Battd opening connections to ad brokers

Discussion in 'Motorola Droid Pro' started by phelbore, Nov 15, 2011.

  1. phelbore
    Offline

    phelbore New Member

    Joined:
    Jan 9, 2011
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    0
    I've noticed some strange connections open (using connection tracker to see what's open). These are all from /system/bin/battd, and appear to be to mobile ad brokers. Any ideas why? The connections are all to port 80 of the following addresses:

    23.15.7.57
    23.15.7.107
    107.20.133.247
    216.157.12.162
    50.16.214.161
    174.129.192.221
    96.7.175.55
    74.14.204.138
    74.14.204.102

    Which addresses it connects to seems to vary by what apps I open.
    I'm sbf'd, did all the OTA updates and rooted, with droidwall installed, so I'm not even sure HOW these are getting out.

    I've tried logging with shark and reading with shark reader but shark reader sucks and just shows everything as "RAW".

    Sent from my DROID Pro using DroidForums
  2. chaihg
    Offline

    chaihg New Member

    Joined:
    Aug 20, 2011
    Messages:
    71
    Likes Received:
    1
    Trophy Points:
    0
    Oh my god, this is interesting
  3. phelbore
    Offline

    phelbore New Member

    Joined:
    Jan 9, 2011
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    0
    I can't confirm that I haven't been hit by a trojan, but I tend to be fairly careful. Is this happening to you too?

    I can't even confirm that connection tracker is reporting the right app. I can tell that connection tracker is somehow pulling ads down when it's blocked by droidwall and isn't allowed root access by superuser, but I can't figure out how.

    At this point, I'm not sure if connection tracker is buggy or if this is a real issue.

    Sent from my DROID Pro using DroidForums
  4. chaihg
    Offline

    chaihg New Member

    Joined:
    Aug 20, 2011
    Messages:
    71
    Likes Received:
    1
    Trophy Points:
    0
    I cant confirm that. But if you give us step by step info on what to do then we will do it and report back to see if our results match.
  5. phelbore
    Offline

    phelbore New Member

    Joined:
    Jan 9, 2011
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    0
    Install https://market.android.com/details?id=com.borgshell.connectiontrackerfree or https://market.android.com/details?id=com.eolwral.osmonitor

    If you choose to use os monitor, these connections show up as being used by the "System" process.

    After that, turn on airplane mode, then reboot. Your phone will come up in airplane mode, so you know there are no connections initiated by booting up.
    Open connection tracker or os monitor (to the connections tab) and watch, you should see nothing.
    Turn off airplane mode, watch os monitor or connection tracker.
    Open an ad supported app, then watch os monitor or connection tracker.

    Sent from my DROID Pro using DroidForums
  6. phelbore
    Offline

    phelbore New Member

    Joined:
    Jan 9, 2011
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    0
    After some tinkering (and disabling my firewall, *slaps self on hand* Bad security, I know), it doesn't appear any data is being sent. It just opens the connections and puts them in the WAITING state.

    Anyone smarter (or dumber, for that matter) than me have any ideas? I don't like this, but I'm just not getting the malicious vibe from it.

    Sent from my DROID Pro using DroidForums
Search tags for this page
android battd
,
atrix battd files for droid x2
,

battd

,

battd android

,
battd razr
,
galaxy s3 battd.bin file location
,
motorola battd
,
plik battd android