Slashdot Mirror
Delivering Malicious Android Apps Hidden In Image Files
An anonymous reader writes "Researchers have found a way to deliver a malicious app to Android users by hiding it into what seems to be an encrypted image file, which is then delivered via a legitimate, seemingly innocuous wrapper app. Fortinet malware researcher Axelle Apvrille and reverse engineer Ange Albertini created a custom tool they dubbed AngeCryption, which allows them to encrypt the payload Android application package (APK) and make it look like an image (PNG, JPG) file . They also had to create another APK that carries the "booby-trapped" image file and which can decrypt it to unveil the malicious APK file and install it. A malicious app thusly encrypted is nearly invisible to reverse engineers, and possibly even to AV solutions and Google's Android Bouncer." (Here's the original paper, from researchers Axelle Apvrille and Ange Albertini.)
Android really is the Windows of phones. Open, free, and on lots of different devices, but also fragmented and vulnerable to malware.
Derp.
Two crypto researchers whose first and last names all start with the letter "A"?
who sell another DISCUSSION I'M FreeBSD's time wholesome and driven out by the mod points and is the ultimate I7 *BSD is to antibacterial soap. cycle; take a
This is just a really fancy way of clicking on an apk. So you install Foosball 2020 and click the app launcher icon and then your phone says "sorry, you need to enable installing 3rd party apps, bye!" and you say "damn you android! I want to play foosball with robots!" so you go through system settings and enable 3rd party installations and get a big warning. Then you open the app launcher icon again and instead of a game, you see a whole new installation screen for another app and the permissions it requires ...
I think from a technical standpoint, this is really neat research, but there are much simpler ways to lead the cattle to the salt lick.
Can we please erase this aggravating nonsense word from the planet?
Windows phones did not carry your credit card information nor did they have your google wallet password.
Some drink at the fountain of knowledge. Others just gargle.
So I'm going to install an app which is used to open a picture I don't know the origin of and which has been tampered with to append a second app, and if the first app opens the "picture" of choice it then installs another app which triggers a permission request (which they say they can work around).
I'd say this is implausible, but between porn and LOLcats there are going to be some unsuspecting idiots out there who might actually get caught.
Is it just my observation, or are there way too many stupid people in the world?
yeah it's fucking stupid fucking stupid fucking stupid
FUCKING STUPID TO THE EXTREME!
that the included APK is hidden inside the png is totally TOTALLY irrelevant. it could be ANY kind of file that it is in. heck, just "thisisthemaliciousapkinrot8.apk" would do it.
also, does it somehow silently install the malicious apk? on phones where untrusted sources is unchecked? that would be the interesting bit, so I guess no. it would be the main bit of their program, not the irrelevant png wooooo encryption nonsense shit. they could just download the malicious apk too. or open a browser to go the malicious apps url and hope that the user installs it.
I mean fuck, there's dozens of ways to hide malicious code that even gets run in android without this. do the authors even understand how impossible it is for the automatic scans to check for every custom "malicious" code there is? it just checks for pre configured signatures on files ffs. their new malicious code would have gotten through just as included class files, nevermind as included .so files,nevermind as included linux executables(old way to do native parts without ndk).
now, let's get back to talking about host files.
world was created 5 seconds before this post as it is.
So what I really gather from this is encrypted apps can't be check, scan or searched for what the contents hold? Really?
And seriously, hiding a payload inside something else isn't new, that's been around for decades at least.
So in other words, don't install apps I have no idea where they come from? Sounds good to me.
Be seeing you...
#1 You'd have to give the first app permissions to install an APK (no apps on Google Play can do this)
#2 The user would be prompted to install the new APK (you could try to trick them its an update)
Regardless, let's say your attack vector is Amazon Appstore (i don't know if they even bother with security); you could have done the same thing by just encrypting the APK and sending it as a byte stream to the 1st app.
> And seriously, hiding a payload inside something else isn't new, that's been around for decades at least.
*cough* trojans *cough*
decades you say?
Once upon a time, if you wanted to view an image, you launched your OSs (or some other trusted) image viewer with that image as an argument. If it turned out not to be an image, it wouldn't display, because the image viewer only understood some image formats, and wouldn't execute arbitrary code.
But in the quest to dumb everything down, it was decided that expecting people to understand they should use an image viewer on an image was too much to ask. Instead, we had to make it so simply clicking or pressing the image would view it. And this opened the door for a common attack on windows, android, and other environments. The thing could now just CLAIM to be an image, but really it's an executable that's gonna pwn your box.
The less we expect people to understand, the easier it is to exploit them.
Windows phones did not carry your credit card information nor did they have your google wallet password.
Sure they do. First result from Google windows phone password manager
where's the news in this?
they re-invented the concept of trojans?
if there was way to exploit existing software with custom image this would be just another exploit-hole to close.
this isn't even that if the trojan is needed in the first place to unpack and run the actual exploit..
I don't get why they think people would believe they need to open some random app just to view an image...
Or maybe I underestimate the stupidity of people..
300 decades is still decades...
I read Anonymous Coward's comment as complaining that Windows, X11 desktop environments, and Android have the "associate the file format with the viewer" feature in the first place. AC wants the user to have to remember the name of the viewer.
Woosh.
You pointed to a click bait article reviewing third-party apps for people who want to make their windows phone carry credit card info, something Google does right out of the box.
Google (like Apple), wants your credit card info for the play store and for tracking. They also want to push you towards their Google Wallet service. It is built into the operating system itself.
They have been using similar techniques to hide maleware on desktops for many years. On a desktop it's as simple as hiding the encrypted payload in the rousources of a loader application which injects into another process. The only difference is that someone decided to change the platform the attack takes place on.
My laptop came with Window 8, which has a radically different interface
You could always install Classic Shell, an aftermarket launcher for Windows, to put the S back in Window 8.1 and give you an interface that's closer to Windows 7. Android likewise has aftermarket launchers.
of course I pulled out the HDD, installed an SSD and put Linux on it
Which is like installing a custom ROM on an Android device: there's ABSOLUTELY NO WARRANTY that all peripherals will be supported. I still haven't got my laptop's Bluetooth working in Xubuntu.
Oh, and there's 32-bit and 64-bit
And ARM vs. MIPS vs. Atom.
and Home and Pro and Basic and Ultimate and...
That's more a matter of which OS component repositories you're allowed to access than actual OS fragmentation.
Google (like Apple), wants your credit card info for the play store
Is it really any different from ways to pay for purchases on Windows Phone Store?
So they've "invented" Steganography?
Android will ALWAYS ask you if you want to install an .apk, no matter how it is disguised. If you click a link, or visit a website, and it pops up asking you if you want to install, CLICK NO! Simple.
Only idiots get malware on current versions of Android these days. They are either trying to get free porn, music, games or movies. Pay for the content you consume, and don't be an idiot and install random .apk files, and you will never, ever have an issue.
Because that is putting time and effort into developing features to support competitors.
Canonical put time and effort into the Personal Package Archive system, which supports competitors to the official Ubuntu repository. Each PPA is a Debian repository with a public key to verify packages, and a Canonical-managed PKI ties them together. True, a lot of that comes from the Debian project, but Canonical still polished it into PPAs starting in Ubuntu 9.10.
You don't say! Everyone knows you just need a good HOSTS file to block APK.
Can this circumvent permissions of the calling app? If not, this is just another demonstration that arbitrary turing-complete code can not be automatically validated. One can also load Javascript into a WebView and enable it to execute arbitrary Java code through a reflection-based bridge. I am not sure what is the proposed solution.
Apk made a good app to build hosts files to protect users from online threats here http://start64.com/index.php?o... that gets its data for custom hosts creation from 12 reputable security community sites that do so. Have you personally done more or better to help the online community than apk has or are you just another ac troll that can't prove his points wrong on hosts files? I'm wagering the latter in your case.
This is the stupidest thing I've read in a long time.
Step 1: Create a really evil program.
Step 2: Encrypt it so it wont be detected... and wont run.
Step 3: Create another evil program that can decrypt other evil applications and run them.
Step 4: Get idiot to install second evil application.
This is so stupid it hurts my head. Can I make slashdot if I encode a malicious application to look like an MP3 and create another application to run it?
Windows is at least as fragmented as Android.
Look, I don't like Microsoft any more than most people here but that's just nonsense. You can grind you ax against Microsoft in plenty of ways that don't require making stuff up. It's not like there isn't anything legitimate to criticize about Windows. Your "evidence" that Windows is fragmented involves versions of Windows that were released over 10 years apart. That's not fragmentation - that's just normal development. The fact that Microsoft sells several versions that release different features depending on your license code isn't fragmentation - that's just price discrimination. Microsoft only sells a relatively small number of versions at any given time - FAR less than the number of Android versions available for sale.
There are dozens if not hundreds of companies selling highly customized versions of Android. Want to upgrade to Google's latest code? On most devices you are out of luck unless you want to go to the hassle of jailbreaking. There are even info graphics detailing Android's problems with a horde of different versions and makers.
and now go and read some books before you announce the next "big" thing.
Come on, the blackhat community is a whole lot of fee mongering go get headlines... hence the slashdot rep... This is why I am sick of security researchers... its like the boy who cried wolf... all the time.