Skip to main content

Don't use that APK site!

 A whileback, Brock and I were impatiently waiting for WiGLE's beta app update. It was was WiGLE just added bluetooth to their platform and it was a big move for us (was that like, 2 years ago?). I went to get the app from WiGLE, but Brock simply google'd the app and downloaded it. I was unsure how this page was already a google result, and he showed me he downloaded it from another apk site. When I objected, he didn't understand. I explained the dangers Rogue Apps present, but also, I then downloaded it anyway to see if my concerns were justified on an old-lab-phone. 

Rogue applications are those which are not created and published by the developer. In general, rogue apps are an Android centered issues (and FireOS - ketchup; fancy ketchup). Back in 2018, RSA published a white paper in which 28% of online fraud were rogue apps, and has seen a 300% surge in 2019. 

Before discussing what's wrong with rogue apps, let's use an example:

Instagram's legitimate Android app: 

  • https://play.google.com/store/apps/details?id=com.instagram.android&hl=en_US

Instagram rogue apps - for the sake of my argument I made sure I linked ones that as of Aug 13th were all the same version 153.0.0.34.96

  • https://instagram.en.uptodown.com/android/download
  • https://apkpure.com/instagram/com.instagram.android/variant/153.0.0.34.96-APK
  • https://www.apkmirror.com/apk/instagram/instagram-instagram/instagram-instagram-153-0-0-34-96-release/instagram-153-0-0-34-96-android-apk-download/download/
  • https://www.androidapksbox.com/apk/instagram-153-0-0-34-96-236572319-old-apk/
    • this website even has the verified hashes published, but we'll get back to that
      • published MD5: eda1e31e06ef33befe363baf4d933712
      • actual MD5 hash of file downloaded: AF63391C984586B94C0628E9110EB0B1
      • published SHA-1: 554405e32a708c29adbd04b8a3914c255380ba79
      • actual SHA-1 hash of file downloaded: 8BF651DA9CE9A052C52A38F7DE978C4C13935221
What's wrong with Rogue Apps:

  1. The app has been modified since the developers' publication. I assume - if this was an desktop application people would take it more seriously. But for some reason, the risk of having an app with privileged access to your device does not trouble many people. 
    I'm not sure why the apk site in the fourth example above published the hashes of the legitimate application, when their hashes would not match? I'm sure it's to give a false sense of security on the site, suspecting that no one would actually checking the hashes. 
    • Future research on this can be done by reverse engineering the app. 
  2. Many times, these apk sites add ads on top of the app to make money for themselves. As mentioned, I downloaded an apk and an add occurs every time I relaunch the app, or after keeping the app up on my screen for extended periods of time. The advertisements are making the apk sites money - that's why there are so many different apk sites. These sites simply mirror the original app, add their own content, and make the modified app the one for download. 
    1. Personally, I find advertising to be annoying, although that's not a malicious interaction. Why have an app with ads, when the legitimate app does not? 
    2. Someone else is making ad profit off others' work. Of course, this is copyright infringement against the legitimate app developer. While content theft is wrong, I find it extra venomous that the apk site makes money of the legitimate developers' work. 
    3. Malvertising. The ad services the apk sites use are bottom of the barrel, common ads. The barrier for entry to advertise with these services is very low, and it's very easy to slip in malicious advertising. 
  3. Worse case scenario, it's phishing. The first two objections are almost always present when downloading from apk sites or other sources of rogue apps. Of course, that would lead to pharming that data out on forums and markets which trade credentials and identities. The idea that "I don't have any money to steal, whatever" is a little bit toxic because more often than not, it is your credentials, personal information, and identity that is being stolen, not your money. Of course, we can lump in all forms of malware under this section as well. Mobile malware is more common than you think, my absolute favorite is the Cerberus Android malware (but more on that later). 

anyway, just wait for the update on Google Play.

Labels:

Comments

Post a Comment

Popular posts from this blog

How to program a NTAG215 NFC Tag

Hi! Did you just acquire a NTAG215 NFC tag? Very cool. Maybe you scanned it and it brought you here. Here's how to edit the content on the tag to make it do what you want.  Easy Steps Download an NFC writing app on a smartphone like this one for Android or this one for iPhone. I assume you might have this app already if you're reading this tag. Done Decide what type of data you want to save. If you picked up more than one of the NFC tags, you may have a variety of data saved to them like the ones below: Plain text URL/URI Link to a search Social networks Video File Application Mail Contact Phone number SMS Location Address Proximity search Street View Emergency info Bitcoin address Bluetooth connection WiFi network settings other custom fields Make sure if you select the correct format to make it easier to scan, save the write data, and re-scan the tag. Switch back to the read function and test your tag! Next Method The above method doesn't cover making everything, such a...
Post a Comment
Read more

Phishing Kits

Let's make a phishing attack (just kidding). The easiest way to do so is obtaining a pre-made phishing kit. Phishing kits represent a significant and growing danger. These tools, readily available in the darker corners of the internet, empower even technically unsophisticated criminals to launch effective phishing campaigns. This post aims to demystify phishing kits, explore their dangers, and provide practical advice on safeguarding against these insidious threats.  Phishing kits are pre-packaged sets of tools and resources designed to facilitate phishing attacks. The parts of a phishing kit can be broken down into the following components: Email templates Webpage clones (usually scraped from the legit site) Scripts and code repositories  Hosting Platforms Delivery Systems Readme & docs Premium services Real-time data analysis tools Customer service* Social engineering tools These kits are designed for ease of use, allowing attackers to launch phishing campaigns with mini...
Post a Comment
Read more

Anti-Phishing Working Group Report from Q2 2023

 The Anti-Phishing Working Group (APWG) is an international coalition focused on unifying the global response to cybercrime, particularly phishing and e-mail fraud. Established in 2003, APWG brings together businesses, government entities, law enforcement, and non-governmental organizations to combat phishing, crimeware, and e-mail spoofing.They create regular reports on the nature of phishing "in the wild" and share trends in this report. You can download the report here .  I wanted to report on a more recent trend report, but at the time of writing I haven't seen a newer one. It being in the middle of 2023, I believe the report is recent enough.  I found a few areas of interest, and questioned a few pieces. There was a reported downward trend in phishing. Despite the high numbers, there was a notable downward trend in phishing by the end of the quarter, indicating a possible shift in tactics or improved countermeasures. I have doubt that phishing is occurring less,...
Post a Comment
Read more