I knew this was going to be a hot-button issue when it was published on /r/Android but I wanted to wait a bit. Now, there is more information available so I have decided to write up this tutorial. Today, I will be showing you how to stop Samsung Galaxy smartphones from sending your data to Chinese Qihoo 360 servers.
Samsung has a feature built into OneUI called Device Care. This application is actually a hub for a number of smartphone and tablet health-related information (battery, storage, RAM, and security). Each section of the app handles something differently with the Storage option offering to monitor your internal storage contents.
Not only does it collect details on the files you have stored on your device, but it also offers to delete unnecessary files to help you save on storage space.
Device Care Storage is Powered by Qihoo 360
The thing is, Samsung doesn’t do all of this Storage-related stuff on its own. Instead, you’ll notice a little bit of text on the Storage page of Device care that reads “powered by + 360.” When you look into what “+ 360” is you learn that it is a Chinese internet security company (as described by Wikipedia).
Unless you live in China, it’s unlikely that you know who Qihoo 360 is. I’ve been writing about Android for over 5 years now (on the English side of things) and I have never heard of the company. At least not enough that I can recall and remember any significant details about products they work on.
However, the company is typically known for its antivirus software (360 Safeguard, 360 Mobile Safe), web browser (360 Secure Browser), and some sort of mobile app called 360 Mobile Assistant.
This seems innocent enough but you don’t even have to leave the company’s Wikipedia page to see it has been surrounded in controversy. From lawsuits to hiding a way to download executable files from a remote server (aka a backdoor) in its popular 360 Secure Browser application.
You can take this a step further though and Google something like “Qihoo privacy concerns” and see many reasons why you would not want any data from your smartphone to be sent to Chinese Qihoo 360 servers. The sad thing is, identifiable device data is being sent from Samsung Galaxy smartphones and tablets to these servers.
Device Care Storage is Sending Data to Qihoo 360 Servers
This all started back in the first week of January when a Reddit user started to bring light to the situation. As seen here, we learned that the storage scanner part of Samsung’s Device Care feature within OneUI had code that allowed the app to communicate with these Chinese servers.
That’s all well and good if there isn’t any identifiable data being sent to those servers, right?
That seems logical and that is what most people assumed at first. That this was just regular analytical data being sent and that is all there was to it (nothing identifiable). Samsung Members Korea even replied to a customer to give the company’s official stance on the issue at hand.
When translated, we were told that Samsung’s Device Care application (even the storage section) did not use any features of the Qihoo 360 Security application. They continued and said the application was only using a database from Qihoo 360 to check for junk files that it is safe to delete.
Again, that sounds logical and safe. This made it sound like Samsung devices would connect to the Chinese servers, authenticate, and then download an updated database of files that it believes is safe to delete from Samsung Galaxy smartphones and tablets. Sadly, that is not all that happened.
With more eyes looking at this from multiple angles, we then learned that personal and identifiable data is being sent to Chinese Qihoo 360 servers. The application has been discovered to be sending your smartphones IMEI number as well as a Uniquely Identifiable ID. Not only that, but the Device Care app is also using an old encryption key that can be used by hackers to steal those two bits of information.
Should You Worry About the Data Being Sent to Qihoo 360 Servers?
The Uniquely Identifiable ID isn’t that big of a deal here as this is common among many applications on Android (and smartphones in general). App developers need a way of distinguishing users beyond manually created user accounts (which can be faked by users for cheating purposes).
However, the IMEI number of your smartphone is a vital piece of personal and identifiable information. I won’t spend time convincing you to not share your IMEI number with just anyone. But there are plenty of good reasons why you would not want this piece of data to be stored on a sketchy Chinese server.
It’s not as bad as giving out your social security number, but it’s not something you want readily available to the public.
So the question from here is, do you trust Qihoo 360 have continuous access to that data from your smartphone? Personally, I wasn’t a fan of the whole situation from the beginning. Why would a company as big as Samsung choose to outsource this tiny bit of its OS to a Chinese company?
Some would say to save time but we’re looking at a company that has gone out of its way to duplicate a massive number of apps (Google Assistant, smartphone operating system, web browser, app stores, etc) so that it does not rely on others for software features. It just seems out of place.
But then the lie from Samsung Members Korea customer service is what made me decide to stop this service from running on my smartphones. So let’s get down to it. Let me show you how to stop your Samsung Galaxy smartphone or tablet from sending your personal data to Qihoo 360 servers.
There are a few ways to go about this so I will do my best to cover all of them.
Disable the Device Care Application Entirely
The most straightforward way to stop an application from running is to uninstall it from the device. Sadly, the Device Care application is pre-installed by Samsung and that means you can’t just uninstall it like you normally would. You could gain root access to the device if you wanted, and ripped the APK out of the firmware, but that’s a bit extreme in my opinion.
Instead, we can actually refer to an older tutorial that I have previously written for the Samsung Galaxy Note 10 series. For those who are curious, you can refer back to this guide to get an idea as to what we’re going to be doing here. The idea here is that we’re going to be treating Samsung’s Device Care application as bloatware.
The tutorial I wrote about disabling bloatware is something we can use for all pre-installed applications.
I usually give a word of warning when showing people how to disable these pre-installed applications. The thing is, disabling something like Facebook or Microsoft Word isn’t going to clash with the rest of the Android operating system. However, disabling something like Bixby could end up causing force closes in other parts of the OS.
That’s because Samsung has done a lot to bake Bixby into its core OEM ROM OneUI. While that is still technically safe to disable Bixby on Samsung devices, you should just know that random force closes could happen if another part of the OS is trying to call those Bixby features.
You can actually see this force close in action in the ADB video embedded below. It’s normal, since we disabled Device Care in the video, but is something you should be aware of (so you don’t worry that your smartphone is broken). So let me show you how to disable the Device Care application on Samsung Galaxy smartphones and tablets.
- Make sure the device is plugged into the PC with a USB cable
- Enter the following into the Command Prompt. . .
adb shell- . . .then press Enter on the keyboard
- Now enter the following. . .
pm uninstall --user 0 com.samsung.android.lool- . . .and press Enter on the keyboard to disable the Device Care app
- Wait for the Success message and then unplug the USB cable
Here is a video that gives you a quick summary of the recent events that I covered earlier. Around the 6-minute mark, I begin to actually get into the tutorial and that is where you see me entering the pm uninstall command in my Windows 10 Command Prompt. This can be done on other versions of Windows, as well as in Windows PowerShell, and Linux/macOS Terminal.
We just need ADB and Fastboot tools to be installed for these two commands to work. The ADB Shell command takes us to the shell prompt of the smartphone we have connected to the PC with a USB cable. In the case of the video above, that is the Samsung Galaxy Note 10. This works on all recent Samsung Galaxy smartphones and tablets through, as longa s it has an up-to-date version of OneUI.
The PM Uninstall command is what actually disables the Device Care application.
We’re disabling the application (because we can’t uninstall it without root access) for “user 0” which is us/you (user accounts on Android are numbered, starting with zero). The backward URL looking bit of text at the end is actually the Android application package name that Samsung has designated for the Device Care app itself.
If everything is done properly then you should see a Success message appear after you have pressed Enter on the keyboard.
Does Disabling Device Care Block You From Installing an OTA Update?
No, you will not have any issues installing OTA updates after you have disabled it with the ADB command listed above. Now, if you removed it with root then Android would block you from installing the new OTA update. However, we are just disabling it so it will not prevent you from installing that over the air update.
Although, you may notice that the Device Care application has been re-enabled automatically after an OTA update has been installed. The same is said for those who decide to perform a factory reset. This can force the Device Care application to be reinstalled as you are booting back into Android so you may need to disable it with ADB again.
How to Enable the Samsung Device Care App?
As mentioned, disabling the Device Care application is the first thing I recommend people do. It’s easy to do, doesn’t require root access, doesn’t require you to trust another company to handle your network traffic, you can replicate its features with better, 3rd-party apps, and you can undo it by executing another ADB command.
Just like we can disable the Device Care application with an ADB command, we can re-enable the application just as easily. It does require you to set up your PC just like you did above, by installing ADB and Fastboot tools, but once that is done (and you have USB Debugging Mode enabled) then you can enable the Device Care application to restore all of its features.
- Open a Command Prompt, Terminal, or Windows PowerShell in the same folder as ADB and Fastboot
- Then enter the following. . .
- adb shell
- . . .before pressing Enter on the keyboard
- Once you are brought to the shell prompt, enter the following. . .
- cmd package install-existing com.samsung.android.lool
- . . .and press Enter on the keyboard to reinstall the Device Care app
Block the Device Care App with Firewalls
There are additional ways to block Samsung’s Device Care application from communicating with China. Remember, the app is something that a lot of people have found to be useful over the years. It’s more than just the Storage section (which some people like anyway). It also gives good data on your Battery usage, details about RAM usage, and some security-related features.
So instead of disabling the Device Care application, we can actually just block the device from communicating to those Chinese servers. We can do this in a number of different ways. I will be filling this section in with more detail as I can complete this tutorial (This is basically a placeholder for now).
Will This Work on the Samsung Galaxy Note 10?
I currently own the Exynos Samsung Galaxy Note 10+ with Android 10 and OneUI 2.0 (as of writing this). I can confirm that this will work on the Galaxy Note 10+ that I currently own. Since the devices are so similar, this tutorial will also work on the Samsung Galaxy Note 10, Galaxy Note 10+ (5G), and Galaxy Note 10 Lite.
Will This Work on the Samsung Galaxy S10?
I also own the Exynos Galaxy S10+ with Android 10 and OneUI 2.0 as well. This tutorial also works on this smartphone in its current state and will also work on the Samsung Galaxy S10 and Galaxy S10 Lite as they are in the same series.
I noticed that Samsung has a history of changing package names between updates so it’s entirely possible that the package name listed above won’t work when these devices are updated in the future. Then again, a lot can happen in the dozens of updates these smartphones get over the next few years.
Samsung may even decide to cut ties with Qihoo 360 due to this recent issue. For now, though, this works and I hope you will let me know in the comments below if it ever needs to be updated 🙂
