3 ms·

> Some time ago I As much as I'd like to believe this anecdote, more proof to back you up would be nice. It's becoming super easy to post weightless stories h

> Some time ago I As much as I'd like to believe this anecdote, more proof to back you up would be nice. It's becoming super easy to post weightless stories here similar to this one, and I'd like to see the (rough?) integrity of HN somewhat preserved a little longer.

codedokode 9y ago
Ok, I looked through old files and found the details. First, you need to get the file Uber_v3.86.5_apkpure.com.apk (Uber app) and decompile it. You can decompile a later version but I cannot guarantee that all the files are still there. In case you don't have decompiling tools around, I found that someone has uploaded files from the directory 'classes/com/baidu/' here: http://rgho.st/8WlHPJC8g http://rgho.st/8WlHPJC8g To find the code that scans WiFi networks, grep the files for getScanResults which is the method name from Android API. You will find a file classes/com/baidu/android/pushservice/util/l.java (and several other files). Someone posted this file here: https://pastebin.com/6cXv2itK https://pastebin.com/6cXv2itK If you look at the method public static String a(Context paramContext, String paramString) at line 114 you'll see that it gets WiFi scan results and then does something that looks like composing a POST request to https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/getzidwifiinfo https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/... (which doesn't resolve currently). I didn't have time to examine the code thoroughly. By the way, the code in a paper [1] mentions a shared property named "pst": SharedPreferences localSharedPreferences = paramContext.getSharedPreferences("pst", 0); If you search Uber sources for "pst", you'll find a file classes/com/baidu/frontia/a/d/b$b.java (here: https://pastebin.com/4zDp8dSz https://pastebin.com/4zDp8dSz ) that also uses this property: localObject1 = "pst"; ... localObject1 = paramContext.getSharedPreferences((String)localObject1, 0); You can also search for "push_sync", which was mentioned in the paper, and you'll find that several files contain this string: classes/com/baidu/android/pushservice/c/b.java classes/com/baidu/android/pushservice/PushLightapp.java classes/com/baidu/android/pushservice/PushManager.java classes/com/baidu/android/pushservice/util/i.java You can also search for other keywords, for example 'http' and you'll find interesting URLs like 'http://127.0.0.1:7777/native' http://127.0.0.1:7777/native'. Finally, you can search for getSubscriberId which is an Android API method that returns an IMSI and you'll also find several matches: classes/com/baidu/location/h/b.java classes/com/baidu/platform/comapi/util/f.java classes/com/baidu/vi/VDeviceAPI.java classes/com/baidu/android/pushservice/message/f.java [1] https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-paper-wild-android-collusions/ https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-p...
- craftyguy 9y ago
  Thank you for the in-depth analysis. I definitely learned a few tricks here!

codedokode 9y ago

Ok, I looked through old files and found the details. First, you need to get the file Uber_v3.86.5_apkpure.com.apk (Uber app) and decompile it. You can decompile a later version but I cannot guarantee that all the files are still there. In case you don't have decompiling tools around, I found that someone has uploaded files from the directory 'classes/com/baidu/' here: http://rgho.st/8WlHPJC8g http://rgho.st/8WlHPJC8g To find the code that scans WiFi networks, grep the files for getScanResults which is the method name from Android API. You will find a file classes/com/baidu/android/pushservice/util/l.java (and several other files). Someone posted this file here: https://pastebin.com/6cXv2itK https://pastebin.com/6cXv2itK If you look at the method public static String a(Context paramContext, String paramString) at line 114 you'll see that it gets WiFi scan results and then does something that looks like composing a POST request to https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/getzidwifiinfo https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/... (which doesn't resolve currently). I didn't have time to examine the code thoroughly. By the way, the code in a paper [1] mentions a shared property named "pst": SharedPreferences localSharedPreferences = paramContext.getSharedPreferences("pst", 0); If you search Uber sources for "pst", you'll find a file classes/com/baidu/frontia/a/d/b$b.java (here: https://pastebin.com/4zDp8dSz https://pastebin.com/4zDp8dSz ) that also uses this property: localObject1 = "pst"; ... localObject1 = paramContext.getSharedPreferences((String)localObject1, 0); You can also search for "push_sync", which was mentioned in the paper, and you'll find that several files contain this string: classes/com/baidu/android/pushservice/c/b.java classes/com/baidu/android/pushservice/PushLightapp.java classes/com/baidu/android/pushservice/PushManager.java classes/com/baidu/android/pushservice/util/i.java You can also search for other keywords, for example 'http' and you'll find interesting URLs like 'http://127.0.0.1:7777/native' http://127.0.0.1:7777/native'. Finally, you can search for getSubscriberId which is an Android API method that returns an IMSI and you'll also find several matches: classes/com/baidu/location/h/b.java classes/com/baidu/platform/comapi/util/f.java classes/com/baidu/vi/VDeviceAPI.java classes/com/baidu/android/pushservice/message/f.java [1] https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-paper-wild-android-collusions/ https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-p...

craftyguy 9y ago
Thank you for the in-depth analysis. I definitely learned a few tricks here!