What Is An Apache Hive?

Heat84

About a week ago, I started having a mysterious alarm while my phone was in sleep mode that used the sound named Castor and had a blank and iconless sleep mode notification. One time the blank notification had a gear button for accessing it’s notification settings. I changed a couple things when I was in there. When I searched the internet about it, someone who had the same problem suggested installing an app called Recent Notification(There are a few apps with that name, so I was gonna install each of them until I could see the mysterious app’s icon) to show you the app’s icon. After I installed the first Recent Notification app, a new symptom occurred. When my phone was in sleep mode, the screen kept turning on and off. Since I wasn’t sure if that symptom was caused by me changing the mysterious app’s notification settings or installing the first Recent Notification app, I decided to uninstall the Recent Notification app first. When I went in to the Apps section of Android’s settings to do that, I saw a nameless app and the area that shows the app’s icon was all white.

On the bottom of the app’s App Info page this was in the version area:
version 2.1.1
org.hiw.vlt.qfaodnha.rlkon

When I searched for that on DuckDuckGo I got this. Apparently it has something to do with an Apache hive. What’s an Apache hive? I know that Apache is webserver software, but I have no idea what a hive has to do with that. On the mysterious app’s App Info page in the Store/App Details section, it said it was installed from Iceraven, which is my browser. Does that mean Iceraven installed it, or that I downloaded it in Iceraven and installed it?

I uninstalled it and that seems to have resolved the issue. But I wish I would’ve just force stopped it instead of uninstalled it, for scientific purposes. I did take a screenshot of the blank iconless notification before I uninstalled it. I think I’ve been descriptive enough that it’s not necessary to post it, but I might-as-well since I have it.

Donoreo

Heat84 What’s an Apache hive?

Apache Hive is a data warehouse system built on top of Apache Hadoop that allows users to query and analyze large datasets using SQL-like queries (HiveQL) without needing to write Java or MapReduce code.

https://hive.apache.org/

broknsymetry

Donoreo Apache Hive is a data warehouse system built on top of Apache Hadoop that allows users to query and analyze large datasets using SQL-like queries (HiveQL) without needing to write Java or MapReduce code.

“What the hell does that mean?” - General Decker

https://clip.cafe/videos/all-green-of-skin-s1.mp4

telcodad

broknsymetry Apache Hive is a data warehouse system built on top of Apache Hadoop …

broknsymetry What the hell does that mean?” - General Decker

Hadoop is an open-source software framework for storing and processing large datasets across clusters of computers, designed to efficiently handle big data applications. It’s named after a stuffed toy elephant belonging to one of the co-founders, Doug Cutting. 🙂

Somewhat-Reticent

Heat84 When I searched for that on DuckDuckGo I got

Did you try this ?

egeezer

It’s a small tool for querying the header file corresponding to a function in C language.

The three columns of the query result are the header file name, the line where the function is located, and the code around the function in the file.

It has been expanded to query any string in the C language header file, which can help solve the problem of not knowing how to include in coding.
😉

The source appears to be China. As to why it’s there, I have no clue. Bazed on your post, it appeared spontaneously and tried to obfuscate itself. The notification indicated it was trying to perform an unknown or hidden function.

If I used the device, I would do a factory reset and change all passwords used on the device unless I knew exactly what purpose the utility served on your device.

dave

egeezer

Do you have a source for that info?

Are you saying that what got installed on the OP’s system was not Hive but some malware claiming to be Hive?

Everyone (including me, at first) is keen to answer the “what is Hive” part rather than on what actually got installed. But I’m drawing a blank on that anyway.

px_eliezer_

Getting back to your original issue….

You need to go to Settings on your phone, and REMOVE any apps that you don’t want.

You also need to install a malware/AV scanner on your phone….

Android:
https://www.bitdefender.com/en-us/consumer/antivirus-free-for-android

iPhone:
https://apps.apple.com/us/app/bitdefender-mobile-security/id1255893012

You can do a basic SCAN of your phone, without needing to get any paid/optional services.

Heat84

Somewhat-Reticent Did you try this ?

I am looking for a job, so maybe that has something to do with how it got installed. Most of those jobs are near me.

Heat84

I just checked my back-up app and it backed up the mysterious app. Should I re-install the mysterious app to do a scientific investigation?

px_eliezer_

Heat84 I just checked my back-up app and it backed up the mysterious app. Should I re-install the mysterious app to do a scientific investigation?

No, just No.

You keep digging yourself deeper and deeper.

Heat84

When I was looking at the mysterious app’s notifications, it wasn’t using the Castor sound. So I still don’t know what that came from. Is there any way to find out what apps are using a notification sound? It’s probably a system app in this case. If this was Windows, I could just search the registry for Castor.

egeezer

dave
I found the information on a Chinese website. The description referenced a utility or search result of “org.hiw.vlt.qfaodnha.rlkon” which was apparently part of or called from some other program on the OP’s device.

Since I used a translator, It’s very possible that it could be something else.

dave

The app implictly claims by its name org.hiw.vlt.qfaodnha.rlkon to have been written by some sub-organization of hiw.org (the naming convention is backwards to that used on web addresses)

There is no ‘hiw.org’ (the closest is hiw.org.uk, the Healthcare Inspectorate of Wales). This itself is grounds for suspicion.

Thane_Bitter

Heat84 If you have a firewall appliance that allows nation block it would be a good time to add China (and Russia, North Korea, all the —stan nations. I would also curate your installed app list, remove anything you don’t need including apps you might want but don’t make much use of. Factory reset and start over. Double check the installed apps and your contacts. Change passwords/passphrases too and set up recovery options for your accounts.

AKA when in doubt nuke it.

If you want to screw around with it install it on a standalone phone or emulator that is outside your firewall and sniff the traffic its generating.

egeezer

dave
I thought about the .org thing too, and tried hiw and wih to no avail. The OP quoted version 2.11 of the mystery app, which makes me think that the string may be a file location on a storage device.

At any rate it’s a screwed up app at best, and malware (or a part of it) at worst.

Heat84

egeezer I thought about the .org thing too, and tried hiw and wih to no avail. The OP quoted version 2.11 of the mystery app, which makes me think that the string may be a file location on a storage device.

Android apps have folder names like that. I thought that’s just what it was.

telcodad

InternetJeff

I just thought it was just one of those “Wanna-bee” Indians:

The Perplexing Nature of ‘Wannabe Indians’
It is considerably more popular today to share and have Native American ancestry than it was years ago, to feel connected to a group of people indigenous to a continent Americans now call their home.
https://americanindianrepublic.com/the-perplexing-nature-of-wannabe-indians/

Somewhat-Reticent

egeezer I found the information on a Chinese website.

The first time I searched,
one of two results was full of placeholders where letters would normally be.
It has not shown up for the same search pattern since.
The other result referenced LinkedIn, and still does.

dave

Heat84 Android apps have folder names like that.

Yeah, it’s a naming convention, used for Java packages amongst other things. Stuff written by whozit.com uses names prefixed with com.whozit. Name clashes are thereby avoided.