Pre-Installed Virus? Secret Process Turning On System Setting for Location

[Dasher]

Generally every 5-12 days Location System Setting is turned on by some hidden process.
This is on my Android phone despite my considerable efforts to prevent Location from ever being enabled.

I have intentionally Set Location to OFF -- ALWAYS - since first use; for more than a year.

This is critical & dangerous because if an Android System Setting can be manipulated by a secret process - ANYTHING

on the phone can be manipulated by this process.

System is scanned clean by major Antivirus apps (confidential except for trusted researchers),

Hidden Device Admin Detector and Warden (No hidden apps).

System --
Motorola "G pure" XT2163DL
Phone originally had TracFone SIM - now using UltraMobile SIM

Android 11, Not rooted

I have disabled all stock apps that this Non-Rooted system allows.
Some are prevented from Uninstall like
DesktopSystemUI
Device Help
Device Management
Motorola Notifications
Motorola Software Updates
Settings
Software Update

I've replaced all stock apps with - no tracking alternatives, several from Simple Mobile Tools.

// Evidence
Dates when I caught the secret process turning on Location System Setting -

March 7,9,14,28
April 1,9,13,15,28, 30

Time: Most often I noticed it turned on in the morning.
Only 3 times did I notice it on after noon.
Most of the time it occurs when I have had zero interaction with the phone at all - other than to turn screen on, or plug it in to charge.

Astoundingly ironically - LOCATION was Turned on WHILE I was  writing this article up !!!
I had just received 2 phone calls, so paused writing this.
Location was definitely OFF before the two calls.
One call lasted 18 minutes.
the 2nd call was 6 minutes.
As soon as I looked - seconds after hanging up the second call - Location was on.

// Settings Page - Current

"No Apps have requested location recently"

OFF Settings include --

Wifi & Bluetooth scanning
Carrier location access
Earthquake alerts
Emergency Location Service
Google (everything)
I have no (intentional) Google account of any sort.

Suspicions:
1. Google is a known serial privacy location violator, Motorola is too. The WANT your Location.

2. Google and Motorola have system blocks preventing users from turning off many apps and processes that demand Location

3. Why would any non-google, non-scam hacker care about my location - other than

Google and Motorola software does surveillance on you - even if you have  turned it off. And they make it damn hard to run off.

The chief suspect is Google, with Motorola and their ThinkShield a close second.
But I need actual repeatable evidence to claim whose process is doing this.

"Google Location Service" Can NOT be stopped ! - even though every other service can be stopped !
It reStarts Itself ! -- within seconds !!!

Motorola G Pure: Settings "REQUIRES camera to operate"
M G Pure: ThinkShield provides Phishing "protection" - which necessarily reads full text of every email & text !

Possibly the most alarming is GBoard - the Google keyboard - which records EVERY KEYSTROKE - exactly like SpyWare Key-loggers ! Gaargle jumps up and down claiming GBoard doesn't send data back home. What they fail to claim is whether GBoard sends its surveillance data to other apps like your default Browser - to be sent back "home" !

*** Do you know of a app to Log all accesses to the system settings and report which processes so I can diagnose this. (like Sysinternals or Anvir on Windows)
 

[BeechComer]

Hi, Dasher,

I'm using a '22 Moto G Pure, namesake of a model I got when it first came out. Unlike that phone, this one is exceptionally cheap, which it shows in bouts of flakey performance along with a creeping performance and battery degradation. However, it does allow me to keep location off.

Had it a year, now. Setup took me a couple of hours to disable everything I wanted to, plus occasional spasms since. Turned off updates when my wife got an unsolicited downgrade (not a typo) from Android 11 to 12. There's at least one more security upgrade for 11 (for a couple o' honkin' big vulnerabilities, apparently) but haven't managed to figure out how to get it without turning updates on and taking a one-way trip to h*ll -- er, I mean 12. Moto may not be offering the 11 version, seeing it looked a lot like work. After seeing it on my wife's phone, it's something I'll never voluntarily do, but vulnerabilities, eh.

I'll try (Yoda: "Try not!...") to go through my setups and document, if you think you'd find it useful. If you have the '23 phone (is it out, yet?) it will be 12 and my hacks probably wouldn't apply. E.g., the process you'd turn off in 11 isn't available for mod in 12.

On another subject, your technical knowledge, patience, and persistence impresses me. Wonder if you've heard of NoScript? It allows you to pick and choose scripts to run in Firefox, Edge, and Chrome. If you've never thought about what scripts run to present a web page, the below pic will be an eye-opener! I had to enable two new processes to be able to reply, as compared with my last participation on this forum some months ago. As a security company, MalwareBytes ought to have fewer (not more) scripts running on their pages!

Best,

--The BeechComer

[Dasher]

Thank you for your tip about NoScript. I'll keep it in mind.
 

Good news? Found a new (to me) set of System Settings - that may solve this.

(Android 11) Under Apps, choose "Special App Access"

Then "Modify System Settings" !

Here I found several Gaargle services that were allowed to change System Settings !!!
Specifically Gaargle, Gaargle Play services, and Gaargle Play Store.

Just switched them all off - and now wait to see if this works.

Should know within a week. Will report on it here.
Or possibly sooner as both of the last 2 days "Sensor Blocker" was turned off !!!