Kicksecure is a free and open-source Linux distribution that aims to provide a highly secure computing environment. It has been developed from the ground up according to a formidable -- and time proven -- defense in-depth security design. In the default configuration, Kicksecure provides superior layered defenses of protection from many types of Malware.
Kicksecure is a complete computer operating system. Numerous applications come pre-installed with safe defaults which can be used immediately upon installation with minimal user input.
Kicksecure uses an extensively security reconfigured of the Debian base (Hardened) which is run inside multiple virtual machines (VMs) on top of the host OS. This architecture provides a substantial layer of protection from malware and IP leaks. Applications are pre-installed and configured with safe defaults to make them ready for use with minimal user input.
The security and privacy of default software management (installing and upgrading software) are much better, making it harder for anyone to send you targeted, malicious software updates. This only applies to system updates over Tor, not all your internet traffic. Learn more
In Kicksecure no unnecessary software is installed by default such as exim, samba, cups etc. At the same time security enhancing software like AppArmor, sdwdate and tirdad are preinstalled. Learn more.
Kicksecure enhances all kinds of security settings, including: kernel hardening, Strong Linux User Account Isolation, disabling legacy login methods, higher quality randomness (entropy), network hardening, root access restrictions, application-specific hardening and much more. Learn more.
Kicksecure is a hardened operating system designed to be resistant to viruses and various attacks. It is based on Debian in accordance with an advanced multi-layer defense model, thereby providing in-depth security. Kicksecure provides protection from many types of malware in its default configuration with no customization required.
Table: Kicksecure Hardening Features
| Feature | Description |
|---|---|
| Default Package Selection | No unnecessary software is installed by default such as exim, samba, cups that otherwise gets installed by some flavors of Debian. [1] |
|
Secure and privacy-protected operating system (  |
 This helps protect against targeted, malicious software upgrades. By default, when using APT (Advanced Package Tool) to upgrade the system or install new software, Kicksecure uses torified operating system upgrades. This means all default APT package manager source files are set to only update over the Tor anonymity network. This makes sure that update servers cannot know who the user is or their IP address. As a result, this mitigates targeted malicious software attacks. This protection is not only much stronger than what iPhones or Android devices offer, but it's also better than what most Linux distributions provide.
This only applies to system updates. This does not mean that all of your internet traffic is automatically torified (protected by Tor). See also: Privacy Goals and Non-Goals of Kicksecure |
| Secure Package Sources Configuration | HTTPS (TLS) is enabled by default in APT. [5] |
| TCP ISN CPU Information Leak Protection |
tirdad (TCP Initial Sequence Numbers Randomization) prevents TCP ISN-based CPU Information Leaks; see footnote. [6]
|
security-misc
|
security-misc enhances miscellaneous security settings related to:
|
Secure network time synchronization using sdwdate
|
Secure Distributed Web Date (sdwdate) mitigates threats from time based attacks by not relying upon unauthenticated NTP. |
| Default security software installations |
Software like AppArmor
|
| Open Link Confirmation
|
This is enabled by default and prevents links from being unintentionally opened in supported browsers. |
While many valuable security guides exist, better security and privacy for the masses necessitates software that applies a majority of hardening instructions by default.
This is the reason the Free and Open Source Kicksecure project exist; to offer a system that provides a reasonable security-hardened baseline, with the in-built flexibility to apply additional hardening dependent upon the user's threat model, hardware capabilities, motivation and knowledge. [8] The table below provides a further rationale for this position.
Table: Security Guide Limitations
| Factor | Description |
|---|---|
| Initial vulnerability | When a base system is first installed, various security customizations are not yet applied. All users are vulnerable during this period. |
| Recipient insecurity | Security principles do not exist in a vacuum:
|
| Reliance on human memory | Adequate hardening often depends on discovering and remembering to apply all necessary steps from favorite security guides. |
| Error risks | Manually applying security guide steps can lead to mistakes that render the whole procedure ineffective. |
| Time requirements | Security guide steps are often lengthy and cover many different facets of computing. |
| Secure guide discovery | There are countless security/hardening guides available on the Internet. It is impossible to follow them all and serious research is required to find valuable new resources. |
| Incompleteness | Logically there is not one definitive, all-encompassing security guide. This means some users harden the kernel and install CPU microcode updates, while others rely on sandboxing and implement better random number generators, and so on. Most users miss critical elements because they are simply not aware they exist. |
| Currency | Even the best security guides often contain outdated material. This is especially true for technically detailed or lengthy guides that canvass many topics. |
| Publication form | The form of security guides can effect their utility. For example, those published in blogs and which do not allow comments have grave disadvantages compared to systems relying on collaborative version control software (like git) or collaborative websites (such as a wiki). The reason is contributors can easily fix issues or update contents. |
| Popularity | Security guides which have low popularity cannot effect change and improve security practices if most people are unaware they exist. |
For these reasons Kicksecure will remain focused on enabling the majority of (reasonable) hardening settings by default, and allowing additional settings to be easily enforced via installable packages. For further information on this topic, see: The Problem with Security Guides and How We Can Fix It.
The Kicksecure development roadmap includes various security improvements:
. [10] See also DNS Security.Kicksecure is a security-hardened Linux Distribution. (Mobile version not planned yet.)
This section details potential future security enhancements for Kicksecure.
(The wiki source for the following text can be found in Template:Kicksecure_Android.)
| Most iPhone / Android devices [2] | "Libre Android" [11] | Linux Desktop Distributions | Kicksecure Development Goals | |
|---|---|---|---|---|
| Upgrades do not require vendor | No | Yes | Yes | Yes |
| User freedom to replace operating system | No | Yes | Yes | Yes |
| Administrator capabilities (root) not refused | No | Yes | Yes | Yes |
| Custom operating system (bootloader unlock) not refused | No | Yes | Yes | Yes |
| No trouble or void device warranty from software changes (rooting or bootloader unlock) | No [12] | No [13] | Yes | Yes |
| No user freedom restrictions | No [14] | Yes | Yes | Yes |
| No backdoors included | No [15] | Yes | Yes | Yes |
| No spyware included in operating system | No [16] | Yes | Yes | Yes |
| No culture of freemium applications that spy on users in appstores | No [17] | Yes | Yes | Yes |
| Culture of Freedom Software in appstores | No | Yes | Yes | Yes |
| Freedom Software | No [18] | Yes | Yes | Yes |
| Compromised application cannot access data of other applications | Yes [19] | Yes [19] | No | Yes |
| Malware on a compromised system cannot easily gain root | Yes [20] | Yes [20] | No [21] | Yes |
| Reasonable resistance against system wide rootkit | Yes [22] | Yes [22] | No | Yes |
| Verified Boot | Yes | Yes | No | Yes |
| Hardened Kernel
|
Yes | Yes | some | Yes |
| Full System MAC Policy
|
Yes | Yes | No | Yes |
| Internal storage can reasonably easily be removed and mounted elsewhere for the purpose of data recovery or hunting malware / rootkits. | No [23] | No [13] | Yes [24] | Yes [25] |
| Internal storage can reasonably easily be decrypted once transferred to a different device if password is known. | No [26] | No [27] | Yes | Yes [28] |
| Can reasonably easily boot from external hard drive, ignoring internal harddrive for purpose of data recovery or hunting malware / rootkits. | No | No [13] | Yes | Yes [25] |
| Can reasonably easily create full data backup. | No [29] | Yes | Yes | Yes [25] |
| Can reasonably easily create full data backup of any app when device is rooted with Titanium Backup or similar | No [30] | Yes | Yes | Yes [25] |
| Applications cannot refuse data backup (for purpose of malware, spyware analysis or backup and restore). | No [31] | Yes | Yes [32] | Yes [25] |
| No culture of users can ask device (code) for permission and device (code) will decide to grant or refuse the request. | No | Yes | Yes [32] | Yes [25] |
| No culture of applications refusing to run if device is rooted. | No [33] | Yes | Yes | Yes [25] |
| No culture of applications refusing to run if using a custom operating system (custom ROM). | No [34] | Yes | Yes | Yes [25] |
| User (privacy) settings are respected. | No [35] | Yes | Yes | Yes [25] |
| WiFi off indicator means that WiFi is really off. | No [36] | Yes | Yes | Yes [25] |
| Bluetooth off indicator means that Bluetooth is really off. | No [37] | Yes | Yes | Yes [25] |
| Prevention of targeted malicious upgrades. [38] | No [3] | ? [39] | ? [40] | Yes [41] |
| Vendors do not sometimes introduce mitigations that introduce attack surface. | No [42] | Yes | Yes | Yes [25] |
| The GNU Project does not state: "Apple's Operating Systems Are Malware" and "Google's Software is Malware".
|
No | Yes | Yes | Yes [25] |
Quote More than a billion hopelessly vulnerable Android gizmos in the wild that no longer receive security updates – research. The operating system of these devices:
Ability to upgrade (security fixes) devices; replace operating system; bootloader freedom vs bootloader non-freedom:
In conclusion, when using iPhone/Android devices that still receive security updates, the iPhone/Android approach provides strong protection against malware, meaning those platforms are impacted much less than Windows or Linux desktops. [19] Despite the many downsides (Mobile Devices Backdoors in Most Phones Tablets Etc, Data Harvesting by Most Phones, ...), the security model of popular mobile operating systems often affords better protection when attempting to prevent any malicious and unapproved party from establishing a foothold in their ecosystem. In the process, the user's and the security community's ability to audit and control what their devices are actually doing is severely diminished. Due to a Conflict of Interest this comes at the expense of transferring power from the user to the developers, user freedom restrictions, Tyrant Security, War on General Purpose Computing.
Kicksecure will not implement these kinds of user freedom restrictions since it is not required nor desirable. The capability to replace the operating system or gain administrator access will remain fully supported. Many popular device operating systems utilize security technologies which restrict user freedoms. In contrast, Kicksecure aims to utilize the same security concepts for the goal of empowering the user and increasing protection from malware.
It is theoretically possible to provide some of the same iPhone / Android security concepts on a Linux computer too. Steps have already been made to apply mobile device security concepts to Linux distributions such as security-misc and apparmor.d. Security technologies like hardened kernels or verified boot used by popular mobile operating systems could also be ported to Linux distributions. Community contributions are gladly welcomed! Here is a list of potential security enhancements for Kicksecure:
While developed with security-focused design goals, Kicksecure remains highly flexible. The layered approach to security allows applications to retain usability. Kicksecure can be used for everyday "general-purpose computing" or for more risky activities that require a highly advanced security-centric platform. Since Kicksecure is Freedom Software users may install any application of their choosing -- no restrictions are placed on how Kicksecure can be used, customized or modified.
Kicksecure aims to maximize usability by default so it can be utilized as an everyday, multipurpose operating system by users of all skill levels.
Table: Kicksecure Usability Features
| Feature | Description |
|---|---|
| Debian Usability Fixes |
|
| Simplicity and flexibility |
|
| Popular applications | Popular applications come pre-installed and configured with safe defaults to make them ready for use right out of the box. |
| Data protection | Sensitive user data is protected by state-of-the-art cryptographic tools:
|
Tip: Since Ubuntu is a Debian derivative, online help for Ubuntu most often works for Kicksecure.
In oversimplified terms, Kicksecure is just a collection of configuration files and scripts. Kicksecure is not a stripped down version of Debian; anything possible in "vanilla" Debian GNU/Linux can be replicated in Kicksecure.
Likewise, most problems and questions can be solved in the same way. For example: "How do I install VLC Media Player on Kicksecure?" -- "The same way as in Debian apt install vlc."
Kicksecure does not break anything, limit functionality, or prevent installation of compatible software.
Many people wonder why developers would spend countless hours of their own time to build an operating system and then give it away. Kicksecure developers believe it is immoral to benefit from those Free / Freedom Software components and give back nothing to the community. We stand on the shoulders of giants. Kicksecure and many other Libre software projects are only made possible because people invested time in writing code and kept it accessible for the public's benefit. Of course, a lot of us just find it great fun.
https://www.wilderssecurity.com/threads/hardened-debian-in-development-feedback-wanted.408245/
Each Kicksecure release is based on a particular version of Debian:
| Kicksecure version | Debian Version | Debian Codename |
|---|---|---|
Kicksecure 17.2.3.7 |
12 |
bookworm
|
Users can manually check the Kicksecure version at any time by following this step.
Kicksecure does not have a fixed release schedule. A new stable release only becomes available when it is deemed ready.
Table: Kicksecure Support Schedule
| Release | Description |
|---|---|
| New Debian Release | One month after a new stable version of Debian is released, Kicksecure VMs may no longer be supported on any older version of Debian. All users must upgrade the Debian platform promptly after the deprecation notice in order to use Kicksecure safely. |
| New Kicksecure Release | One month after a new stable version of Kicksecure is released, older versions will no longer be supported. All users must upgrade the Kicksecure platform promptly in order to remain safe. |
| Deprecation Notices | The deprecation notice is provided at least one month in advance and posted in the kicksecure.com news forum. Stay Tuned! All users must upgrade the respective platform promptly in order to remain safe.
|
Learning more about Kicksecure is the best way to determine whether it is a suitable solution in your personal circumstances. The following chapters are recommended:
. demonstrates this. It is therefore established that the google website can result in remote app installation on the phone.
It follows that a coerced or compromised google play website could do the same. Since the gmail based web login can be linked to the same gmail address on the phone, pushing targeted malicious upgrades is esspecially easy. Even if a phone was always fully torified (all traffic routed over Tor) the gmail identifier could still be used. While Tor can anonymize the connection, it does not (and should not) attempt to modify anything inside the traffic (the gmail identifier).
Donate
/etc/apt/sources.list file using http:// (unencrypted) instead of the more secure https:// (TLS) by default.
The Linux kernel has a side-channel information leak bug. It is leaked in any outgoing traffic. This can allow side-channel attacks because sensitive information about a system's CPU activity is leaked. It may prove very dangerous for long-running cryptographic operations. Research has demonstrated that it can be used for de-anonymization of location-hidden services.
. Replicant allows root access, but no references were found that Replicant makes use of verified boot yet. It's not relevant to pick any specific Android distribution for the sake of making the point "iPhone and Android Level Security for Linux Desktop Distributions" no specific Android distribution was chosen for this compassion. A "perfect" Android distribution checking all "green yes" is possible in theory. It doesn't exist due to policy decisions. (GrapheneOS vs root in default builds vs device selection / features.) There are no technical reasons for non-existence. See also this Overview of Mobile Projects, that focus on either/and/or security, privacy, anonymity, source-available, Freedom Software..
user has full access to all information which that user has access to, including all files, keystrokes and so on. The exception is when mandatory access control (MAC) is in use and successfully confines that application.
and indicators of compromise are rare.
:
For 4.0+ devices there is a solution called "adb backup".
Note: This only works for apps that do not disallow backup! Apps that disallow backup are simply ignored when creating a backup using this way.
Information from Copy full disk image from Android to computer does not work for non-rooted / non-rootable devices.
Taking a non-rooted Android device with GrapheneOS, contributed by a user.
$ adb devices List of devices attached xxxxxxxxxxx device $ adb root adbd cannot run as root in production builds $ adb shell walleye:/ $ ls ls: ./init.zygote64_32.rc: Permission denied ls: ./init.rc: Permission denied ls: ./init.usb.rc: Permission denied ls: ./ueventd.rc: Permission denied ls: ./init.zygote32.rc: Permission denied ls: ./init: Permission denied ls: ./cache: Permission denied ls: ./init.environ.rc: Permission denied ls: ./persist: Permission denied ls: ./postinstall: Permission denied ls: ./init.usb.configfs.rc: Permission denied ls: ./metadata: Permission denied acct apex bin bugreports charger config d data debug_ramdisk default.prop dev dsp etc firmware lost+found mnt odm oem proc product product_services res sbin sdcard storage sys system vendor 1|walleye:/ $ sudo ls /system/bin/sh: sudo: inaccessible or not found 127|walleye:/ $ su /system/bin/sh: su: inaccessible or not found 127|walleye:/ $
walleye:/dev/block $ ls -lah total 0 drwxr-xr-x 6 root root 2.4K 1970-07-03 11:40 . drwxr-xr-x 18 root root 3.9K 2020-05-26 15:41 .. lrwxrwxrwx 1 root root 37 1970-07-03 11:40 bootdevice -> /dev/block/platform/soc/1da4000.ufshc drwxr-xr-x 2 root root 1.6K 1970-07-03 11:40 by-name brw------- 1 root root 252, 0 1970-07-03 11:40 dm-0 brw------- 1 root root 252, 1 1970-07-03 11:40 dm-1 brw------- 1 root root 7, 0 1970-07-03 11:40 loop0 brw------- 1 root root 7, 8 1970-07-03 11:40 loop1 brw------- 1 root root 7, 80 1970-07-03 11:40 loop10 brw------- 1 root root 7, 88 1970-07-03 11:40 loop11 brw------- 1 root root 7, 96 1970-07-03 11:40 loop12 brw------- 1 root root 7, 104 1970-07-03 11:40 loop13 brw------- 1 root root 7, 112 1970-07-03 11:40 loop14 brw------- 1 root root 7, 120 1970-07-03 11:40 loop15 brw------- 1 root root 7, 16 1970-07-03 11:40 loop2 brw------- 1 root root 7, 24 1970-07-03 11:40 loop3 brw------- 1 root root 7, 32 1970-07-03 11:40 loop4 brw------- 1 root root 7, 40 1970-07-03 11:40 loop5 brw------- 1 root root 7, 48 1970-07-03 11:40 loop6 brw------- 1 root root 7, 56 1970-07-03 11:40 loop7 brw------- 1 root root 7, 64 1970-07-03 11:40 loop8 brw------- 1 root root 7, 72 1970-07-03 11:40 loop9 drwxr-xr-x 2 root root 80 1970-07-03 11:40 mapper drwxr-xr-x 3 root root 60 1970-07-03 11:40 platform brw------- 1 root root 1, 0 1970-07-03 11:40 ram0 brw------- 1 root root 1, 1 1970-07-03 11:40 ram1 brw------- 1 root root 1, 10 1970-07-03 11:40 ram10 brw------- 1 root root 1, 11 1970-07-03 11:40 ram11 brw------- 1 root root 1, 12 1970-07-03 11:40 ram12 brw------- 1 root root 1, 13 1970-07-03 11:40 ram13 brw------- 1 root root 1, 14 1970-07-03 11:40 ram14 brw------- 1 root root 1, 15 1970-07-03 11:40 ram15 brw------- 1 root root 1, 2 1970-07-03 11:40 ram2 brw------- 1 root root 1, 3 1970-07-03 11:40 ram3 brw------- 1 root root 1, 4 1970-07-03 11:40 ram4 brw------- 1 root root 1, 5 1970-07-03 11:40 ram5 brw------- 1 root root 1, 6 1970-07-03 11:40 ram6 brw------- 1 root root 1, 7 1970-07-03 11:40 ram7 brw------- 1 root root 1, 8 1970-07-03 11:40 ram8 brw------- 1 root root 1, 9 1970-07-03 11:40 ram9 brw------- 1 root root 8, 0 1970-07-03 11:40 sda brw------- 1 root root 8, 1 1970-07-03 11:40 sda1 brw------- 1 root root 8, 10 1970-07-03 11:40 sda10 brw------- 1 root root 8, 11 1970-07-03 11:40 sda11 brw------- 1 root root 8, 12 1970-07-03 11:40 sda12 brw------- 1 root root 8, 13 1970-07-03 11:40 sda13 brw------- 1 root root 8, 14 1970-07-03 11:40 sda14 brw------- 1 root root 8, 15 1970-07-03 11:40 sda15 brw------- 1 root root 259, 0 1970-07-03 11:40 sda16 brw------- 1 root root 259, 1 1970-07-03 11:40 sda17 brw------- 1 root root 259, 2 1970-07-03 11:40 sda18 brw------- 1 root root 259, 3 1970-07-03 11:40 sda19 brw------- 1 root root 8, 2 1970-07-03 11:40 sda2 brw------- 1 root root 259, 4 1970-07-03 11:40 sda20 brw------- 1 root root 259, 5 1970-07-03 11:40 sda21 brw------- 1 root root 259, 6 1970-07-03 11:40 sda22 brw------- 1 root root 259, 7 1970-07-03 11:40 sda23 brw------- 1 root root 259, 8 1970-07-03 11:40 sda24 brw------- 1 root root 259, 9 1970-07-03 11:40 sda25 brw------- 1 root root 259, 10 1970-07-03 11:40 sda26 brw------- 1 root root 259, 11 1970-07-03 11:40 sda27 brw------- 1 root root 259, 12 1970-07-03 11:40 sda28 brw------- 1 root root 259, 13 1970-07-03 11:40 sda29 brw------- 1 root root 8, 3 1970-07-03 11:40 sda3 brw------- 1 root root 259, 14 1970-07-03 11:40 sda30 brw------- 1 root root 259, 15 1970-07-03 11:40 sda31 brw------- 1 root root 259, 16 1970-07-03 11:40 sda32 brw------- 1 root root 259, 17 1970-07-03 11:40 sda33 brw------- 1 root root 259, 18 1970-07-03 11:40 sda34 brw------- 1 root root 259, 19 1970-07-03 11:40 sda35 brw------- 1 root root 259, 20 1970-07-03 11:40 sda36 brw------- 1 root root 259, 21 1970-07-03 11:40 sda37 brw------- 1 root root 259, 22 1970-07-03 11:40 sda38 brw------- 1 root root 259, 23 1970-07-03 11:40 sda39 brw------- 1 root root 8, 4 1970-07-03 11:40 sda4 brw------- 1 root root 259, 24 1970-07-03 11:40 sda40 brw------- 1 root root 259, 25 1970-07-03 11:40 sda41 brw------- 1 root root 259, 26 1970-07-03 11:40 sda42 brw------- 1 root root 259, 27 1970-07-03 11:40 sda43 brw------- 1 root root 259, 28 1970-07-03 11:40 sda44 brw------- 1 root root 259, 29 1970-07-03 11:40 sda45 brw------- 1 root root 8, 5 1970-07-03 11:40 sda5 brw------- 1 root root 8, 6 1970-07-03 11:40 sda6 brw------- 1 root root 8, 7 1970-07-03 11:40 sda7 brw------- 1 root root 8, 8 1970-07-03 11:40 sda8 brw------- 1 root root 8, 9 1970-07-03 11:40 sda9 brw------- 1 root root 8, 16 1970-07-03 11:40 sdb brw------- 1 root root 8, 17 1970-07-03 11:40 sdb1 brw------- 1 root root 8, 32 1970-07-03 11:40 sdc brw------- 1 root root 8, 33 1970-07-03 11:40 sdc1 brw------- 1 root root 8, 48 1970-07-03 11:40 sdd brw------- 1 root root 8, 49 2020-05-26 15:41 sdd1 brw------- 1 root root 8, 58 1970-07-03 11:40 sdd10 brw------- 1 root root 8, 59 1970-07-03 11:40 sdd11 brw------- 1 root root 8, 60 1970-07-03 11:40 sdd12 brw------- 1 root root 8, 61 1970-07-03 11:40 sdd13 brw------- 1 root root 8, 62 1970-07-03 11:40 sdd14 brw------- 1 root root 8, 63 2020-05-26 15:42 sdd15 brw------- 1 root root 259, 30 2020-05-26 15:41 sdd16 brw------- 1 root root 259, 31 2020-05-26 15:41 sdd17 brw------- 1 root root 259, 32 1970-07-03 11:40 sdd18 brw------- 1 root root 8, 50 1970-07-03 11:40 sdd2 brw------- 1 root root 8, 51 1970-07-03 11:40 sdd3 brw-rw---- 1 system system 8, 52 2020-05-26 15:48 sdd4 brw------- 1 root root 8, 53 1970-07-03 11:40 sdd5 brw------- 1 root root 8, 54 1970-07-03 11:40 sdd6 brw------- 1 root root 8, 55 1970-07-03 11:40 sdd7 brw------- 1 root root 8, 56 1970-07-03 11:40 sdd8 brw------- 1 root root 8, 57 1970-07-03 11:40 sdd9 brw------- 1 root root 8, 64 1970-07-03 11:40 sde brw------- 1 root root 8, 65 1970-07-03 11:40 sde1 brw------- 1 root root 8, 66 1970-07-03 11:40 sde2 brw------- 1 root root 8, 67 1970-07-03 11:40 sde3 brw------- 1 root root 8, 68 1970-07-03 11:40 sde4 brw------- 1 root root 8, 69 1970-07-03 11:40 sde5 brw------- 1 root root 8, 80 1970-07-03 11:40 sdf brw------- 1 root root 8, 81 1970-07-03 11:40 sdf1 brw------- 1 root root 8, 82 1970-07-03 11:40 sdf2 brw------- 1 root root 8, 83 1970-07-03 11:40 sdf3 brw------- 1 root root 8, 84 1970-07-03 11:40 sdf4 brw------- 1 root root 8, 85 1970-07-03 11:40 sdf5 drwx------ 2 root root 40 1970-07-03 11:40 vold brw------- 1 root root 253, 0 2020-05-26 15:41 zram0
$ adb shell walleye:/ $ mount /dev/root on / type ext4 (ro,seclabel,nodev,relatime) tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,size=1851548k,nr_inodes=462887,mode=755) devpts on /dev/pts type devpts (rw,seclabel,nosuid,noexec,relatime,mode=600) proc on /proc type proc (rw,nosuid,nodev,noexec,relatime,gid=3009,hidepid=2) sysfs on /sys type sysfs (rw,seclabel,nosuid,nodev,noexec,relatime) selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime) tmpfs on /mnt type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=1851548k,nr_inodes=462887,mode=755,gid=1000) tmpfs on /apex type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=1851548k,nr_inodes=462887,mode=755) /dev/block/sdd3 on /persist type ext4 (rw,seclabel,nosuid,nodev,noatime,data=ordered) /dev/block/dm-1 on /vendor type ext4 (ro,seclabel,relatime) none on /dev/cpuctl type cgroup (rw,nosuid,nodev,noexec,relatime,cpu) none on /acct type cgroup (rw,nosuid,nodev,noexec,relatime,cpuacct) none on /dev/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset,noprefix,release_agent=/sbin/cpuset_release_agent) none on /dev/stune type cgroup (rw,nosuid,nodev,noexec,relatime,schedtune) /dev/root on /apex/com.android.tzdata@290000000 type ext4 (ro,seclabel,relatime) /dev/root on /apex/com.android.tzdata type ext4 (ro,seclabel,relatime) /dev/root on /apex/com.android.runtime@1 type ext4 (ro,seclabel,relatime) /dev/root on /apex/com.android.runtime type ext4 (ro,seclabel,relatime) debugfs on /sys/kernel/debug type debugfs (rw,seclabel,relatime) none on /config type configfs (rw,nosuid,nodev,noexec,relatime) tracefs on /sys/kernel/debug/tracing type tracefs (rw,seclabel,relatime) /dev/block/sde4 on /metadata type ext4 (rw,sync,seclabel,nosuid,nodev,noatime,discard,data=ordered) /dev/block/sda28 on /firmware type vfat (ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=437,iocharset=iso8859-1,shortname=lower,errors=remount-ro) tmpfs on /storage type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=1851548k,nr_inodes=462887,mode=755,gid=1000) /dev/block/sda45 on /data type ext4 (rw,seclabel,nosuid,nodev,noatime,noauto_da_alloc,resgid=1065,errors=panic,stripe=4096,data=ordered) /dev/root on /apex/com.android.conscrypt@290000000 type ext4 (ro,seclabel,nodev,relatime) /dev/root on /apex/com.android.conscrypt type ext4 (ro,seclabel,nodev,relatime) /dev/root on /apex/com.android.media@290000000 type ext4 (ro,seclabel,nodev,relatime) /dev/root on /apex/com.android.media type ext4 (ro,seclabel,nodev,relatime) /dev/root on /apex/com.android.media.swcodec@290000000 type ext4 (ro,seclabel,nodev,relatime) /dev/root on /apex/com.android.media.swcodec type ext4 (ro,seclabel,nodev,relatime) /dev/root on /apex/com.android.resolv@290000000 type ext4 (ro,seclabel,nodev,relatime) /dev/root on /apex/com.android.resolv type ext4 (ro,seclabel,nodev,relatime) adb on /dev/usb-ffs/adb type functionfs (rw,relatime) mtp on /dev/usb-ffs/mtp type functionfs (rw,relatime) ptp on /dev/usb-ffs/ptp type functionfs (rw,relatime) /data/media on /mnt/runtime/default/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=1015,multiuser,mask=6,derive_gid,default_normal) /data/media on /storage/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=1015,multiuser,mask=6,derive_gid,default_normal) /data/media on /mnt/runtime/read/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=23,derive_gid,default_normal) /data/media on /mnt/runtime/write/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=7,derive_gid,default_normal) /data/media on /mnt/runtime/full/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=7,derive_gid,default_normal) pstore on /sys/fs/pstore type pstore (rw,seclabel,relatime)
which is even harder to extract.cryptsetup-reencrypt). is such an example. People expected Titanium Backup to be able to backup the Signal app data but lost data. Extra steps are required for a Signal backup. (Insturctions untested by author of this wiki page.)
android:allowBackup
Whether to allow the application to participate in the backup and restore infrastructure. If this attribute is set to false, no backup or restore of the application will ever be performed, even by a full-system backup that would otherwise cause all application data to be saved via adb. The default value of this attribute is true.
Google wants to know where you go so badly that it records your movements even when you explicitly tell it not to.
An Associated Press investigation found that many Google services on Android devices and iPhones store your location data even if you’ve used a privacy setting that says it will prevent Google from doing so.
Computer-science researchers at Princeton confirmed these findings at the AP’s request.
How it works, according to Google, is that the Android Location Services periodically checks on your location using GPS, Cell-ID, and Wi-Fi to locate your device. When it does this, your Android phone will send back publicly broadcast Wi-Fi access points' Service set identifier (SSID) and Media Access Control (MAC) data. Again, this isn't just how Google does it; it's how everyone does it. It's Industry practice for location database vendors.
.
/etc/apt/sources.list file by default.
/etc/apt/sources.list comes with a broken deb cd-rom: line./etc/apt/sources.list comes with http instead of https by default./etc/apt/sources.list has only the debian-security repository enabled by default but not the debian repository. As a result, no packages are installable until the user figures out how to add that line to APT sources./etc/apt/sources.list comes empty except fora broken deb cd-rom: line.
su followed by /usr/bin/adduser user sudo and reboot (or re-login) to be able to user sudo.
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2024 ENCRYPTED SUPPORT LP
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!