Google

ManufacturerCarrier

“Among all the apps pre-installed by the majorsmartphone vendors (Samsung, HTC, LG, Sony)”on their phones, only about 18% come from AOSP.

•HA

RE

Phone VersionSMS/MMSContent ProviderInstant MessagingApp

VoIP MessageContent Provider

NewMessage

Tablet Version

SMS/MMSContent ProviderInstant MessagingApp

VoIP MessageContent Provider

NewMessage

Tablet Version

SMS/MMSContent ProviderInstant MessagingApp

VoIP MessageContent Provider

NewMessage

check its signaturecheck the image properties

fundamental conflictcomplicated relationshipverificationØMissing Packages, Activities, ActionsMissing Content ProvidersMissing Permissions

If com.samsung.android.app.memo exists

If com.sec.android.app.smemo exists

If com.samsung.android.app.memo exists

If com.sec.android.app.smemo exists

If com.samsung.android.app.memo existscom.samsung.android.app.memo

If com.sec.android.app.smemo exists

• Stealing voice noteAll deomos can be found at https://sites.google.com/site/androidharehunting/Missing Packages, Activities, ActionsØMissing Content ProvidersMissing Permissions

Query“com.lge.lgaccount.provider”for additionalCloud Servicesand add an item

LG CloudHub App

Query“com.lge.lgaccount.provider”for additionalCloud Servicesand add an item

Owncom.lge.lgaccount.provider

Handlecom.lge.ADD_ACCOUNT

Google Email App

AccountSetting ActivityWithin Google Email App

version 6.3-1218562

Action: android.intent.action.EDITData: content://ui.email.android.com/settings?account=id

Google Email App

AccountSetting ActivityWithin Google Email App

version 6.3-1218562

Action: android.intent.action.EDITData: content://ui.email.android.com/settings?account=id

ui.email.android.com

onlyGoogle Email Appversion 6.3-1218562

Malicious App

• Google Email Attack

All deomos can be found at https://sites.google.com/site/androidharehunting/and https://sites.google.com/site/perplexedmsg/

Missing Packages, Activities, ActionsMissing Content ProvidersØMissing Permissions

com.google.android.c2dm.permission.SENDcom.amazon.device.messaging.permission.SEND

com.nokia.pushnotifications.permission.SEND

Google Cloud Messaging

GCMReceiver

ADMReceiverAmazon Device Messaging

NokiaReceiverNokia Notification

Google Cloud Messaging

On NexusGCMReceiver

ADMReceiverAmazon Device Messaging

NokiaReceiverNokia Notification

Google Cloud Messaging

On NexusGCMReceiver

ADMReceiverNokiaReceiverPush Message

I have Nokia permission!

• Facebook Service Confusion

All deomos can be found at https://sites.google.com/site/androidharehunting/and https://sites.google.com/site/perplexedmsg/

I have GCM permission!

On Kindle FireGCMReceiver

Push Registration ID

ADMReceiverAmazon Device Messaging

NokiaReceiverGCM receiverAny timeGCM receiverAny timeGCM receiver• Skype Message StealingAll deomos can be found at https://sites.google.com/site/androidharehunting/and https://sites.google.com/site/perplexedmsg/

Attribute ReferenceStartService(action1)StartService(action1)

StartService()…

StartService(action1)StartService(action1)

StartActivity()…

Attribute Definitioncom.package.pkg1com.package.pkg1

Package Names…

com.package.pkg1com.package.pkg1

Actions…

StartService(action1)StartService(action1)

com.package.pkg1com.package.pkg1

StartService(action1)StartService(action1)

com.package.pkg1com.package.pkg1

Query()…

readPermission()…

Content Providers…

Permissions…

Vendor# of Images# of System Apps

Avg # of SystemApps Per Images# of Countries# of Carriers# of OSVersions

A

83

21733

261

36

2310B

71561

223

1

14C

1174

174

111D

4398

99

113E2319

159

212Total

9724185183362310Hares in Android 4.XHares in Android 5.X# of Hares# of Vulnerable Apps

# of Hares# of Vulnerable Apps

Avg Haresper Device

A

19279

3045 (18%)

608

99 (6%)

239

23598

B

679

121 (13.3%)

425

85 (15.5%)

157

100

224

C

N/A

N/A

248

33 (21.5%)

248

248

248

D

107

31 (12.4%)

85 (5%)

29845E187

23 (15.6%)

168 (12.1%)

101

16187

Total

20252

3220 (14.3%)1305

230 (11.7%)

153

8598

VendorMin Haresper Device

Max Haresper Device

* Co-first Author