5 ms·

https://tusfiles.net/3d5ea3kw8nky https://tusfiles.net/3d5ea3kw8nky A very cursory look seems to indicate the microphone permission is used by Gracenote (https

• voltagex_ 11y ago
  Thanks - just for next time, tusfiles seems to use very shady advertisers and I happened to open it in Chrome for Android. I was redirected to another APK download!
  • brbsix 11y ago
    Sorry about that. I've had problems with Dropbox removing APKs in the past. Tusfiles is very lenient with that sort of thing but clearly there's a downside I hadn't noticed (ad block was enabled).
    • voltagex_ 11y ago
      No worries. If you've got some time, the SilverPush demo apps seem to be obfuscated and are out of my league.
      • brbsix 11y ago
        Yeah I'm looking over it right now... I'll see what I can find out, if anything.
• voltagex_ 11y ago
  Damn, looks like I missed the mark on that one. I was basing my assumptions on http://stackoverflow.com/questions/32432785/i-have-updated-android-api-to-23-and-there-is-no-error-in-any-xml-file-but-when http://stackoverflow.com/questions/32432785/i-have-updated-a... which shows that the package we're looking for is com.silverpush.sdk. The developer who asked that question works for the company who released that app. The app description also says "Download MI Mobile and activate today, then just keep your phone with you throughout the day (including while you watch TV) with MI Mobile running in the background." which made me suspicious.
  • brbsix 11y ago
    I'm a little dumbfounded that someone who works for SilverPush is soliciting StackOverflow for help integrating the their own SDK within an app. Anyways... Here's the (clean) link to com.silverpush.sdk: https://www.dropbox.com/s/i9uaoqp10k4lmaf/SilverPush%20Beacon%20Demo%20App%20v1.0.3.apk?dl=1 https://www.dropbox.com/s/i9uaoqp10k4lmaf/SilverPush%20Beaco...
  • brbsix 11y ago
    Below is just a little bit of relevant source from the demo app. As you can see it certainly appears to be listening for audio beacons. Now the interesting part would be to find an easy way to determine which other apps are using this. void a(String s1, String s2, String s3, String s4) { i(); p.setVisibility(8); w.setVisibility(8); s.setVisibility(0); s2 = Uri.decode(Uri.encode(s2)); if ("video".equals(s4.toLowerCase())) { s2 = new StringBuilder(); s2.append(s3); t.loadDataWithBaseURL("file:///android_asset/", s2.toString(), "text/html", "utf-8", null); q.setText("Demo : Audio Beacon Detected"); r.setText(s1); q.setText("Found a match !!"); return; } else { StringBuilder stringbuilder = new StringBuilder(); stringbuilder.append("<html><body style='margin:0;padding:0;background-color:black;'><a href='").append(s2).append("' ><img src='").append(s3).append("' height=250 style='margin:0 auto;display:block;' /></a></body></html>"); t.loadDataWithBaseURL("file:///android_asset/", stringbuilder.toString(), "text/html", "utf-8", null); s3 = new StringBuilder(); s3.append("<html><body style='margin:0;padding:0;background-color:black;'><a href='").append(s2).append("' ><img src='").append(s4).append("' height=50 style='margin:0 auto;display:block;' /></a></body></html>"); u.loadDataWithBaseURL("file:///android_asset/", s3.toString(), "text/html", "utf-8", null); q.setText("Demo : Audio Beacon Detected"); r.setText(s1); q.setText("Found a match !!"); return; } }
    • voltagex_ 11y ago
      The package name is obfuscated, correct?
• voltagex_ 11y ago
  Right under my nose instead: https://play.google.com/store/apps/details?id=com.silverpush.democrossdevice https://play.google.com/store/apps/details?id=com.silverpush...