yashsingh1/xdaforums huggingface dataset:
[Epic 4G Android Development] DAvid_B:
So, let me understand this.

Are the Apps you download from the official Google app store stored by google or the developers?

If it's stored by Google, how in the world can they not be automating checking for apps like this?

This sounds kind of lame for a company with $11billion dollars in the bank.

Unless apps aren't stored by Google? And if they aren't, why doesn't Google tell you that when you download an app?
[Epic 4G Android Development] Rodderik:
apps are stored by google but i dont blame them for stuff like this. google doesn't dissect every single piece of code that gets pushed to the market. it wouldnt be very cost effective for them or motivational for software developers....after all we dont want the android market becoming like apple's store do we?
[Epic 4G Android Development] brickwall99:
So this patch (zip) can be applied via CWM3 just like anything else, right?
[Epic 4G Android Development] Rodderik:
correct

10char
[Epic 4G Android Development] eliasadrian:
I'm pretty sure I'm in the clear, but this should prevent some future attacks, correct?

And any idea of phone compatibilities, ie MT4G? If you don't know I can flash it and let you know, but if it doesn't work there's no point in trying. Thanks in advance!

Edit: I guess it doesn't matter anyways, I could just create the blank folder. My bad... but thanks.
[Epic 4G Android Development] Rodderik:
from what i understand it applies to all pre-gingerbread phones that are exploitable by rageagainstthecage (but possibly others) it doesn't hurt anything to put an empty file called profile in /system/bin/ if it prevents the current malware from doing it's damage just to be safe
[Epic 4G Android Development] nubecoder:
Thanks for the info, but I don't quite understand what putting an empty file named profile in the bin folder would do.

I'm not seeing any special permissions being set or anything.

How is this fix effective? Couldn't the "malware" simply overwrite the blank file?

I don't get it.

=]

-ps I haven';t taken the time to read through the linked source, so forgive me if this has been explained.
[Epic 4G Android Development] britoso:
Anyone know exactly what that profile file flags in the OS?

edit: looks like this is a fix for this particular strain only.
[Epic 4G Android Development] Rodderik:
the fix is based off of Justin's suggestions in the link...what is to stop future versions of this malware from ignoring this file in the future? nothing! but for now Justin over at andoidpolice.com has combed through the known infected apk files and provided us with this fix and info....i would read the 2 articles quote in the OP for all the goodies

the empty profile file shouldn't affect anything in the market or otherwise....i'm assuming the malware checks if that file exists and if it does then it doesn't try to run but this is speculation on my part. if i need to i can get some more information if the links in the OP don't answer your questions
[Epic 4G Android Development] Tortel1210:
My guess is that it tries to extract then run a file named profile, and adding the blank might prevent it from working
[Epic 4G Android Development] rayburne:
Would it be safe to assume that if you look in your system/bin directory and already have a file named profile than you have been infected?

Instead of flashing, using Root Explorer could I just create a file named "profile" in the system/bin directory for a fix?

Anyone think an android AV program like Lookout would have caught this if running when the infected app was installed?
[Epic 4G Android Development] k0nane:
I suspect it would.
[Epic 4G Android Development] Rodderik:
It is quite possible. Check and see if you installed any of the programs lately from the OP. If so then it is quite possible. It is also quite possible a rom developer put that file in there so that is not a 100% way of making sure.

Yes indeed!

Here is more from the articles I posted

So I'm assuming that means Lookout scans for or will soon scan for this malware.
[Epic 4G Android Development] xaueious:
Does the file prevent the root exploits from running?

I am not sure if your update.zip actually works, unless you are sure that the file is created with the correct file permissions. I'll test it in a minute. I don't know if your updater script is universal either:

ui_print("**Installing**");
ui_print("**Mounting Partition**");
run_program("/sbin/mount", "/dev/block/stl9", "/system");
ui_print("**Copying System File**");
package_extract_dir("system", "/system");
ui_print("**Unmounting Partition**");
unmount("/system");
ui_print("**Installation Successful**");

Can someone elaborate more on why this works, if it works?

It takes 10 minutes to throw this into an APK fix on the Market for rooted users, which works better than update.zip.

adb remount

adb shell touch /system/bin/profile

adb shell chmod 644 /system/bin/profile
[Epic 4G Android Development] Muckrak3r:
I ran the patch using clockwork, how do I know if it worked?

The only app I may have downloaded from that list is chess, but I doubt I did install that.

Most of those other apps have keywords I STAY AWAY FROM for this very reason lol!
[Epic 4G Android Development] xaueious:
I redid the update.zip in OP.

Forgot attachment.

show_progress 0.1 0

copy_dir PACKAGE:system SYSTEM:

show_progress 0.1 10

show_progress 0.2 0

set_perm 0 0 0644 SYSTEM:bin/profile

show_progress 0.2 10

This should work on more devices. Test signed.
[Epic 4G Android Development] Rodderik:
This .zip is flashable for the Epic running ClockworkMod Recovery. I will include directions in the OP for other methods of getting the file there. If some one wants to put together an apk or a signed update.zip feel free to let me know and I'll make sure it gets posted.

Also I have requested some more technical information on the malware and I will update with the new information when I get it.
[Epic 4G Android Development] xaueious:
Actually, I'm not too familiar with update.zip.

Wouldn't it make sense to ensure that the permissions on the profile file are 644?

Append

set_perm(0, 0, 0644, "/system/bin/profile");

to your updater-script

edit:

nevermind. 644 is default. So both our packages work fine.

This is the post linked by AndroidPolice. That's why I was commenting here. I did not notice that this as the Epic forum :D
[Epic 4G Android Development] Rodderik:
by default permissions are set to 0644 when not specified...looking at your previous post as well it looks like your recovery for pre-Edify update script...i have updated the OP and attached new files including your pre-edify version of the update.zip thanks
[Epic 4G Android Development] MilkPudding:
I really appreciate what you guys are doing here. But I still can't stop wondering if these sudden outbreaks of trojans are created by antivirus companies to instill fear and the need for their apps. :(
[Epic 4G Android Development] joebob2000:
The fact that it is possible at all, with code pushed from the "official" market, with no fix except an ota patch that has to come before the infection... Who ever did this, they did a good job instilling fear. God willing, this won't turn tragic, but if it does (say, identity theft or premium text scams escalate) the android app community could be set back years.

Want to play follow the money? Apple is right there next to the av companies :D
[Epic 4G Android Development] lazyart:
I had the Super Ringtone Maker on my phone a few months back. It seemed kinda sketchy because once you ran it, it popped up some ad and then Ringdroid would run. I removed it because I something just didn't seem right... especially since RingDroid is a free app. Some time later I wiped my phone while flashing a ROM.

Ugh.
[Epic 4G Android Development] Rodderik:
interesting theory there Puddin' you could be right...until i see what exactly its doing i don't know how the profile file stops it from working...it does sound a little fishy

EDIT: I mean't by stopping it from working...not Justin and all his efforts giving us a way to patch it. hehe
[Epic 4G Android Development] MaxPatlick:
damn.. this is why we can't have nice things. I think I downloaded the scientific calculator, but I can't remember.. oh and my phone seems to be missing anyway.. HACKERS STOLE MY PHONE :mad:
[Epic 4G Android Development] huytrang90:
I hope this won't be a reason for google to remove root from us..
[Epic 4G Android Development] huytrang90:
Not good.

I just flashed the edify version of this on Bonsai 3.0. now I got all kind of FC.
[Epic 4G Android Development] iSaint:
Im pretty sure i would have been infected but if i flash stock with root in cwm3 is that good enough? because my odin NEVER works it recognizes but always fails
[Epic 4G Android Development] GoogleAndroid:
So this app is one of the infected ones: http://www.appbrain.com/app/spider-man/com.hz.game.spiderman

I can't find it in the market, but it isn't by myournet. I recently installed it, and it was gone after I had to wipe, but Titanium restored it. I never ran it after the restore. Could I be infected?

EDIT: Reading through some comments on an article, I think that is the original safe one, but Google pulled both.
[Epic 4G Android Development] cyansmoker:
Well, these is now an .apk. Look for "DroidDreamKiller" on the market (I know it's a stupid name) or on the web: https://market.android.com/details?id=com.voilaweb.mobile.droiddreamkiller

It's a really simple app that I quickly put together by ripping pieces of another of my apps.
[Epic 4G Android Development] musclehead84:
Just downloaded apk from.market and I really like it. It says.I'm good to go.

Sent From My Evo Killer!!!
[Epic 4G Android Development] Rodderik:
Great! Original Post has been updated...thanks cyansmoker
[Epic 4G Android Development] Mr. Frost:
Is there any way to check if I had installed one of the named apps? I mean, I can remember I've tried a calculator, but there are tons, even with the name scientific calculator... I have no idea which one I installed.
[Epic 4G Android Development] zman519:
I just found this app/game on my GFs phones (LG Optimus) after i put the profile fix on to my Epic.

So do i have to wipe her phone out:mad::confused::mad: I think i can get it done before shes up hehe:p

update

Ok so i ran the "DroidDreamKiller.apk" from market and it did not find the file So i hope the phones ok. I'v been working on to many other androids I need some time for my Epic

any one know?
[Epic 4G Android Development] row1:
Is there anyway for non-root users to:

(i) See if they are infected

(ii) Apply a patch?

My friend had "Spider Man" on his phone and is thinking of just doing a standard wipe ... but it seems like this wont be enough.
[Epic 4G Android Development] zman519:
Would running "Droidwall" in white list mode block this malware/Trojan from reporting home?

Just a thought some times in the past Zone Alarm on windows would stop crap like this dead in its tracks. But i don't think i ever picked up any trojans on day Zero.

A little OT but some of the app names ROFL your just asking for it. You all remember cleaning up friends/side jobs windows machines and seeing that malware name in Ad-aware that seemed to only come from porn sites :p

But the "Photo Editor" and the "Scientific Calculator" i about fliped when i saw Photo Editor cuz i have PhotoEditor by satorun installed :eek:
[Epic 4G Android Development] zman519:
What phone does he have? if its one that z4root works on you could temp root it and then do it via adb or the terminal emulator
[Epic 4G Android Development] Darkstriker:
This is mostly true, however, protecting against it isn't that simple. z4ziggy (member here) discovered the exploit was possible from inside an application and released a proof-of-concept here. He is a very accomplished programmer and tried for several weeks to create an immunizing application, but failed! I strongly doubt that protecting a phone would be this easy.

Also, devices running 2.2.1 are safe. Not only 2.3 is patched. Android 2.2 is, however, still vulnerable!
[Epic 4G Android Development] Cjunior:
How can i find out if im infected or not?

and if im infected what should i do?

this is only for 2.2 roms?

so if i have CM7 with is 2.3 GB i don't have to worry about it?
[Epic 4G Android Development] XtaC318:
We don't need to worry about it at all. Our device's are running 2.2.1 not 2.2
[Epic 4G Android Development] row1:
Desire Z. Will look into it thanks.
[Epic 4G Android Development] Cjunior:
thanks for the replay :)

so just so i can sleep well....

if im running CM7 i don't have to worry about this malware?

and almost all sense roms are 2.2.1, with is ok as well?

sorry for the noobe question is just becouse i do a lot of baking only true my phone i that scared me for a minute :eek:
[Epic 4G Android Development] MilkPudding:
Correctly me if I was wrong, if you look into system/bin before applying the fix here and found a file named 'profile' there, you are likely to be infected.

Anyway, for those who are really worried, just do a factory reset and you should be good.
[Epic 4G Android Development] musclehead84:
I would use Odin if I was likely infected.

Sent From My Evo Killer!!!
[Epic 4G Android Development] Cjunior:
thanks i will do the factory reset on it. just to make sure.:D
[Epic 4G Android Development] fanjal:
Thanks everyone for the work in finding this and providing us with some protection.

Is there any sure way of knowing whether a phone has been infected, other than the profile file method?

Just asking because I happened to apply the patch BEFORE reading about it and checking if file existed. I had a Chess app installed but it looks legit enough as it is still in the market and is by Aart Bik, nevertheless I would prefer to know someone is working on a detection tool.

I may end up doing the factory reset, but I wanted to ask anyways.
[Epic 4G Android Development] Rodderik:
i think you are ok if you didnt download from Myournet
[Epic 4G Android Development] ungovernable1977:
Jobs did it. :D
[Epic 4G Android Development] MilkPudding:
Hahaha!! More or less since people start to freak out and assume iphone is so much safer. Lol.

Jokes aside, use an antivirus apps if it makes you feel safer. But if you know how it work, you will realize that it only protects you as far as your common sense goes.

"All smart phones are only as smart as the user. " - use your common sense, it's the best antivirus.
[Epic 4G Android Development] bobbbb:
That was so corny :rolleyes:
[Epic 4G Android Development] xceebeex:
Would something like Lookout catch stuff like this?
[Epic 4G Android Development] zman519:
Rodderik & cyansmoker

Just want to give you two a big THANK YOU :)
[Epic 4G Android Development] woolster22:
So if I dont have a profile in system/bin I'm good?
[Epic 4G Android Development] californiarailroader:
If we have Lookout, do we need this?
[Epic 4G Android Development] Rodderik:
i would just to be safe
[Epic 4G Android Development] californiarailroader:
Thanks. I am running CoreDroid, does it understand Edify?

"

UPDATE: I renamed the .zip file and reuploaded it (350 hits wow). Also in the edify scripted version I added 644 permissions to the file (but if you already flashed it then it should have defaulted to that). I also added a pre-edify version of the patch thanks to xaueious for people using a recovery that does not yet understand edify."
[Epic 4G Android Development] californiarailroader:
Thanks Rodderik!
[Epic 4G Android Development] pulser_g2:
Quick technical question...

I presume this is to prevent the malware from making an infected binary called profile, which is the Trojan itself?

If so, what's to stop a future attack from using a differently named, or self mutating, file?

Just curious as to how effective this is, given the fact we are talking about root exploits, which can be programmed to overcome most limitations like this.

Or am I missing something here? (reading from my phone so I could have missed a bit of something)
[Epic 4G Android Development] javip:
out curiosity how do you know who the publisher of a certain app is? is it the name the appears right under the app in the market place?

the reason i ask is because i have chess for android and pewpew but neither say anything about Myournet being the publisher.
[Epic 4G Android Development] musclehead84:
Yes the name.under the apologize is the developer

Sent From My Evo Killer!
[Epic 4G Android Development] overground:
I'm fairly sure this particular fix is just for this particular strain. I highly doubt it will thwart any pre-existing, alternate malware nor any futures.
[Epic 4G Android Development] MaluNoPeleke:
Can my phone (HTC Desire Z with 1.82 firmware) be infected?

I don't have root and even with the psneuter temproot method I cannot create the blank profile file.

Thanks
[Epic 4G Android Development] fsc137:
Niggling technicality:

Using 'adb shell' or terminal emulator (should work on any phone)

Using 'adb shell' or terminal emulator (should work on any ROOTED phone)

Isn't that right? Can't "su" without rooting. (Can you "su" from adb shell without rooting?)

(In fact, as an old Unix guy, I'm nervous about this whole "su with null password" business in Android. Seems to me that exploits like this could be prevented by installing a root password.)
[Epic 4G Android Development] pulser_g2:
Most devices I know of can open adb shell after enabling usb debugging. No su or remount unless ro.secure=0.

You cannot su from adb shell without root, as you need root to reflash boot.img to set ro.secure=0.

Root password wouldn't help IMHO, as the suid could still be set, AND... root exploit grants you root, regardless of the length of said password.
[Epic 4G Android Development] fsc137:
It seems to me that the whole "outside developers" idea is, at present, based on the existence of a root exploit, so if all the root exploits were fixed, these wonderful ROMs would not be available.

A better way to go, in the long term, would be to fix the root exploits and then have the outside developer software loaded (at least initially) through Odin. That would be more secure, requiring that someone actually hold down "1" while rebooting, rather than allowing root to ever be achieved through software.
[Epic 4G Android Development] Rodderik:
You're right! I have updated the OP to clarify that. Thanks.

root permissions do not get called from any password based authentication on android
[Epic 4G Android Development] Rodderik:
Correct again! Developers could easily extract, modify, inject, and release a hacked up initramfs with root built-in an Odin .tar (or any stock image flashing program). On the same note though not much is going to prevent a malicious apk from reflashing the kernel of unsuspecting users and then on reboot have a go at the info they want. I guess my point is anything is possible given the time and determination.
[Epic 4G Android Development] cyansmoker:
Then, as an old unix guy, I'm sure you realize that this exploit has nothing to do with su, which is just an executable, and that it, instead, uses privilege escalation (or in rageagainstthecage's case: lack of de-escalation)

Nothing. As you suspect, this particular patch only addresses this particular malware and we were lucky that its behavior is so...compliant.
[Epic 4G Android Development] pulser_g2:
Fair enough :) It does the trick here.

Obviously it would be trivial to code it such that "static" measures such as this would not work. Randomly naming the file, or abusing the root permissions to delete the existing file and overwrite it.

I wonder... how many HTC users were saved by their NAND locking, which would prevent these changes being committed to NAND, despite being root. Perhaps manufacturers will use this as justification for NAND locks?
[Epic 4G Android Development] fsc137:
Apps can reflash the kernel??? That should not be permitted. One of the whole points of a Java virtual machine is that the apps can't get a hold of the real hardware.

Anyone who cared about security would be very careful about what they flashed with Odin. Software from a trusted source, possibly assembled and compiled one's self from source code (inspected source code, if necessary), is the way to go.

Some sort of accommodation would have to be made so that the wireless carrier can modify the ROM, but that should be done with some sort of strict hardware-based encryption and handshaking.

Meanwhile, you're not going to catch me doing any banking on my phone.
[Epic 4G Android Development] deano0714:
Umm i think im infected... would the profile file in system/bin be empty?
[Epic 4G Android Development] thunderteaser:
Please, give me an advice.

Suppose I want to create this file while installing a rom, I would make a little script like this:

#!/sbin/sh
echo "Fixing vulnerability issues..."
touch /system/bin/profile
chmod 644 /system/bin/profile

and edit the updater-script to copy it in /tmp and run it, will it work?
[Epic 4G Android Development] cyansmoker:
Yes it should work except I wouldn't label it "Fixing vulnerability issues..."

That's a tad misleading.
[Epic 4G Android Development] thunderteaser:
Thank you very much! That was just an example, also it's a script I would personally use, I'm not a professional cooker so I'm not releasing ROMs! I could also delete that echo part, it was just for fun! :)
[Epic 4G Android Development] deano0714:
Please answer
[Epic 4G Android Development] Rodderik:
yes it should initially not exists and when it does it should be empty...if your profile is not empty please paste it's contents here
[Epic 4G Android Development] Rodderik:
even simpler your updater-script should copy files to /system so simple put that file in the right place and set_perm(0, 0, 0644, "/system/bin/profile") in your updater-script or download the edify zip from the first post and use it as an example.
[Epic 4G Android Development] aca89:
Does this mean that device which was not rooted after infection becomes rooted?
[Epic 4G Android Development] thunderteaser:
Oh, yes! I should bear in mind there's always an easier option! Shame on me... :o But did you mean 0644 instead of 0777?
[Epic 4G Android Development] Rodderik:
yes i meant 0644 my apologies...i'm digging in kernel source so i was a bit distracted...ill fix that post now :)
[Epic 4G Android Development] Rodderik:
correct but you still might not be able to issue a su command without the proper binaries in place common to when we root on purpose
[Epic 4G Android Development] aca89:
Thx for response. It would've been nice way to find out whether your device is infected or not by just installing some random app which requires root permisions and then starting it.
[Epic 4G Android Development] thunderteaser:
No problem! ;) Can you also kindly tell me if this syntax is correct?

set_perm 0 0 644 SYSTEM:bin/profile

Obviously after copying system.
[Epic 4G Android Development] Rodderik:
set_perm 0 0 0644 SYSTEM:bin/profile for pre-edify yup that's right
[Epic 4G Android Development] harabinger66:
Ok so i'm trying to understand what's going on. The bad Apk's install a file called profile, in /system/bin (/profile). So how does one see if there infected? I assume you should see a profile file in that directory already. If I understand all of this correctly thus far my question is:

------------ If you installed one of these infected apps, deleted it, and then subsequently flashed many roms afterwards.... would you still have the profile file in your /system/bin ?

Because I know i installed a program called "photo editor", and currently I have no profile file in said folder.. Wondering if I am safe or if I should clean the slate. A pain in the arse.

BTW I use a Samsung Vibrant.
[Epic 4G Android Development] Rodderik:
if when you flashed those roms you wiped/factory reset (or the rom did it for you) then you should be ok
[Epic 4G Android Development] harabinger66:
Thanks

Cool thanks. I wasn't sure if it could survive the data wipe without reformatting. Thanks again.