3 ms·

OK, it's a RAT, but how do we get from receiving a supposed .ppt on email to having DroidJack .apk installed on the system ? Assuming user isn't tricked into co

by tdkl 10y ago

OK, it's a RAT, but how do we get from receiving a supposed .ppt on email to having DroidJack .apk installed on the system ? Assuming user isn't tricked into confirming the install (not to mention disabling the manual apk install protection).

Buge 10y ago
I'm not sure if this was how it's done. But if the app is on the Play store, it can be remotely installed on your Android device via the Play website.
- tdkl 10y ago
  Ah, it's all described perfectly here [1] and Android specifically [2]: [1] https://citizenlab.org/2016/08/group5-syria/ https://citizenlab.org/2016/08/group5-syria/ [2] https://citizenlab.org/2016/08/group5-syria/#part4 https://citizenlab.org/2016/08/group5-syria/#part4 Good old fake Flash update. But still relies on user to be installed, so nothing sophisticated or "Android is bad" here. If anything the Powerpoint malware looks interesting. The .ppsx extension kinda gives it away, since it's unusual for casual presentations, but that's hard to spot for Joe User.
  - duaneb 10y ago
    The fact that installing an app can give people arbitrary access to your phone without understanding WHAT you installed definitely implies Android app installation is broken in some way.
    - tdkl 10y ago
      Well, it's exactly what the warning popup when enabling side-loading states ;] But it's still possible, so that's pretty fine in my book compared to the fruit company.
      - duaneb 10y ago
        It's a little too easy for non-technical users to accidentally enable it. The moms & pops of the world would probably never need to side-load.
        Nullabillity 10y ago
        Who is the right person to decide who "needs" to side-load? Besides, there are loads of legitimate reasons to, there's a reason Humble Bundles aren't a thing on iOS.
        duaneb 10y ago
        > Who is the right person to decide who "needs" to side-load? The person who decides to explicitly opt in to allowing side-loading. Just don't allow apps, web pages, etc etc to opt-in for you to ensure the technically non-adept have a difficult time getting themselves into trouble.
        Nullabillity 10y ago
        Which is already the case...?

by tdkl 10y ago

Buge 10y ago

I'm not sure if this was how it's done. But if the app is on the Play store, it can be remotely installed on your Android device via the Play website.

tdkl 10y ago
Ah, it's all described perfectly here [1] and Android specifically [2]: [1] https://citizenlab.org/2016/08/group5-syria/ https://citizenlab.org/2016/08/group5-syria/ [2] https://citizenlab.org/2016/08/group5-syria/#part4 https://citizenlab.org/2016/08/group5-syria/#part4 Good old fake Flash update. But still relies on user to be installed, so nothing sophisticated or "Android is bad" here. If anything the Powerpoint malware looks interesting. The .ppsx extension kinda gives it away, since it's unusual for casual presentations, but that's hard to spot for Joe User.
- duaneb 10y ago
  The fact that installing an app can give people arbitrary access to your phone without understanding WHAT you installed definitely implies Android app installation is broken in some way.
  - tdkl 10y ago
    Well, it's exactly what the warning popup when enabling side-loading states ;] But it's still possible, so that's pretty fine in my book compared to the fruit company.
    - duaneb 10y ago
      It's a little too easy for non-technical users to accidentally enable it. The moms & pops of the world would probably never need to side-load.
      - Nullabillity 10y ago
        Who is the right person to decide who "needs" to side-load? Besides, there are loads of legitimate reasons to, there's a reason Humble Bundles aren't a thing on iOS.
        duaneb 10y ago
        > Who is the right person to decide who "needs" to side-load? The person who decides to explicitly opt in to allowing side-loading. Just don't allow apps, web pages, etc etc to opt-in for you to ensure the technically non-adept have a difficult time getting themselves into trouble.
        Nullabillity 10y ago
        Which is already the case...?