Skip to main content

Don't use that APK site!

 A whileback, Brock and I were impatiently waiting for WiGLE's beta app update. It was was WiGLE just added bluetooth to their platform and it was a big move for us (was that like, 2 years ago?). I went to get the app from WiGLE, but Brock simply google'd the app and downloaded it. I was unsure how this page was already a google result, and he showed me he downloaded it from another apk site. When I objected, he didn't understand. I explained the dangers Rogue Apps present, but also, I then downloaded it anyway to see if my concerns were justified on an old-lab-phone. 

Rogue applications are those which are not created and published by the developer. In general, rogue apps are an Android centered issues (and FireOS - ketchup; fancy ketchup). Back in 2018, RSA published a white paper in which 28% of online fraud were rogue apps, and has seen a 300% surge in 2019. 

Before discussing what's wrong with rogue apps, let's use an example:

Instagram's legitimate Android app: 

  • https://play.google.com/store/apps/details?id=com.instagram.android&hl=en_US

Instagram rogue apps - for the sake of my argument I made sure I linked ones that as of Aug 13th were all the same version 153.0.0.34.96

  • https://instagram.en.uptodown.com/android/download
  • https://apkpure.com/instagram/com.instagram.android/variant/153.0.0.34.96-APK
  • https://www.apkmirror.com/apk/instagram/instagram-instagram/instagram-instagram-153-0-0-34-96-release/instagram-153-0-0-34-96-android-apk-download/download/
  • https://www.androidapksbox.com/apk/instagram-153-0-0-34-96-236572319-old-apk/
    • this website even has the verified hashes published, but we'll get back to that
      • published MD5: eda1e31e06ef33befe363baf4d933712
      • actual MD5 hash of file downloaded: AF63391C984586B94C0628E9110EB0B1
      • published SHA-1: 554405e32a708c29adbd04b8a3914c255380ba79
      • actual SHA-1 hash of file downloaded: 8BF651DA9CE9A052C52A38F7DE978C4C13935221
What's wrong with Rogue Apps:

  1. The app has been modified since the developers' publication. I assume - if this was an desktop application people would take it more seriously. But for some reason, the risk of having an app with privileged access to your device does not trouble many people
    I'm not sure why the apk site in the fourth example above published the hashes of the legitimate application, when their hashes would not match? I'm sure it's to give a false sense of security on the site, suspecting that no one would actually checking the hashes. 
    • Future research on this can be done by reverse engineering the app. 
  2. Many times, these apk sites add ads on top of the app to make money for themselves. As mentioned, I downloaded an apk and an add occurs every time I relaunch the app, or after keeping the app up on my screen for extended periods of time. The advertisements are making the apk sites money - that's why there are so many different apk sites. These sites simply mirror the original app, add their own content, and make the modified app the one for download. 
    1. Personally, I find advertising to be annoying, although that's not a malicious interaction. Why have an app with ads, when the legitimate app does not? 
    2. Someone else is making ad profit off others' work. Of course, this is copyright infringement against the legitimate app developer. While content theft is wrong, I find it extra venomous that the apk site makes money of the legitimate developers' work. 
    3. Malvertising. The ad services the apk sites use are bottom of the barrel, common ads. The barrier for entry to advertise with these services is very low, and it's very easy to slip in malicious advertising. 
  3. Worse case scenario, it's phishing. The first two objections are almost always present when downloading from apk sites or other sources of rogue apps. Of course, that would lead to pharming that data out on forums and markets which trade credentials and identities. The idea that "I don't have any money to steal, whatever" is a little bit toxic because more often than not, it is your credentials, personal information, and identity that is being stolen, not your money. Of course, we can lump in all forms of malware under this section as well. Mobile malware is more common than you think, my absolute favorite is the Cerberus Android malware (but more on that later). 

anyway, just wait for the update on Google Play.

Comments

Popular posts from this blog

2023 Resolutions

Welcome to my New Year's Resolutions! I feel a little vulnerable sharing my goals publicly and auditing if I failed or succeeded over the year.  My 2023 Resolutions 1) HACK THE PLANET! 2) Upload to WiGLE every month 3) Post to the blog at least once a month 4) Continue to follow and maintain my vision board. Don't judge me! I thought they were cheesy and weird, but it's been so effective. I made a blog post about it already, but just as a refresher my current board is below. A vision board is almost a resolution list in of itself. These are all the things I want to achieve in the near future.  5) Pass the HAM radio exam 6) Continue in content creation and make articles or a podcast Let's go over what my resolutions where last year: My 2022 Resolutions 1) Make it to 500,000 unique wifi networks I made it in November! I achieved this goal and obtained the gold WiGLE badge.  2) Upload to WiGLE every month I made this most months, but not every month. I will try again! 3) W

Remove data from Data Brokers

 If you have a little change from your tax return, I have a suggestion on where you should spend it this year. This is not sponsored, not an advertisement, and I do not benefit from these companies. I paid for these services out of pocket on my own. Okay. We all know how scary OSINT can be, being able to look up public information such as age and home address. We hand over this information readily when we use certain products and services. Some of this information is also kept at a criminal level, such as criminal record lookups.  That's not the only information we hand over, we are tracked and have our data collected every day through data brokers. They profit off of our identities selling it back to one another constantly.  There are services now that will automate the removal of your data from data brokers. I found Aura and Incogni when promoted online. Both of them had a referral code, but also a standard discount for an annual subscription instead of monthly. At the time of wr

#WardrivingWednesday

 I've attempted, with mixed results, to establish a hashtag on Mastodon on Wednesdays for wardriving. Why? Because I feel like it. There are so many awesome people in the wardriving space that could probably do it better, but I'm going to do it instead.  I cannot recall where I heard this general rule of thumb, but I believe it was Dragorn who said " For every adapter you can go about 10mph ". I wonder how true that is, and I wonder more how I would begin to test that theory. This is something I'd like to figure out, and will likely need some assistance.  I also plan on remaking my rigs with raspberry pi alternatives. Right now there is a lot of drama surrounding raspberry pi, but I'm doing it just because of the cost and supply issues. There are many alternatives now, and I'm sure they'll make a few rigs. I'll keep the updates posted under the hashtag on Wednesday. If you're interested in wardriving you should join the RF Sanctuary Discord.