[General Topics] Jarmezrocks:
Good day ladies and gents,

I just downloaded and installed and logged this app from the playstore. Check out the list of permissions it has:

Here it is and the developers reasons for why he needs those things.

THIS APPLICATION HAS ACCESS TO THE FOLLOWING:
NETWORK COMMUNICATION
FULL NETWORK ACCESS
Allows the app to create network sockets and use custom network protocols. The browser and other applications provide means to send data to the internet, so this permission is not required to send data to the internet.
PHONE CALLS
READ PHONE STATUS AND IDENTITY
Allows the app to access the phone features of the device. This permission allows the app to determine the phone number and device IDs, whether a call is active, and the remote number connected by a call.
SYSTEM TOOLS
INSTALL SHORTCUTS
Allows an app to add shortcuts without user intervention.
UNINSTALL SHORTCUTS
Allows the app to remove shortcuts without user intervention.
BOOKMARKS AND HISTORY
WRITE WEB BOOKMARKS AND HISTORY
Allows the app to modify the Browser's history or bookmarks stored on your device. This may allow the app to erase or modify Browser data. Note: this permission may note be enforced by third-party browsers or other applications with web browsing capabilities.
READ YOUR WEB BOOKMARKS AND HISTORY
Allows the app to read the history of all URLs that the Browser has visited, and all of the Browser's bookmarks. Note: this permission may not be enforced by third-party browsers or other applications with web browsing capabilities.
Hide
NETWORK COMMUNICATION
VIEW NETWORK CONNECTIONS
Allows the app to view information about network connections such as which networks exist and are connected.
VIEW WI-FI CONNECTIONS
Allows the app to view information about Wi-Fi networking, such as whether Wi-Fi is enabled and name of connected Wi-Fi devices.
SYSTEM TOOLS
READ HOME SETTINGS AND SHORTCUTS
Allows the app to read the settings and shortcuts in Home.
AFFECTS BATTERY
PREVENT DEVICE FROM SLEEPING
Allows the app to prevent the device from going to sleep.
YOUR APPLICATIONS INFORMATION
RUN AT STARTUP
Allows the app to have itself started as soon as the system has finished booting. This can make it take longer to start the device and allow the app to slow down the overall device by always running.

This is one nasty piece of work

- This app checks to make sure it has all the requirements it needs to perform its harm

- The App hides its methods to initiate

- It activities a hidden sms message to send to the maximum allowed recipients

- It hides all notification to the interface

- It attempts to execute

- It checks to make sure any popup windows generated by its actions do NOT display to the end user

- It then goes back and sweeps up after its self

- It checks to make sure it has not been detected (in which case it had....but all the while Logcat was running I couldn't see what was happening so I shut it down) only last week I started development on my own console app for logging ADB to stream both to the console and to a log file. I think I will finish that project off this week now :)

- It checks that it has not been discovered

- It re-initiates again the same cycle....

Developers Play Store Account.....and YES ALL of their apps are the same (nicely rendered good looking apps too) ALL with the same permissions as well!

https://play.google.com/store/apps/developer?id=HorseMaster+Labs

This app alone has been downloaded 1,000 - 5,000 in the last 30 days!

https://play.google.com/store/apps/details?id=com.lwpp.android.techno&feature=search_result

You will note my review and I have reported this already to the Google Play support team and am about to contact Kapersky and the likes.

After running logcat for no more than a minute I got the following:(see attached its too large to post as plain text)

Those who may have installed this app remove it straight away and contact your service provider

==============================================================================================

Update:

For anyone following.

The zip has all of my analysis contained.

1) The main apk used

2) Typical dex2jar decompile

3) APKTool 1.5.2 (latest) decompile to smali

4) My own personal decompilation process with several iterations of optimisation (been running for the last hour or so) with as pur java output as you can probably get. Much better for analysing these kinds of apps

5) My own stripped version of the apk that still contains the executing code of the apk (has had permissions revoked and heaps of junk removed) if you decompile this app you will see what I mean. I have done a fair bit of the hard work, there is still a fair bit more to be done though.

Download from skydrive here:

http://sdrv.ms/11yRKoW

If someone gets the apk (my modded apk) running and or decodes the methods to readable strings could you please respond in here and share for the rest for the rest of us.

UPDATE:!

Well after I hacked the apk and stripped it back of all the junk that I believed that could be responsible for this nasty stuff, I attempted to compile and re-install. Obviously that didn't work so well. The apk compiled but does not run. More investigation needed at a later date.

HOWEVER, I checked it via logcat. To my surprise there was STILL a lot of nasty stuff going on? seriously WTF?

I decided to download the ESET android version after recognised dev [MENTION=2178960]pulser_g2[/MENTION] made mention of it in this thread detecting the apk and removing it before he could even download it. Avast = sh!t I installed ESET free beta trial version and bam straight waya recognised another nasty living in my system. Good thing that it hadn't been there for too long. It incidentally got restored during a batch install with Titanium after a clean flash the other day.

Second culpret Call & Sms Stats (I never use it anyway).

I used these

http://www.virustotal.com

http://virusscan.jotti.org/en

and low and behold the following...

Call & SMS Stats

Call & SMS Stats - Virus Total

Call & Sms Stats - Jotti's Malware scan

Techno Live Wallpaper

Techno Live Wallpaper - Virus Total

Techno Live Wallpaper - Jotti's Malware scan

I thought I might do a little bit of a write up on the techniques that I use in my analysis whilst I am at it. Firstly this is for greater understanding of what is going on with these apps.

But before I start, I wanted to add that I think the developers of these apps are not the ones at fault. I think they are merely looking out fr their pocket and not for their users with hosting these apps for free and most likely to the decline of people purchasing paid versions of apps. So they embed some plugin (or in this case several) into the application in hopes for better returns, but ignorantly in doing so putting a whole heap of peoples privacy at risk!

These adware companies work of two things 1) Signing people up to premium services 2) Lead generation to their clients that pay them advertising. The developers although unknowing are not helpless and innocent and should be more aware of what they are doing before they commit to doing things like this.

Communication stats or Call & SMS Stats as it is better known has 5 or 6 independent ad add-ons (that was a mouthful) in their app. On top of Googles Admobs, which at the moment is starting to sound like a clean going citizen if it was one. It IS these ad companies that are the nasties. However it is the reputations of the developers them selves that are going to get tarnished.

Ok to continue on here are some steps that I take to analysing apps.

More to come here.....stay tuned

Thanks

James