Tuesday, June 28, 2016

Is XperiFirm trustworthy?

Hello.

This is my first post, and might be my only one as well. Since I am
not allowed to post into developers' forums, I post this here. I'm
sorry for any inconvenience caused, if any.

After setting things up (download and install Mono, download and
uncompress XperiFirm then reboot) to use XperiFirm on my Mac, I wanted
to check if I could download Xperia firmwares directly from Sony's
servers.

Assuming XperiFirm downloads files directly from Sony, I asked a
friend a command that could give me what I'd need. He gave me two, one
of which (
Code:

$ lsof -i
) returned some interesting results.
At the
Code:

mono-sgen
command line, the connection is
established with an IP address that Whois says belonging to a single
person located in Santa Monica, California. I tried that while
downloading Xperia Z3+'s Android 5.0.2*, 32.2.A.0.224 / R3C and Xperia
Z3's 23.5.A.0.575 / R9D. I won't give more info on what I found, if
you want to know more you'll have to check this out by yourself.
I don't understand. I am still far from being a network computing and
IT security professional, but I'm not sure Sony would register as one
single person. I don't imply that something stinks, I only say I find
this rather strange.**

If the files were retrieved directly from Sony by someone and stored
on their server to be downloaded, why not keep the files even when
Sony deletes them? Is XperiFirm using some sort of intermediate
service hosted by someone?
Could someone explain me this? I found the official thread to be
elusive about how XperiFirm works.

Thank you. Have a nice day.

* I can't recall this Android version's associated Sony Xperia Z3+
firmware's name since it since disappeared, but I first noticed this
at the time it was still available — some months ago.
** Still, Maps' Street view shows what appears to be a black building
that looks more like a workplace than a home to me.


from xda-developers http://ift.tt/291n107
via IFTTT

No comments:

Post a Comment