What is "vibiu-dau.com" have i been hacked?

SpeakYourMind

Hi thanks for looking into this.
As if someone read this yesterday. Today it happened again i wanted to go to youtube, typed in vanadium "yout" and boom it vanadium showed a warning:

This page isnt working
pro-jex.de is currently unable to handle this request.
HTTP ERROR 500

But the page has changed to pro-jex.
The thing is i am not worried that a "cookieless advertisement solution" server is miconfigured i wonder how the hell i get this link in vanadium.

Since i switched of WLAN yesterday it definitely happened through the mobile connection.
Is YT blocking me from accessing the site?

1 week ago i got a warning like:

www.youtube.com is blocked
www.youtube.com refused to connect.
ERR_BLOCKED_BY_RESPONSE

But i have no idea why it would block me. And if you read only what Google writes about this nothing is really helping in my case. The german government has not blocked Youtube - or maybe it has in my case.

So any idea what is going on? Let`s say somebody did get physical access to the phone. (the owner profile was always locked with a pin but i admit not to long sometime only 4 digits) and messed with it or one of the apps is a virus.

After a factory reset i still could not be sure if i was OK right?

PS can you send me some links on the "weird stuff" please? Would like to know more about this....

SpeakYourMind

I saw in the vanadium privacy and security settings:

"Improve search suggestions"
"Wehn you type in the address bar or search box , Vanadium sends what you type to your default search engine to get better suggestions...."

By default it is on, so it was on on.
Does maybe something go wrong with this feature so that it suggests and executes this weird websites?

Matth

SpeakYourMind

It says you type in "yout" and Vanadium then suggests the "wrong" site.

What search engine have you defined in Vanadium? I would believe it comes from your search engine, as it tries to autocomplete. But not quite sure.

Have you tried to install another browser, like Firefox and see if it happens there as well? That way it could be your phone, or just an issue in your app.

matchboxbananasynergy

SpeakYourMind Google Play services !!
Google Play store!! I have not installed those in this profile.

In your owner profile you will also see apps installed in other profiles.

matchboxbananasynergy

other8026 SpeakYourMind Android Open Source Music Player

I don't know why this is there, but it's on my phone too as a system app. Probably has to be there for some reason.

It provides the bare minimum intents for playing music in AOSP. If you tap on a music file in the file manager, you will get a small pop-up with a bare bones music player if you don't have another music player app. That's what that is.

other8026 I've read GrapheneOS devs say that the calendar app launcher was removed but the app itself has to remain to handle certain system intents.

Correct.

matchboxbananasynergy

@SpeakYourMind Have you manually configured any custom DNS either in Vanadium itself, or via the system's Private DNS setting found in Settings > Network & Internet?

If so, remove that and use the default and see if this behavior persists.

Have you installed any VPN app or any "firewall" app or any app in general that might using the VPN spot in your profile? If so, disable that app and give it a shot again.

3rd and final question/test. Create a brand new user profile / guest profile. Do you get the same behavior there?

SpeakYourMind

matchboxbananasynergy

Have you manually configured any custom DNS either in Vanadium itself,

No i haven't changed anything. The setting for "Use secure DNS" is "automatic". And "Use your current service provider".
So you think my carrier has a malfunction? is there a secure alternative for testing? Would OpenDNS be good?

Under Network and internet it says:
VPN: None
Private DNS: automatic
Internet connectivity checks: GrapheneOS Server

matchboxbananasynergy

In Vanadium's Secure DNS setting, you can tap on "choose another provide", then tap on 'custom' and choose one of the pre-existing options there to test. See if the issue persists after changing Vanadium's DNS to something else.

SpeakYourMind

So nobody really knows where this sites i got them from? Difficult situation for me to understand whether the phone has been hacked or not...

@machboxbananasynergy: yes i have seen it that is why i was asking which of those is really trustworthy. If i ditch my german Telekom DNS the new one should be more trustworthy..

matchboxbananasynergy

Any of those is fine for a test, you don't have to keep it long term.

SpeakYourMind

@matchboxbananasynergy
Ok. Thanks so far
@other8026 @de0u or anyone else any idea of what has happened here? I could really need some help understand the situation...

forumuser

SpeakYourMind it is possible this is occurring at the connection level. If you create a new profile with the same stuff does this keep occurring?

Some Internet providers give you fake data so they can sell more info for money. You don't get a correct https certificate when doing that, but otherwise it looks the same. Do you get these errors when using a VPN?

It's possible someone compromised Graphene, but doing that would be so hard that they would likely not be so sloppy after. This seems like redirection and ISP manipulation or some App trying to quickly open a browser and get some data and close and it isn't expecting https enforcement.

I would create a new profile with everything the same and delete the old profile.

It's also possible that Nokia App is trying to quietly contact some tracking server. A lot of links like that don't use https because why would they use encryption if they are actively trying to track and exploit you?

Muta

Neither website is blacklisted.

Vibiu is using AWS and is located in the UK. I can post a phone number if you like.

Pro-jex is tougher. Not much info other than its encrypted

SpeakYourMind

Muta

Hi Muta, thank you. I was on a trip. Yes i would like to have this phone number. That would be interesting...

i did clear the vanadium cache and yesterday it showed up again.

Muta

I would clear the vanadium cache after closing all windows and try again.

yore

SpeakYourMind Wireless Emergency Alerts comes with Android. You can disable alerts through Settings.

Secondly, GrapheneOS tries to make the whole operating system more secure. They do not make apps (except for a few hardened apps) because that is not their purpose.

[deleted]

forumuser A lot of links like that don't use https because why would they use encryption if they are actively trying to track and exploit you?

HTTPS on its own does not make an site safe. HTTPS only means that the Connection to the site is secure.

forumuser some App trying to quickly open a browser and get some data

An app doesn't have to open a browser for that.

forumuser Some Internet providers give you fake data so they can sell more info for money. You don't get a correct https certificate when doing that, but otherwise it looks the same.

Could you elaborate? I don't think ISPs can MitM like that without being a certificate authority themselves.

SpeakYourMind

forumuser

If you create a new profile with the same stuff does this keep occurring?

I can't it is the Owner profile. It wouldn't be the same if i did it in another profile i suppose.

I will try with an VPN.

This seems like redirection and ISP manipulation or some App trying to quickly open a browser and get some data and close and it isn't expecting https enforcement.

Actually this is what i was wondering about, wether some redirection of ISP has happened through hacking OR that the government is spying on me. German government has a stake in german telecom. And i have been on demonstrations, speaking about the violations of the german ground law through the surveillance state the police took in several instances my identification. I promoted petitions, for the german parliament, where suddenly the petition site of the german parliament came under strange attacks. Without my promotion the petition probably wouldn't have succeded. And my number will be in lot of peoples telephonbook that i think are surveilled by the security apparatus.

To make a long story short if the government used a "predato" tool or ordered my ISP to reroute the traffic is that what it would look when it has an error? Or is it some App redirecting traffic? Of course the wouldn't want to show this like that but maybe something is not working properly?

the real problem is that this only happens every couple of days so it is hard to test by deinstalling apps to see if one of them was it.. Nevertheless i will trow some of...

forumuser

[deleted] ISPs have done this. They clone certain https certificates so the traffic passes through them to the ISP as clear and then pass the traffic to the real site https cert encrypted to monitor user input for monetization or surevilance. It is not often but has been found in the wild with sufficient testing to show it occurred but probably is harder to do now as https has gained more traction.

Muta

SpeakYourMind

It is registered in Middlesex GB
Registrant: identity protection services
Number: +44.1483307527

cyclk

Hello,

I found this thread via Google search. I have a Pixel 7a still without GrapheneOS. Everything default no simcard.
Today I wanted to transfer some photos to a Windows 11 PC.

Have the Pixel connected via USB with data transfer enable. The DCIM folder appears
and in the background Firefox opens the web page without asking and then emits a quiet beep.

http://vibiu-dau.com/zclkvisitor/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX?campaignid=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

I have changed the exact code that possibly identifies me with the exact number of X.

I have noscript on so probably only half as bad but already questionable the whole thing.
Maybe that brings a little more light into the dark hope that someone else can say something about it.

zkz

cyclk is there a chance the OS on your machine itself is compromised, and not the pixel?

Either way I'd suggest backing up important data (and not the applications themselves) doing a reset on both your machine and your pixel.

« Previous Page Next Page »