A few days ago, I switched my Yettel SIM card into another phone. Right after inserting it, I received one MMS configuration message and one MMS message (I did not download it). MMS config message disappeared shortly after (I'm not entirely sure if I accidentally opened it, but I am certain I never accepted any installation or configuration prompts). Immediately after this, I noticed a brand new directory named MMS had been created on the device storage. Inside, there was a file called cmsotapath.ini. Thinking it was just a plain-text INI config file, I tried opening it with a text editor, but it turned out to be a binary file, specifically, an embedded LiteDB NoSQL database file. I haven't been able to fully unpack or inspect it myself yet. I checked it on VirusTotal and it came up clean (it is likely just APN configuration, but I would like to know the content), but if anyone wants to take a look at it, here is the file: https://limewire.com/d/OYOX7#F0Rre0J0lJ
That being said I will start approaching the subject of this post – on my other phone (the one the SIM used to live in), since the last couple of weeks (starting around September 30th), I’ve started receiving random MMS messages out of the blue. It is a bit odd is that these messages are in English, despite coming from a Serbian operator (Yettel Serbia), and they end with sketchy call-to-actions like "Act now" (see the screenshot).
I checked the APN profiles on that phone out of curiosity (but also as I had weird issues with mobile Internet) – I found two profiles, one for Internet and one for MMS (which is nothing out of ordinary):
-
The MMS profile contained the URL [http://mms.yettel.rs/servlets/mms\](http://mms.yettel.rs/servlets/mms) as a MMSC parameter, which again should not be anything unusual I guess. The weird part is that accessing that specific URL via a browser, it immediately used to trigger Bluetooth to switch on, alongside a background service called something like Connected phone and watch services.
-
Meanwhile, the Internet APN profile had most of its parameters completely empty except username, password, and APN type. Even proxy and port were blank, which caused severe internet lagging and DNS errors for days before I noticed last night and manually reconfigured to correct values. The Internet works now but an exclamation mark appeared on the signal bars and visiting above URL no longer triggered Bluetooth and the above mentioned service.
Interestingly, today, a day after I wrote this post and after I changed these settings, I tried opening that same MMS URL and this time behavior changed: it opened a webpage you could see within the screenshots without forcibly turning on Bluetooth or that companion service anymore.
Additionally, Brave browser started showing "No Internet Connection" error at the top of the app while still loading pages normally, whereas Firefox workes fine.
Has anyone experienced anything similar, or does anyone know why a carrier APN URL/config would trigger Bluetooth and companion watch (I have never even connected this device with smartwatch, and I always keep Bluetooth disabled) services like that and why proxy and port parameters were empty?
Screenshots: https://postimg.cc/gallery/X3dCKqn
Source: r/AndroidHelp · by /u/AntiqueWait9280