1

Android Mobile OS Snooping By Samsung,

Xiaomi, Huawei and Realme Handsets

CONTENT OF NETWORK CONNECTIONS

Note: To save space and reduce repetition, common Google

Play Services and Google Play store connections are not

included, e.g.

1) https://play.googleapis.com/vn/log/batch

2) https://play.googleapis.com/play/log

3) https://www.googleapis.com/experimentsandconfigs

2

I. SAMSUNG

Summary:

Samsung system app endpoints: Identifiers Sent:

gos-api.gos-gsp.io uuid

api.omc.samsungdm.com hardware serial number, Samsung

Consumer ID, Firebase IDs/tokens

dir-apis.samsungdm.com IMEIs, hardware serial number,

Samsung Consumer ID

api.gras.samsungdm.com hardware serial number, regID

capi.samsungcloud.com device id, authorization value

fota-cloud-dn.ospserver.net IMEI, Firebase ID

sspapi-prd.samsungrs.com GAID

dms.ospserver.net IMEIs

sdk.pushmessage.samsung.com IMEI, Firebase ID

samsung-

directory.edge.hiyaapi.com

GAID, other IDs

us-api.mcsvc.samsung.com x-smcs-did

us-rd.mcsvc.samsung.com sid

ie-odc.samsungapps.com IMEI

Third-party (non-Google) system

Identifiers Sent:

app.adjust.com GAID, android uuid

www.linkedin.com bcookie, bscookie, lidc, trackingId

samsung-directory.edge.hiyaapi.

com

GAID X-Hiy-Installation-User-ID,

hin, hui

Identifiers observed to persist

across factory reset

IMEIs (including hashes of the

IMEIs), hardware serial number,

Samsung Consumer ID

TABLE I

2) Details of installed software are sent to os-api.gos-gsp.io/,

TABLE II

GOOGLE SYSTEM APPS).

com. This appears to be associated with the Samsung

Cloud service.

a proprietary format). These connections appears to be

associated with the Samsung Knox service.

and the Samsung device/consumer id are sent to www.

ospserver.net/, which appears to be a Samsung server.

Cell tower identifiers are sent that reveal the approximate

device location. The Firebase authentication token for app

com.wssyncmldm is also sent, allowing linkage of data

collection by Samsung and Google Firebase.

3

4

quality database to determine the best Wifi network to

4) LinkedIn. A first connection is made to www.linkedin.

Installation-User-ID and an authorization token that when

decoded contains hin and hui values that appear to be

persistent device identifiers.

log handset activity using Google Firebase Analytics.

These include: com.google.android.apps.maps,com.

microsoft.skydrive,com.android.vending,com.google.

android.googlequicksearchbox,com.sfr.android.sfrjeux,

com.altice.android.myapps

x−wap−profile: http://www.openmobilealliance.org/tech/profiles/

<<< HTTP 200, 168.30KB

instance id=

5

<<< HTTP 200, 1.19KB

response sets a cookie and sends config information presumably based on

geolocation of the handset IP address (namely that the country is IRL,

currency is euro etc). The handset as no SIM installed here.

POST https://app−measurement.com/a

POST body decoded as protobuf:

<...>

8: ”android”

9: ”10”

10: ”SM−G960F”

11: ”fr−fr”

12: 60

23: 1

30: ”egHfAlJvXwI”

31: 1543000

35: 1585956163239078

<...>

System app com.altice.android.myapps registering with Google Analytics.

The value cfb8a087-1c38-4bb9-bc15-5f51001b8df1 is the Google rdid/adid

advertising identifier, The d4b47dc0a35001516161c1141fed695a value is the

app

instance id and the egHfAlJvXwI value is later sent as the X-appid

com.samsung.android.bixby.agent, com.samsung.android.kgclient,

com.samsung.android.themestore, com.sec.android.app.billing,

com.samsung.android.game.gamehome, com.android.vending,

om.google.android.googlequicksearchbox, com.altice.android.myapps

POST https://android.googleapis.com/checkin

This checkin connection as been documented elsewhere. It links together

several device identifiers including the IMEI, hardware serial number and

Wifi MAC address, and sends extensive details of the device hardware and

software to Google.

Sends telemetry to Microsoft. The Bond Compact Binary format is a

Microsoft data serialisation format. The schema is needed to decode Bond

and so we decompiled the app, manually reconstructed the schema from the

decompiled code and then compiled a C++ programme based on this

reconstructed schema using Microsoft’s Bond compiler to yield a decoder

that can deserialise the observed POST payload data, then re-serialise to

json so that its human readable. The Bond documentation is unhelpful, to

say the least, so this was quite a painful process. After decoding we

observed three main types of event payload. One is act

stats, e.g.

”:[”7434683b182f4b49bc52295c8152518d−e1d93d3d−7e05−4dd3−94d4−

DataPackageId”:”39f999f3−3773−4a6c−919f−03088dfb241c”,”Timestamp

−3261−4832−a234−bc0f2c11c76d”,”Timestamp”:1617185943946,”Type”:”

2) DeviceInfo.SDKUid - The device unique identifier (similar to

6

”,”true”,”ChargerSetting”,”false”,”CheckOfferEligible”,”false”,”

DefaultPushNotificationAction”,”true”,”DetectXplatDbCorruption”,”true”,”

DeviceInfo.Id”,”cff4bd4ddb34000b”,”DeviceInfo.Make”,”samsung”,”

DeviceInfo.Model”,”SM−G960F”,”DeviceInfo.NetworkCost”,”Unknown”,”

DeviceInfo.NetworkType”,”Unknown”,”DeviceInfo.OsBuild”,”

G960FXXU8DTC5”,”DeviceInfo.OsName”,”Android”,”DeviceInfo.

OsVersion”,”10”,”DeviceInfo.SDKUid”,”dac15d07-c41e-4121-b672-

c46f1496da7c”,”DisableRoboAlbums”,”true”,”DiscoverView2”,”true”,”

DiscoverViewLocalNotification”,”true”,”Dogfood”,”false”,”

ECSConfigTesting4”,”0”,”EditTagsV2 Android”,”false”,”

EnableCrashSearchStatistics”,”false”,”EnableCrashTelemetry”,”true”,”

EnableMRUv2 1”,”true”,”EnableRiverflowGrouping”,”true”,”

EnvironmentManagementState”,”NO MANAGEMENT”,”EventInfo.InitId

IapRecoveryManager”,”true”,”InAppPurchases Android”,”true”,”

IsIntentional”,”0”,”JoinOpenPublicBeta”,”true”,”LGOffer”,”false”,”

LegacyEventName”,”AppState/ProcessStart”,”LensSDKBulkMode”,”false”,”

LensSDKCropMagnifier”,”true”,”LensSDKInk”,”true”,”LensSDKPageLimit

”,”10”,”LensSDKPhotoModeTheme”,”true”,”LensSDKScan”,”true”,”

LensSDKSnapToEdge”,”true”,”LensSDKTapToSelect”,”true”,”

LensSDKTelemetry”,”false”,”LensSDKTextStickers”,”true”,”

LocalFolderCovers”,”false”,”LocalPhotoVideoStreams”,”1”,”LogsToFabric”,”

false”,”LoopDetection”,”true”,”MAMAllowedAccounts”,”true”,”

MarqueeSelect”,”true”,”MassDeletePushNotificationAction”,”1”,”

NewExperienceForBeta”,”true”,”NewOdcSaveAs”,”true”,”

NotificationChannels”,”true”,”NotificationsBlocked”,”false”,”

O365ChunkUploading”,”true”,”ODBCameraBackup”,”true”,”

ODBEmbeddedViewer v1”,”true”,”ODBPhotosView”,”true”,”

ODBRemoveFromSharedList”,”false”,”ODCExpirationLinks”,”true”,”

OdbDocCreation”,”false”,”OdbFreUpsell”,”false”,”OdbGetChangesForShared

”,”true”,”OdbNotifications”,”true”,”OdbSharingDialog”,”true”,”

OdbVRoomSharedWithMe2”,”true”,”OdcBundleSharing”,”false”,”

OdcHevcStreaming2”,”true”,”OdcSharingDialog”,”false”,”

OdcSharingGoPremium”,”true”,”OdcSharingLearnMore”,”true”,”

OdcWebSharingDialog”,”−1”,”OfferExpirationNotifications”,”true”,”

”,”false”,”OneDriveApiFileDownload”,”true”,”OneDriveApiSingleFileUpload

true”,”PhotosSearch”,”true”,”PhotosUploadSection”,”true”,”PowerLift”,”true

”,”PreVersion1RestoreAccessToken”,”false”,”

PreVersion1RestoreAccessTokenUrl”,”https://onedrive.live.com/?v=restore”,”

PreinstallManufacturer”,”Samsung”,”ProjectZeroUpsell”,”false”,”

PurchaseSuccess2”,”−1”,”QuotaPushNotificationAction”,”true”,”

RansomwareHandling”,”true”,”RecoverFromEmptyOwnerCid”,”true”,”

RefreshUIWhenOnePageSynced”,”true”,”

”,”−1”,”RestoreOneDriveEnableCookies”,”true”,”RestoreOneDriveEntryPoint

”,”true”,”ResyncWhenMetadataCorrupted2”,”false”,”

RetryWhenMediaTAServiceError”,”true”,”SampleRate”,”1”,”

testRamp”,”SamsungDeal”,”true”,”SamsungOfferId”,”ProjectZeroPointOne”,”

7

”,”true”,”DiscoverView2”,”true”,”DiscoverViewLocalNotification”,”true”,”

EnvironmentManagementState”,”NO MANAGEMENT”,”EventInfo.InitId”,”

b21ec774−7477−4be5−a971−fd031e14efd8”,”EventInfo.Name”,”usagemobile

”,”EventInfo.SdkVersion”,”ACT−Android−Java−no−3.0.12.0−ECS”,”

EventInfo.Sequence”,”2”,”EventInfo.Source”,”act default source”,”EventInfo

.Time”,”2021−03−31T12:45:04.262Z”,”EventName”,”Legacy/AppState/

ProcessStart”,”EventSampleList”,”Legacy/Auth/TokenRefresh”,”

EventSchemaVersion”,”20”,”EventType”,”Legacy”,”FastScroller”,”true”,”

FileExtensionsSetting”,”true”,”FilesRepair Android”,”true”,”

FilesUploadSection”,”false”,”Freemium”,”true”,”

GooglePlayServicesAvailable”,”true”,”HeaderSwitchSort”,”true”,”

IapRecoveryManager”,”true”,”InAppPurchases Android”,”true”,”

InstalledOnSdCard”,”false”,”IntuneLogging”,”true”,”IsDataCleared”,”false”,”

MediaTAScanSetMetadata”,”true”,”MediaTAScanVault”,”true”,”

MobileNetworkSetting”,”settings wifi only”,”MultiPageDocScan”,”true”,”

MultiPageDocScanODB”,”true”,”Name”,”Legacy/AppState/ProcessStart”,”

NativeCrashReportToFabric”,”false”,”NetworkChoice”,”Unset”,”

NewExperienceForBeta”,”true”,”NewOdcSaveAs”,”true”,”

NewSamsungFlow v2”,”0”,”NewUiAB”,”1”,”NewUiSurvey”,”false”,”

NotificationChannels”,”true”,”NotificationsBlocked”,”false”,”

NotificationsHistory Android”,”true”,”NotificationsSettings”,”true”,”

O365ChunkUploading”,”true”,”ODBCameraBackup”,”true”,”

ODBEmbeddedViewer v1”,”true”,”ODBPhotosView”,”true”,”

OdcSharingGoPremium”,”true”,”OdcSharingLearnMore”,”true”,”

OfficeLensScanV2”,”true”,”OfficePdfPreview”,”true”,”OfficePdfPreviewOdb

true”,”OfflineFoldersPersonal”,”true”,”OfflineNotification Android”,”true”,”

OnBoardingUI”,”false”,”OnThisDay”,”false”,”OneDriveApiChunkFileUpload

”,”false”,”OneDriveApiFileDownload”,”true”,”OneDriveApiSingleFileUpload

”,”true”,”OneRmCampaigns”,”true”,”OutlookUpsellSamsungPromotionAB

”,”0”,”PDFLocalNotification”,”true”,”PdfCrossFade”,”true”,”PeopleCard”,”

true”,”PhotosSearch”,”true”,”PhotosUploadSection”,”true”,”PowerLift”,”true

”,”PreVersion1RestoreAccessToken”,”false”,”

PreVersion1RestoreAccessTokenUrl”,”https://onedrive.live.com/?v=restore”,”

PreinstallManufacturer”,”Samsung”,”ProjectZeroUpsell”,”false”,”

”,”−1”,”RestoreOneDriveEnableCookies”,”true”,”RestoreOneDriveEntryPoint

”,”true”,”ResyncWhenMetadataCorrupted2”,”false”,”

SamplingNonReportingDevice”,”true”,”SamsungAllowlistedRamp”,”

testRamp”,”SamsungDeal”,”true”,”SamsungOfferId”,”ProjectZeroPointOne”,”

SamsungOfferUpsellExperimentEvent”,”NA”,”SamsungOfferYears”,”1”,”

SamsungStorageAmount”,”100”,”Scan Android”,”true”,”SendFeedback”,”

true”,”ServiceDrivenPositioning”,”true”,”ShakeToSendFeedback”,”true”,”

ShareCustomization Android”,”true”,”SharingLink ODB Android”,”true”,”

ShowFileExtensionsSetting”,”false”,”ShowReauthInvalidToken”,”true”,”

SonyOffer”,”false”,”SortExtensions”,”true”,”StreamingUploadWriteBack”,”

false”,”SuggestAnIdea”,”false”,”SwitchToModernRateDialog”,”true”,”

SyncAlternatePhotoFolders”,”true”,”SyncSignalOverError”,”false”,”

ThumbnailAndStreamingTelemetry”,”true”,”ThumbnailLoadingSamplingRate

8

0,”epoch”:”−4785621991705672117”,”seqNum”:9,”iKey”:”A−MMXSDK”,”

flags”:257,”os”:”Android”,”osVer”:”10”,”appId”:”A:com.microsoft.

appmanager”,”appVer”:”1.21072.151.0”,”cV”:”yUn+2y

c4ed18d002”,”deviceClass”:”Android.Pho

”:”1.6.0”,”ringName”:”PRODUCTION”,”isPreload”:false,”model”:”SM−

G960F”,”manufacturer”:”samsung”,”dim3”:”

3.3.0−development.2107.29001”,”activityStatus”:1,”result”:0,”resultDetail”:”

START ASYNC”,”correlationId”:”9837bd3a−6eed−4f6c−a5dc−

aad3953ca924”,”relatedId”:”508c8e5a−fbae−4d12−

c4ed18d002”,”deviceClass”:”Android.Ph

G960F”,”manufacturer”:”samsung”,”dim3”:

”3.3.0−development.2107.29001”,”activityStatus”:2,”result”:3,”resultDetail”:”

GET NOTIFICATION PROVIDER”,”correlationId”:”9837bd3a−6eed−4f6c−

a5dc−aad3953ca924”,”relatedId”:”508c

8e5a−fbae−4d12−961d−a51199404b8d”,”details”:”Notification provider does

RomeInitialization.DeviceRegistrarRomeAsyncInitActivity”,”time

G960F”,”manufacturer”:”samsung”,”dim3”:

”3.3.0−development.2107.29001”,”activityStatus”:1,”result”:0,”resultDetail”:”

GET NOTIFICATION PROVIDER”,”correlationId”:”4aec3f8e−0721−4793−

b812−d73c00a29de8”,”relatedId”:”508c

GET https://gos−api.gos−gsp.io/v4/devices/starlte

Headers

sec.android.app.samsungapps=enabled,com.samsung.android.game.

gos-gsp.io appears to be a Samsung domain related to games (gos=game

optimisation service?). The uuid value c0a49953a5de45ea81f494f435fe8c99

links connections to this domain together and so acts as a device identifier.

GET https://www.googleadservices.com/pagead/conversion/1001680686/?

bundleid=com.google.android.youtube&appversion=14.47.50&osversion

4bb9-bc15-5f51001b8df1&timestamp=1617103754.324&remarketing only

=1&usage tracking enabled=0&data.screen name=%3

CAndroid YT Open App%3E

appears to be the pre-installed Google Youtube app registering with the

9

=14.47.50&cver=14.47.50&cosver=10&cbrand=samsung&proc=8

<<< HTTP 204, 0.00B

POST https://api.omc.samsungdm.com/v5/api/service/getOMCUpdateVersion

Headers

device id=”227ae90a14017ece”,signature=”fwmVO4p...OK6uUTHezZCs=”

227ae90a14017ece”,”deviceUN”:”CE0218227AE90A14017E”,”emStatus

”:”0”,”fingerPrint”:”samsung/starltexx/starlte:10/QP1A.190711.020/

G960FXXU8DTC5:user/release−keys”,”fwVersion”:”G960FXXU8DTC5/

G960FOXJ8DTC5/G960FXXU8DTC5”,”initType”:”OOBE”,”modelName”:”

device id=”227ae90a14017ece”,signature=”JZFkh1JEa...uYGwroF28Y=”

<<< HTTP 200, 0.00B

Set-Cookie: WMONID=seXNro qjh

The device id value is the hardware serial number. The regId value is an

authentication token returned by Google Firebase in an earlier connection

made by app com.samsung.android.app.omcagent. It therefore appears to

allow linkage of data collection by Samsung and Google Firebase.

POST https://dir−apis.samsungdm.com/api/v1/device

deviceID”:”IMEI:357171099697326”,”secondDeviceID”:”IMEI:

serialNumber”:”R58K514R04Y”,”customerCode”:”SFR”,”mncByNetwork

deviceNetworkType”:”GSM”,”deviceNetworkCellInfo”:”48500181”,”

clientVersion”:”5.0.08”,”eulaVersion”:2,”networkBearer”:”WIFI”,”rooting

device/user identifier (the consumer id and uniqueNumber value), the device

act as a rough indicator of location.

POST https://api.gras.samsungdm.com/v1/api/gras/registerDevice

Headers

227ae90a14017ece”,signature=”ClntUk0sz...6o5CoXo//0=”,server id=”

dr39o9a52q”

”carrierID”: ”SFR”,

”clientVersion”: ”2.0.15”,

”deviceID”: ”227ae90a14017ece”,

”fingerPrint”: ”samsung/starltexx/starlte:10/QP1A.190711.020/

Authorization: auth identifier=”GRASSE−AUTH”,device id=”