There seems to be a major vulnerability in Android: even when using firewalls these aren't active immediately after a restart.
The seconds before the firewall (NetGuard) starts can be used by apps that auto-start to send (exfiltrate) all kinds of data.
For example:
- There apps that are installed by-default that can't be deinstalled even though I'd like to deinstall them and they are running by default and autostart which also can't be prevented (and I can see that these apps try to send data in the NetGuard protocols)
- the keyboard "Gboard" could for example send everything one has ever typed on the phone including passwords within seconds, it also tries to "update your typing experience" from time to time even though it shouldn't and is blocked by NetGuard
How can this be prevented?
One way could be to always deactivate Internet before turning the phone off but that may not always work (for example when updating) and sometimes the phone could get turned off accidentally or because the battery goes empty.
