Suspicious connection from service "MTP-host"

graphmobile

I received my Pixel 7 not long ago and installed GrapheneOS right away.

I've been very pleased with it so far.

Have ran some connection tests on it to see how much the OS itself and installed apps talk to the outside world.

The test has lasted for 2-3 days (idle on the table) and nothing speciel has popped up until today.

The phone was charging from a wall socket and suddenly the phone connects to rr6---sn-uqj-j2ik.gvt1.com on TCP/443 with a payload of 15 megabytes via the service "MTP-host":

https://i.imgur.com/nzVZJ4W.png

Some research shows this URL is owned by google.

The big question is why. Has anybody else seen this? Does anybody know why?

[deleted]

graphmobile this is interesting because if you look at its permissions, there is no network toggle and upon looking at all permissions it doesn't mention any network access.

matchboxbananasynergy

graphmobile Did any non-default apps or anything else exist on the phone at the time? This is likely the result of some app doing something.

muhomorr

graphmobile
The PCAPdroid app incorrectly shows the source of network traffic. It knows only the UID, and more than one app can have the same UID. In that case, PCAPdroid picks one of the apps in the UID and shows it as a source, instead of listing all of the apps in that UID and indicating that any one of them made the connection.

Link to the source code: https://github.com/emanuele-f/PCAPdroid/blob/f482d0fa8fe300aa8105a77e8bfe8d26ee71ce71/app/src/main/java/com/emanuelef/remote_capture/AppsResolver.java#L121

MTP Host, DownloadProvider, DownloadManager UI and SoundPicker have the same UID.

Apps that have the Network permission can ask the DownloadProvider to download a file, this is almost certainly what happened.

vcmj

Could possibly be misattributed? The app info page for MTP-host in the data usage section mentions that the usage is merged with the Download Manager, at least on my device. Couldn't find any network accessing code in packages/services/Mtp/* in the source tree which is where the code for that service lives, so if its legit access that might be concerning. Doesn't even have network permission. I think its just from the Download Manager though.
AFAIK the gvt URLs are used for various Chrome and other Google binary hosting.

treequell

I thought I'd share here the MTP documentation, just in case it helps to answer your query:
https://developer.android.com/reference/android/mtp/package-summary

graphmobile

muhomorr

Very useful info. Thank you!

matchboxbananasynergy

Yes there is. I have the following installed:

F-droid:

Etar
Fennec
K-9 Mail
Newpipe
Open Camera
Organic Maps
PCAPdroid
DAVx5

Google play:

Soundhound (Disabled)
Session (Disabled)
PostNord (Disabled)
Easypark (Disabled)
Yr
Parqo
Mobilepay
Kemiluppen