This is the provisioning from the QR code.
Sorry, I like to inspect these types of APKs before installing them…
{
"android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.shomerdns.kosher/.DnsLockAdminReceiver",
"android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM": "myg79QmtfmI6V-Xgocs4-pqa53rZiub0cOxoyWmtgHo",
"android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://shomerdns.com/frumphone/downloads/shomerdns.apk",
"android.app.extra.PROVISIONING_WIFI_SSID": "not_real",
"android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE": "NONE",
"android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
"dns_host": "frum.shomerdns.com",
"wifi_ssid": "not_real",
"wifi_password": ""
}
}
Claude Code
I decompiled the full APK with jadx (not just the pre-exported package folder, which was missing the shared/utility classes the app’s own logic lives in after R8 minification) and cross-checked it against the raw dex strings. Here’s what I found.
What the app actually is
com.shomerdns.kosher (v1.10, targets SDK 37) is a Device Owner / MDM-style “kosher phone” lock app, not a VPN app in the technical sense. It’s provisioned via Android’s standard managed-device enrollment flow (GetProvisioningModeActivity always requests fully-managed/device-owner mode; DnsLockAdminReceiver is the DeviceAdminReceiver).
There is no VPN. The manifest has no BIND_VPN_SERVICE permission and no VpnService component anywhere in the dex. The “VPN” marketing claim is inaccurate — what it actually does is force Android’s built‑in Private DNS (DNS‑over‑TLS) to a specific hostname via DevicePolicyManager.setGlobalPrivateDnsModeSpecifiedHost(), then lock the setting with the disallow_config_private_dns user restriction so it can’t be changed from Settings. That’s a legitimate device-owner API, just not a VPN.
Real capabilities (all via standard DevicePolicyManager/UserManager device-owner APIs)
- Lock private DNS to an admin-chosen host; pause/resume it; detect mismatch/pause state
- Lock a specific Wi-Fi network via WifiSsidPolicy (SDK ≥33) and store SSID/password (see below)
- Disable camera, disable SMS app, hide Play Store, hide the Google app
- “Lockdown” mode: adds ~19 user restrictions (no Bluetooth, no NFC, no debugging, no unknown sources, no factory reset, no safe boot, no uninstall apps, no USB file transfer, no airplane mode, etc.)
- Block all app installs (no_install_apps)
- Silence notifications (setInterruptionFilter), not read them
- PIN-gate the settings UI, with Argon2id-hashed PIN storage, AES-256-GCM (AndroidKeyStore-backed) encryption of the stored DNS host/Wi-Fi credentials, and exponential-backoff lockout after failed attempts
- “Emergency unlock”: requires typing an exact confirmation phrase and the correct PIN, then locally clears every restriction and calls clearDeviceOwnerApp() — no hidden bypass or backdoor code found
- Self-update: periodic WorkManager job fetches https://shomerdns.com/frumphone/downloads/manifest.json, downloads the APK over HTTPS, verifies SHA-256, and silently installs it via PackageInstaller (only possible because it’s device owner) — legitimate mechanism for a locked-down device that can’t use the Play Store, but it does mean shomerdns.com’s server can push arbitrary code to enrolled devices, which is inherent to this deployment model and disclosed by definition (it’s a fleet-management app)
What it does not do
I found no evidence of: microphone/camera capture, location tracking, SMS/call-log/contacts reading, accessibility-service abuse, notification-content reading, ad/analytics SDKs, or any network egress besides the one shomerdns.com update endpoint (confirmed by grepping every string literal in classes.dex — the only two other embedded URLs are a stock schemas.android.com XML namespace and a Bouncy Castle library credit string).
Verdict
This is a legitimate, if powerfully-privileged, parental/religious-community “locked phone” management tool — consistent with the real-world “kosher phone” product category. It is not spyware and has no C2/backdoor behavior. The two things worth flagging to a user/reviewer are:
- Marketing inaccuracy: calling it a “VPN client” when it only enforces Private DNS — meaningfully weaker/different privacy properties than a real VPN.
- Trust concentration: as device owner, it can silently install anything shomerdns.com’s manifest points to, and whoever performs the QR-code provisioning controls the initial DNS host/Wi-Fi credentials pushed to the device — normal for MDM, but it means device security fully depends on trusting the phone’s enrolling party and shomerdns.com’s server security, not on the app’s code itself.
Quote of the day:
…normal for MDM, but it means device security fully depends on trusting the phone’s enrolling party and shomerdns.com’s server security