3 ms·
Below is just a little bit of relevant source from the demo app. As you can see it certainly appears to be listening for audio beacons. Now the interesting part
by brbsix 11y ago
Below is just a little bit of relevant source from the demo app. As you can see it certainly appears to be listening for audio beacons. Now the interesting part would be to find an easy way to determine which other apps are using this.
void a(String s1, String s2, String s3, String s4)
{
i();
p.setVisibility(8);
w.setVisibility(8);
s.setVisibility(0);
s2 = Uri.decode(Uri.encode(s2));
if ("video".equals(s4.toLowerCase()))
{
s2 = new StringBuilder();
s2.append(s3);
t.loadDataWithBaseURL("file:///android_asset/", s2.toString(), "text/html", "utf-8", null);
q.setText("Demo : Audio Beacon Detected");
r.setText(s1);
q.setText("Found a match !!");
return;
} else
{
StringBuilder stringbuilder = new StringBuilder();
stringbuilder.append("<html><body style='margin:0;padding:0;background-color:black;'><a href='").append(s2).append("' ><img src='").append(s3).append("' height=250 style='margin:0 auto;display:block;' /></a></body></html>");
t.loadDataWithBaseURL("file:///android_asset/", stringbuilder.toString(), "text/html", "utf-8", null);
s3 = new StringBuilder();
s3.append("<html><body style='margin:0;padding:0;background-color:black;'><a href='").append(s2).append("' ><img src='").append(s4).append("' height=50 style='margin:0 auto;display:block;' /></a></body></html>");
u.loadDataWithBaseURL("file:///android_asset/", s3.toString(), "text/html", "utf-8", null);
q.setText("Demo : Audio Beacon Detected");
r.setText(s1);
q.setText("Found a match !!");
return;
}
}
- voltagex_ 11y agoThe package name is obfuscated, correct?
- brbsix 11y agoI'm not sure what you're referring to. An aapt dump shows the package name as 'SilverPush Demo App' (version 1.0.3). It appears the same in the app drawer. If you mean the class files, then yes they are obfuscated. ProGuard (or something like it) was used to obfuscate the Java, but that is pretty par for the course. It is connecting to a few servers: http://54.243.149.109:8040/register http://54.243.149.109:8086/receiver http://ad-x.co.uk/API/click/Hungind45789jo/am554ec53dd8d021/NET/aff_sub/SilverPush?subid=aff_sub2&ord=[random] http://mobext.com http://silverpush.com So presumably these (along with other mobile ad networks) can be blocked via hosts file or MinMinGuard (Xposed). Not great, but probably a good course of action for now.
- voltagex_ 11y agoMore like we can't scan APKs for particular API calls because it looks like a call to a.a.b.a() internally. I guess package name was the incorrect term to use.
- brbsix 11y agoOh right, yes exactly... Though some of the "Anti-virus" apps are pretty good about identifying ad networks, so I suspect it's not a big problem to detect one way or another. Of course SilverPush could get pretty nefarious if they wanted to, but if that demo app is a proper exhibition of their products then I don't think we should be very afraid :)