3 ms·
Damn, looks like I missed the mark on that one. I was basing my assumptions on http://stackoverflow.com/questions/32432785/i-have-updated-android-api-to-23-and
by voltagex_ 11y ago
Damn, looks like I missed the mark on that one.
I was basing my assumptions on http://stackoverflow.com/questions/32432785/i-have-updated-android-api-to-23-and-there-is-no-error-in-any-xml-file-but-when http://stackoverflow.com/questions/32432785/i-have-updated-a... which shows that the package we're looking for is com.silverpush.sdk.
The developer who asked that question works for the company who released that app.
The app description also says "Download MI Mobile and activate today, then just keep your phone with you throughout the day (including while you watch TV) with MI Mobile running in the background." which made me suspicious.
- brbsix 11y agoI'm a little dumbfounded that someone who works for SilverPush is soliciting StackOverflow for help integrating the their own SDK within an app. Anyways... Here's the (clean) link to com.silverpush.sdk: https://www.dropbox.com/s/i9uaoqp10k4lmaf/SilverPush%20Beacon%20Demo%20App%20v1.0.3.apk?dl=1 https://www.dropbox.com/s/i9uaoqp10k4lmaf/SilverPush%20Beaco...
- brbsix 11y agoBelow is just a little bit of relevant source from the demo app. As you can see it certainly appears to be listening for audio beacons. Now the interesting part would be to find an easy way to determine which other apps are using this. void a(String s1, String s2, String s3, String s4) { i(); p.setVisibility(8); w.setVisibility(8); s.setVisibility(0); s2 = Uri.decode(Uri.encode(s2)); if ("video".equals(s4.toLowerCase())) { s2 = new StringBuilder(); s2.append(s3); t.loadDataWithBaseURL("file:///android_asset/", s2.toString(), "text/html", "utf-8", null); q.setText("Demo : Audio Beacon Detected"); r.setText(s1); q.setText("Found a match !!"); return; } else { StringBuilder stringbuilder = new StringBuilder(); stringbuilder.append("<html><body style='margin:0;padding:0;background-color:black;'><a href='").append(s2).append("' ><img src='").append(s3).append("' height=250 style='margin:0 auto;display:block;' /></a></body></html>"); t.loadDataWithBaseURL("file:///android_asset/", stringbuilder.toString(), "text/html", "utf-8", null); s3 = new StringBuilder(); s3.append("<html><body style='margin:0;padding:0;background-color:black;'><a href='").append(s2).append("' ><img src='").append(s4).append("' height=50 style='margin:0 auto;display:block;' /></a></body></html>"); u.loadDataWithBaseURL("file:///android_asset/", s3.toString(), "text/html", "utf-8", null); q.setText("Demo : Audio Beacon Detected"); r.setText(s1); q.setText("Found a match !!"); return; } }
- voltagex_ 11y agoThe package name is obfuscated, correct?
- brbsix 11y agoI'm not sure what you're referring to. An aapt dump shows the package name as 'SilverPush Demo App' (version 1.0.3). It appears the same in the app drawer. If you mean the class files, then yes they are obfuscated. ProGuard (or something like it) was used to obfuscate the Java, but that is pretty par for the course. It is connecting to a few servers: http://54.243.149.109:8040/register http://54.243.149.109:8086/receiver http://ad-x.co.uk/API/click/Hungind45789jo/am554ec53dd8d021/NET/aff_sub/SilverPush?subid=aff_sub2&ord=[random] http://mobext.com http://silverpush.com So presumably these (along with other mobile ad networks) can be blocked via hosts file or MinMinGuard (Xposed). Not great, but probably a good course of action for now.
- voltagex_ 11y agoMore like we can't scan APKs for particular API calls because it looks like a call to a.a.b.a() internally. I guess package name was the incorrect term to use.
- brbsix 11y agoOh right, yes exactly... Though some of the "Anti-virus" apps are pretty good about identifying ad networks, so I suspect it's not a big problem to detect one way or another. Of course SilverPush could get pretty nefarious if they wanted to, but if that demo app is a proper exhibition of their products then I don't think we should be very afraid :)