1

I was reviewing what programs are connecting to the internet on my Android Nexus 5, and I saw that Root had already disconnected from the connection to SoftLayer Technologies, inc (IP 108.168.176.245 Port 5222 insecurely over http - status: TCP_Close_Wait).

Why does Root connect to SoftLayer? Is this normal?

migrated from security.stackexchange.com Nov 4 '14 at 8:44

This question came from our site for information security professionals.

  • No this isn't normal. How and what steps did you use to get root? You have "BAD" software on your device. Have you tried to unroot the device? Does it still request access for that IP address? – HasH_BrowN Nov 4 '14 at 16:23
  • I've rooted my Nexus 5 using "OEM unlock" method long ago when I first got it. I don't think it had anything to do with this recent change. I just checked and SockStat (open source app) showed that it just sent TCP_SYN just now. When ever I open the app it seem to disappear. – Mars Nov 5 '14 at 15:38
  • I've just launched the app, saw it's now established a connection for a split second with 180.76.3.151 (I've immediately captured a screenshot to look up the IP, and it disconnected and disappeared immediately). This second IP is in China and belongs to Baidu company. I have AFwall+ which doesn't show Root logs, only app logs. How can I know what app is using Root to establish a connection? – Mars Nov 5 '14 at 15:44
2

So for anyone who sees suspicious internet activity on his phone, here's how I figured it out:

I monitor my phone on random occasions (several times a day) using this amazing app called: SockStat (no conflict of interest).

When I just found this IP yesterday 108.168.176.245, I blocked everything on AFWall+ (Android open source firewall), this way, any app that tries to connect remotely will be logged (turn logging on if it's off).

In my case, I saw that WhatsApp+ tried to connect to the same IP that I'm investigating. Looked up the WhatsApp+ IP and yes, it's on SoftLayer network. Waited a bit, and finally captured what caused Root to connect! Same IP but this time, "(Kernel) - Linux kernel" is trying to connect to that IP.

From here, I'll email the developer* and ask how he got Root without requesting Root from Superuser app.

I still haven't figured out what is trying to connect to Baidu (180.76.3.151), but you get the idea from the first suspicious IP.

Hope this helps.

*WhatsApp+ is a third-party WhatsApp client. Not sure how it works under the hood though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.