4 ms·
I'm not sure what you're referring to. An aapt dump shows the package name as 'SilverPush Demo App' (version 1.0.3). It appears the same in the app drawer. If y
by brbsix 11y ago
I'm not sure what you're referring to. An aapt dump shows the package name as 'SilverPush Demo App' (version 1.0.3). It appears the same in the app drawer. If you mean the class files, then yes they are obfuscated. ProGuard (or something like it) was used to obfuscate the Java, but that is pretty par for the course.
It is connecting to a few servers:
http://54.243.149.109:8040/register
http://54.243.149.109:8086/receiver
http://ad-x.co.uk/API/click/Hungind45789jo/am554ec53dd8d021/NET/aff_sub/SilverPush?subid=aff_sub2&ord=[random]
http://mobext.com
http://silverpush.com
So presumably these (along with other mobile ad networks) can be blocked via hosts file or MinMinGuard (Xposed). Not great, but probably a good course of action for now.
- voltagex_ 11y agoMore like we can't scan APKs for particular API calls because it looks like a call to a.a.b.a() internally. I guess package name was the incorrect term to use.
- brbsix 11y agoOh right, yes exactly... Though some of the "Anti-virus" apps are pretty good about identifying ad networks, so I suspect it's not a big problem to detect one way or another. Of course SilverPush could get pretty nefarious if they wanted to, but if that demo app is a proper exhibition of their products then I don't think we should be very afraid :)