persist.cne.loadVendorCne=true
persist.cne.bat.range.low.med=30
persist.cne.bat.range.med.high=60
persist.cne.loc.policy.op=/system/etc/OperatorPolicy.xml
persist.cne.loc.policy.user=/system/etc/UserPolicy.xml
persist.cne.bwbased.rat.sel=true
persist.cne.snsr.based.rat.mgt=true
persist.cne.bat.based.rat.mgt=true
persist.cne.rat.acq.time.out=30000
persist.cne.rat.acq.retry.tout=0

Notice the "rat" in the lower five lines. Now, perhaps I'm being paranoid, but in computing you would normally interpret that abbreviation as "Remote Administration Tool." What is that? Basically any program you can use to monitor or control a remote computer, such as TightVNC or TeamViewer. Not knowing if my suspicions were correct or not, I changed all the values to false to hopefully "disable" the RAT, if one in fact existed. My phone continued to perform normally, even during heavy tethering use, so I concluded all was well.

Fast forward several months...

Recently, Ive been doing some ROM testing, and due to some issues with the tweaks I had in build.prop, I swapped it out for the original version giving no thought to these lines which I had removed before. Today, not even three days after swapping the files, I receive a text from Boost saying that I am violating the TOS, blah, blah, blah...

So, what I want to know is... could this be only a coincidence? Or does our phone have some kind of integrated monitor?
 
Last edited:
  • Like
Reactions: LilBit
If this is true then I'm Pissed!!! Can I edit my own build.prop from within the phone? Using file explorer or root explorer?

I know, right? Yes, you can do that. Just navigate to the build.prop file (/system/build.prop) and edit it directly. I set the lines to all false and the two numeric values to 0.
 
  • Like
Reactions: LilBit
Upvote 0
Interesting. So you had.

# system props for the cne module
#
# modify the data config wangcheng_ril_20110120
persist.cne.UseCne=false
persist.cne.loadVendorCne=true
persist.cne.bat.range.low.med=30
persist.cne.bat.range.med.high=60
persist.cne.loc.policy.op=/system/etc/OperatorPolicy.xml
persist.cne.loc.policy.user=/system/etc/UserPolicy.xml
persist.cne.bwbased.rat.sel=false
persist.cne.snsr.based.rat.mgt=false
persist.cne.bat.based.rat.mgt=false
persist.cne.rat.acq.time.out=0
persist.cne.rat.acq.retry.tout=0
 
Upvote 0
Interesting. So you had.

# system props for the cne module
#
# modify the data config wangcheng_ril_20110120
persist.cne.UseCne=false
persist.cne.loadVendorCne=true
persist.cne.bat.range.low.med=30
persist.cne.bat.range.med.high=60
persist.cne.loc.policy.op=/system/etc/OperatorPolicy.xml
persist.cne.loc.policy.user=/system/etc/UserPolicy.xml
persist.cne.bwbased.rat.sel=false
persist.cne.snsr.based.rat.mgt=false
persist.cne.bat.based.rat.mgt=false
persist.cne.rat.acq.time.out=0
persist.cne.rat.acq.retry.tout=0


Correct, that's what I changed them to.
 
Upvote 0
Correct, that's what I changed them to.

I wouldnt doubt it here guys an android is one big tracking beacon in your pocket i dont know how many of you can get on the deep web or know what it is but the hackers bbs i am a member of highly recommends either not buying an android or hacking google completely out of the phones system the latter is a highly delicate process because you have to basically find every code that ties into google and change it to the anonymous codes they list the ip hack that removes the throttling we have all heard of it yes well i have a feeling that they know too because i have it set up the exact way i was told to do and everytime i tether i have to reboot to even get 1x signal you think they dont browse here looking for what we do i dont mean to sound like a paranoid internet fearing individual but they are here they are waiting
 
  • Like
Reactions: Russ71 and LilBit
Upvote 0
I wouldnt doubt it here guys an android is one big tracking beacon in your pocket i dont know how many of you can get on the deep web or know what it is but the hackers bbs i am a member of highly recommends either not buying an android or hacking google completely out of the phones system the latter is a highly delicate process because you have to basically find every code that ties into google and change it to the anonymous codes they list the ip hack that removes the throttling we have all heard of it yes well i have a feeling that they know too because i have it set up the exact way i was told to do and everytime i tether i have to reboot to even get 1x signal you think they dont browse here looking for what we do i dont mean to sound like a paranoid internet fearing individual but they are here they are waiting

I tried that right after I rooted this phone last year and really messed it up. I used TB to delete google market and gmail, really messed up the phone bad. But now, with the new way to root and cwm my phone is back better than ever.


Now, after editing the build.prop I seem to have a full signal all over my apt, where as before it would alsway switch between 1X and 3G constantly. WTF!! Also everything seems to be working ok, wifi tether, text, internet with boat browser, etc. Cant really call anyone because its so late , but I'll be watching the phone, and this thread like a freakin Hawk!! This shit just burns me up!!
 
Upvote 0
That seems fishy to me. Then again if my PC wants to send an error report I say no.

I agree, I do the same thing! lol

The way I see it, if it's something as simple as a little debug message being sent, there'd most likely be an option to turn it off. Companies can debug their own code with or without our help, although granted having a couple thousand debug messages from real-world usage would speed things up a bit. But my point here is that they really don't care if they get our error reports and debug data or not. But something that they don't give us an (accessable) option to turn off? That sounds very fishy to me indeed.
 
Upvote 0
I agree, I do the same thing! lol

The way I see it, if it's something as simple as a little debug message being sent, there'd most likely be an option to turn it off. Companies can debug their own code with or without our help, although granted having a couple thousand debug messages from real-world usage would speed things up a bit. But my point here is that they really don't care if they get our error reports and debug data or not. But something that they don't give us an (accessable) option to turn off? That sounds very fishy to me indeed.

I'm running Ubuntu, and very rarely does it tell me I had an internal error, would you like to send a report. I always click no.
 
Upvote 0
I tried that right after I rooted this phone last year and really messed it up. I used TB to delete google market and gmail, really messed up the phone bad. But now, with the new way to root and cwm my phone is back better than ever.


Now, after editing the build.prop I seem to have a full signal all over my apt, where as before it would alsway switch between 1X and 3G constantly. WTF!! Also everything seems to be working ok, wifi tether, text, internet with boat browser, etc. Cant really call anyone because its so late , but I'll be watching the phone, and this thread like a freakin Hawk!! This shit just burns me up!!

If it was that easy to remove them would they still be in business they update these phones daily sir everytime backround data is on do you know whats happening do you think they want you to know i bet all methods of removing google completely go obsolete on a daily basis its what they do guys they are only in business to keep an eye on us it has nothing to do with apps or simple codes the guys on my hack bbs are talking total phone recoding total manipulation of phone os and total software overwrites and rewrites this isnt anything simple if it was a thread would have been made how to do it i read the instructions and by the time i was done i couldnt think because i hurt my brain it is not simple if the phone is your main phone dont bother if its a test i will try to find the link and make a thread for you guys
 
Upvote 0
Please pardon me but I am doing this research on my phone since I'm driving... it is possible this could be part of boosts ota updates. I'll be off work and home in about another hour and can do some more thorough research...

1) don't be doing that and driving that's dangerous
2) if it has to do with ota most of us don't need that then.
3) yes check into it when home.
 
Upvote 0
Please pardon me but I am doing this research on my phone since I'm driving... it is possible this could be part of boosts ota updates. I'll be off work and home in about another hour and can do some more thorough research...

In my research I ran into the same possible association, but nowhere does it come out and say what these lines are for.

And there's the issue of the huge coincidence that I swap build.prop files and within days get the message from Angryface, Inc.
 
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones