aPuppet client is starting itself?

[dfun90]

Hello,

we are running our own aPuppet server on a dedicated server and deploy the aPuppet Android client using Headwind MDM Enterprise Edition.

In the past 1-2 weeks we have had around 4 employees (that have reported it, at least) telling us that the aPuppet app displayed that their is being remote-controlled, but they stated that they have not opened up the app themselves. I know of 2 cases where the users have never even opened the aPuppet client, nor gave the permissions needed for it to function.

It doesn't seem to be specific to the Android version, happened both on Android 10 and 11 phones.

Here is the most recent log I could find matching the Session-Id the user gave me today. He said that at the time (08:01:49) the Session was created he wasn't even awake yet.

[Tue Jun 29 08:01:49 2021] Got a DataChannel message (118 bytes): {"textroom":"create","is_private":false,"permanent":false,"transaction":"36870xxx2241","room":"xx6499xx","pin":"xxx"}
[Tue Jun 29 08:01:49 2021] Created TextRoom: xx6499xx (Room xx6499xx, public, secret: no secret, pin: xxxx)
[Tue Jun 29 08:01:49 2021]   ::: [xx6499xx][Room xx6499xx]
[Tue Jun 29 08:01:49 2021] Got a DataChannel message (162 bytes): {"textroom":"join","room":"xx6499xx","username":"device:motorola moto g(8) power","display":"phone","pin":"xxxx", "transaction":"61607xxx3668"}
[Tue Jun 29 08:03:59 2021] Request to unmount mountpoint/stream xx6499xx
[Tue Jun 29 08:03:59 2021] [mp-xx6499xx] Interrupting mountpoint
[Tue Jun 29 08:03:59 2021] [mp-xx6499xx] Leaving streaming relay thread
[Tue Jun 29 08:03:59 2021]   >> To device:motorola moto g(8) power in xx6499xx

Another reported incident happened 8 days ago, the same schema:

[Mon Jun 21 08:31:47 2021] Got a DataChannel message (118 bytes): {"textroom":"create","is_private":false,"permanent":false,"transaction":"7810xxx16354","room":"xx1462xx","pin":"xxxx"}
[Mon Jun 21 08:31:47 2021] Created TextRoom: xx1462xx (Room xx1462xx, public, secret: no secret, pin: xxxx)
[Mon Jun 21 08:31:47 2021]   ::: [xx1462xx][Room xx1462xx]
[Mon Jun 21 08:31:47 2021] Got a DataChannel message (162 bytes): {"textroom":"join","room":"xx1462xx","username":"device:motorola moto g(7) power","display":"motorola moto g(7) power","pin":"xxxx", "transaction":"0913xxx72771"}
[Mon Jun 21 08:33:55 2021] Request to unmount mountpoint/stream xx1462xx
[Mon Jun 21 08:33:55 2021] [mp-xx1462xx] Interrupting mountpoint
[Mon Jun 21 08:33:55 2021] [mp-xx1462xx] Leaving streaming relay thread
[Mon Jun 21 08:33:55 2021]   >> To device:motorola moto g(7) power in xx1462xx

In our Headwind MDM configuration, the App is NOT set to start after installation nor at boot.

I have no idea what would cause the aPuppet client to randomly start itself nor how I would go about debugging that.

[h-mdm]

APuppet can be automatically started by Headwind MDM request (appRun push message). I do not however remember if you have a Remote Control plugin which implements automatic start of aPuppet.

In aPuppet Premium, there's a remote logging through Headwind MDM. In Community version, you can investigate logcat to review what's going on.