Samsung non-removable spyware

[DavidCWGA]

Details: https://www.reddit.com/r/Android/comments/ektg8u/chinese_spyware_preinstalled_on_all_samsung/

List of hosts:

aicleaner.shouji.360.cn
care.help.360.cn
eul.s.360.cn
g.s.360.cn
mclean.cloud.360safe.com
mclean.f.360.cn
mclean.lato.cloud.360safe.com
mclean.uk.cloud.360safe.com
mvconf.cloud.360safe.com
mvconf.f.360.cn
mvconf.lato.cloud.360safe.com
mvconf.uk.cloud.360safe.com
p.s.360.cn

[StevenBlack]

David @DavidCWGA thank you. This is good!

[StevenBlack]

Done! Closing!

[XhmikosR]

@StevenBlack are you sure about this addition? Won't this prevent the Device Cleaner from updating its definitions?

[StevenBlack]

Hi @XhmikosR I can't evaluate what you are saying. What do you mean when you say, "Device Cleaner"?

[Laicure]

Hi @StevenBlack, the Device Cleaner is the one installed on Samsung devices that connects through those listed domains.
It's a system app with lots of default permission requests and resides inside the Settings menu of the phones. (according to the reddit link above)

edit:
It's so BS that I don't want Samsung phones anymore..

the so-called Device Cleaner acts as an optimizer and upon disabling it (via adb; no means of stock disabling), significant issues occur as reported.

[XhmikosR]

Don't get me wrong, I'm all for blocking stuff. I'm just trying to figure out if there's a definitive answer as to what those packets contain. Because blocking these domains will make the Device Cleaner not be able to update, right?

[StevenBlack]

Thank you Laicurè @Laicure.

I suppose we'll need a Samsung device owner to check.

I'd also like to know, why would anyone need Device Cleaner? In the MacOS space, and the Windows Space too (usually), that sort of thing is scam.

[XhmikosR]

I'd also like to know, why would anyone need Device Cleaner? In the MacOS space, and the Windows Space too (usually), that sort of thing is scam.

Well, that's not for us to decide :)

All I wanted to say is that unless someone analyzes the packets sent, we can't just assume it's bad. Although I'd rather err on the safe side, I don't think we should break this feature unless it's confirmed.

[StevenBlack]

@XhmikosR I understand what you're saying. I'm prone to agree, except I'm more prone to distrust .cn domains that appear unrelated to the corporations we're discussing. Like Samsung, for example.