PR1.2 automatically sends SMS, registers phone with My Nokia. Privacy breach? - Page 17 - maemo.org

pelago | # 161 | 2010-06-04, 15:09 | Report

After some hours of researching how to do so, I finally managed to download the cherry deb file. On my PR1.1.1 N900 I used (as root)

Code:

apt-get install wget

then (not as root),

Code:

wget --no-check-certificate https://qa9recEP:Pat2UGuP@downloads.maemo.nokia.com/fremantle/ssu/mr0/cherry_0.20-2+0m5_armel.deb

to get the archive. Strangely, that same wget command doesn't seem to work on my Ubuntu box, only from the N900.

Anyway, of course the main cherry binary is closed source, but I now see the /etc/X11/Xsession.d/34cherry script that arne mentioned, which for the record contains:

Code:

#!/bin/sh

# Cherry checks for .cherry_state anyway, but testing here makes it faster
if [ ! -f /home/user/.cherry_state ] ; then
  . /etc/X11/Xsession.d/04b_start_matchbox
  /usr/bin/cherry 1>&2
  . /etc/X11/Xsession.d/06stop_matchbox
fi

It would certainly seem that doing

Code:

touch /home/user/.cherry_state

as arne said, should stop the binary from doing anything.

Note that there is also a script called /etc/osso-cud-scripts/cherry-clean.sh which deletes the /home/user/.cherry_state file:

Code:

#!/bin/sh
/bin/rm -f $HOME/.cherry_state

Maybe this is called when the user does "Restore Original Settings" from the menu in the Settings app? If that is true, if you ever do that, you might want to

Code:

touch /home/user/.cherry_state

again to stop the SMS from being sent next boot.

I found the changelog mildly interesting, as you get to read a little about how the app developed over time. It contains:

Code:

cherry (0.20-2+0m5) unstable; urgency=low

  * This entry has been added by BIFH queue processor
    version has been changed to 0.20-2+0m5

 -- Urho Konttori <urho.konttori@nokia.com>  Tue, 16 Mar 2010 16:46:41 +0200

cherry (0.20-2) unstable; urgency=low

  * 0.20-2 uses PROD configuration

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Mon, 15 Mar 2010 12:11:51 +0000

cherry (0.20-1) unstable; urgency=low

  * Read environment variables CHERRY_FORCE_MCC_FOR_TERMS and
    CHERRY_MCC_FOR_TERMS for debugging
  * Fixes: NB#159338 Disable keys ctrl-n/ctrl-u
  * 0.20-1 uses QA configuration

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Mon, 15 Mar 2010 11:50:30 +0000

cherry (0.19-2) unstable; urgency=low

  * 0.19-2 uses PROD configuration

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Thu, 04 Mar 2010 14:23:10 +0000

cherry (0.19-1) unstable; urgency=low

  * Fixes: NB#159208 Fix terms cleaning script for h1 titles
  * Fixes: NB#159084 Fix terms language with Norwegian SIM cards
  * 0.19-1 uses QA configuration

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Thu, 04 Mar 2010 14:10:55 +0000

cherry (0.18-2) unstable; urgency=low

  * 0.18-2 uses PROD configuration

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Wed, 03 Mar 2010 14:29:48 +0000

cherry (0.18-1) unstable; urgency=low

  * Fixes: NB#158773 Cherry uses the correct ovi icon
  * 0.18-1 uses QA configuration

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Wed, 03 Mar 2010 14:24:40 +0000

cherry (0.17-2) unstable; urgency=low

  * 0.17-2 uses PROD configuration

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Fri, 26 Feb 2010 15:20:47 +0000

cherry (0.17-1) unstable; urgency=low

  * New PROD configuration from Jukka 2010-02-26
  * Terms: add terms for country code 235 (UK)
  * New QA configuration from Jukka 2010-02-26
  * Terms: add terms for country code 310 311 316 (USA)
  * KeyLeadService: set to Store (9)
  * 0.17-1 uses QA configuration

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Fri, 26 Feb 2010 15:02:09 +0000

cherry (0.16-3) unstable; urgency=low

  * Fixes: NB#154397 - Cherry integration
  * Remove English support for Finland in the PROD image

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Wed, 24 Feb 2010 15:48:36 +0000

cherry (0.16-2) unstable; urgency=low

  * Same as 0.16-1 but with PROD numbers

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Tue, 23 Feb 2010 14:10:02 +0000

cherry (0.16-1) unstable; urgency=low

  * Fix bug on sending SMS to international or short numbers, again

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Tue, 23 Feb 2010 14:06:10 +0000

cherry (0.15-2) unstable; urgency=low

  * Switch to QA configuration for testing

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Tue, 23 Feb 2010 13:45:17 +0000

cherry (0.15-1) unstable; urgency=low

  * Fixes: NB#156627 - powerup_to_get_most text is displayed partially

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Fri, 19 Feb 2010 17:21:41 +0000

cherry (0.14-2) unstable; urgency=low

  * Fixes: NB#156620 - Legal disclaimer looks bad
  * Fixes: NB#156703 - My Nokia icon missing in the control panel
  * Fixes: NB#156709 - use real phone number instead of QA number
  * Fixes: NB#156886 - Unable to unsubscribe if the language is not supported
  * Fixes: NB#157395 - An extra button starts with Norsk(Norge)
  * Fixes: NB#157494 - Terms and Conditions dialog is empty with Indian SIM

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Fri, 19 Feb 2010 12:51:41 +0000

cherry (0.14-1) unstable; urgency=low

  * Fix bug on sending SMS to short numbers

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Thu, 18 Feb 2010 16:08:48 +0000

cherry (0.13-1) unstable; urgency=low

  * Fix control panel UI in Norsk(Norge) NB#157395
  * Production configuration: 2010-02-18 + revert on terms&conditions lang.

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Thu, 18 Feb 2010 13:50:31 +0000

cherry (0.12-1) unstable; urgency=low

  * New QA configuration from Jukka 2010-02-18 with English in Finland

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Thu, 18 Feb 2010 10:34:53 +0000

cherry (0.11-1) unstable; urgency=low

  * Terms and conditions faster to load in the control panel
  * Add empty line between paragraphes in Cherry
  * Use the real phone number from the configuration
  * Terms: use the fallback when the country is unknown
  * New QA configuration from Jukka 2010-02-18

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Wed, 17 Feb 2010 15:42:15 +0000

cherry (0.10-1) unstable; urgency=low

  * Enable debug to test US UI and non-US UI
  * Ability to unsubscribe from the control panel NB#156886
  * Language of terms based on locale
  * Fix tidying script of terms NB#156620

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Mon, 15 Feb 2010 15:32:38 +0000

cherry (0.9-1) unstable; urgency=low

  * New config, based on Jukka Ahokas' email
  * Update eTerms.tar.gz with Uhro's script and Tidy NB#156620
  * Remove last piece of sms-manager
  * Send the SMS to the phone number according to the SIM's MCC-MNC
  * Add terms in the control panel applet

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Thu, 11 Feb 2010 16:01:32 +0000

cherry (0.8-1) unstable; urgency=low

  * Optimizations on D-Bus calls
  * Use matchbox at startup, UI beautification
  * Terms and conditions are compressed

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Wed, 10 Feb 2010 17:46:24 +0000

cherry (0.7-1) unstable; urgency=low

  * Packaging: fix integration errors detected by lintian
  * Get the phone number associated to the current country and network

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Tue, 09 Feb 2010 11:43:18 +0000

cherry (0.6-1) unstable; urgency=low

  * Update UI according to UI spec
  * Display the checkbox for USA
  * Display cherry again after usage of Clear User Data feature

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Mon, 08 Feb 2010 18:41:56 +0000

cherry (0.5-1) unstable; urgency=low

  * Add applet into control panel

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Thu, 04 Feb 2010 16:27:34 +0000

cherry (0.4-1) unstable; urgency=low

  * Disable optification for now
  * Remove translations, it should be integrated by osso-powerup-shutdown

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Wed, 03 Feb 2010 14:57:21 +0000

cherry (0.3-1) unstable; urgency=low

  * Language check, cleanup
  * Fix dependencies

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Wed, 03 Feb 2010 11:52:29 +0000

cherry (0.2-1) unstable; urgency=low

  * Send subscribe and unsubscribe SMS to the QA Cherry server

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Tue, 02 Feb 2010 14:50:36 +0000

cherry (0.1-1) unstable; urgency=low

  * Initial release

 -- Alban Crequy <alban.crequy@collabora.co.uk>  Thu, 14 Jan 2010 15:32:27 +0000

Last edited by pelago; 2010-06-04 at 15:43.

The Following 11 Users Say Thank You to pelago For This Useful Post:
attila77, benny1967, BLC, Crashdamage, daperl, Helmuth, j.s, qwerty12, sjgadsby, x-lette, zimon

twigleaf1976 | # 162 | 2010-06-04, 15:31 | Report

I hadn't even considered when I installed 1.2 that an SMS would be sent.

Seriously unhappy, even more than I was already. That is the simple reason I didn't go for android was the trickling of information BACK to some corporation. Now Nokia are doing it anyway.

Originally Posted by cazzajay View Post

and risk bad publicity.

ROTFL

What like this forum and their handling of everything from the OVI store, Maemo and N900 isn't enough bad publicity. Nearly all Maemo things in google hit back to this forum, nearly all this forum is abuse at Nokia. I would like to see really bad publicity and what makes Nokia actually take action to rectify.

pelago | # 163 | 2010-06-04, 15:46 | Report

It would be interesting to see exactly what the SMS texts contain, but I'm not quite sure how to achieve that. Maybe we could hack the numbers stored in the cherry binary to a phone number of another phone.

The Following User Says Thank You to pelago For This Useful Post:
thecursedfly

R-R | # 164 | 2010-06-04, 15:59 | Report

haha I'm happy to have asked Fido to block my SMS out ability long before this ...

aspidites | # 165 | 2010-06-04, 16:17 | Report

The related bug report seems to indicate that the "subscribe" button being greyed out doesn't indicate that you are already subscribed. This could very well be the reason the unsubscribe button doesn't work.

For Tmobile USA customers, you can have mynokia blacklisted by calling into customer care as well. Actually, if you don't use any of the web2go services, you can sign up for content blocking at my.tmobile.com >> plans and services or by calling cutsomer care as well.

x-lette | # 166 | 2010-06-04, 16:32 | Report

Originally Posted by pelago View Post

After some hours of researching how to do so, I finally managed to download the cherry deb file. [...]
Strangely, that same wget command doesn't seem to work on my Ubuntu box, only from the N900.

Great job! Many thanks for investigating that.
Did you use a normal Linux or did you try to download from within the maemo ide? Might be the server checks somehow from which system you are connecting.

I'm just downloading the file too from my n900 with the UA string set to 'wget'.

Works

an empty string works too. They might check something different.

xmob | # 167 | 2010-06-04, 17:24 | Report

Originally Posted by pelago View Post

It would be interesting to see exactly what the SMS texts contain, but I'm not quite sure how to achieve that. Maybe we could hack the numbers stored in the cherry binary to a phone number of another phone.

Great idea! I modified the cherry bin, and the message still went to Nokia. I've since found a list of numbers in libcpcherry.so. I've modified that and had success at sending messages to my other phone!!!

They seem to be base64 encoded. I will report back soon with my findings.

The Following 8 Users Say Thank You to xmob For This Useful Post:
BLC, Crashdamage, gadgetChris, Helmuth, ndi, pelago, sjgadsby, x-lette

breakd0wn | # 168 | 2010-06-04, 17:51 | Report

I did a firmware and emmc flash.

Was never asked to subscribe. Looking at the option in settings, looks like I am subscribed.

It doesn't bother me at all. They probably just want to know how many people are actually using pr 1.2, upgraded, etc.

I still have yet to get any tips though.

trotor | # 169 | 2010-06-04, 18:41 | Report

I just went through the license and terms (in finnish) and it reads roughly translated that "This announcement is not valid and welcome screen WILL NOT open on first run and NO sms is sent if the service is not available at your country, in your version of software or in chosen language."

So most likely you who didn't get the welcome announcement or don't have subscribe active won't be able to unsubscribe either - you haven't been subscribed at all in the first place? I can re subscribe even though I already did.

pelago | # 170 | 2010-06-04, 20:58 | Report

Originally Posted by x-lette View Post

Great job! Many thanks for investigating that.
Did you use a normal Linux or did you try to download from within the maemo ide? Might be the server checks somehow from which system you are connecting.

I'm just downloading the file too from my n900 with the UA string set to 'wget'.

Works

an empty string works too. They might check something different.

I've tried wget from a couple of different normal Linux desktops (not SDK), and I get a 403 forbidden. I don't know why wget from the N900 works. Strange, isn't it?

I don't really know enough about deb packaging, but would it theoretically be possible to create a .deb that overwrote or deleted /etc/X11/Xsession.d/34cherry, /usr/bin/cherry, libcpcherry.so (the hildon-control-panel plugin) etc? I guess maemo.org Extras won't host it, but it could be hosted elsewhere.

My aim is to find the most user-friendly way for people to avoid this.

Last edited by pelago; 2010-06-04 at 21:04.