Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was browsing some website last night and that website suddenly sent me an apk called 'browser_update_install.apk', DrWeb light detect it and was able to delete it.

My question here is about the apk itself, was there any incidents where apks are able to self execute and override permissions of 'install from unknown source'?

I've googled this topic but found nothing but speculations and guides about best practices.

Here is a picture of what was detected (DrWeb detection)

Thanks

Edit: forgot to say that the malware I'm talking about is at the bottom in case it wasn't obvious.

share|improve this question
    
As long as it is not installed, then you will be safe as it will not self execute and it will not be able to enable 'Unknown Sources'. –  wcypierre Feb 1 '13 at 16:17
    
Thanks for your answer, it's relief to know that things cannot happen silently like in Windows lol. –  Meldar Feb 1 '13 at 17:06
    
you're welcome :) Well, Android is made based on Linux, so of course it would inherit its characteristics(most if not all). Not all of the malware in Windows are self-triggered, although some are(Java driveby, autorun of virus through thumbdrive and etc). I guess that the rule of thumb is not to trust any files that you've downloaded from the Internet :) –  wcypierre Feb 1 '13 at 17:27

1 Answer 1

up vote 0 down vote accepted

I've seen an Android 2 Gingerbread PoC game app in which you were supposed to tap moving objects. The trick was that after tapping a few objects, the app would call the settings page where the "unknown sources" is. The next object to be tapped was right where the check box appeared so it would trick the user into tapping it. Then the game would focus on itself so the trick was barely noticeable.

Android 4 still allows apps to pop settings pages (the Maps app pops up the GPS settings screen) but it added a confirmation message for when you allow unknown sources. This confirmation message would still be vulnerable to the same trick but it would be more noticeable.

The name of the APK above suggests a social engineering trick to get the user to install the APK on a phone that hopefully has "Allow installation of non-Market apps" (aka "Unknown sources") setting checked. But a legitimate Play store app could trick a user into allowing unknown sources and then it could direct to a site similar to the one mentioned in this question.

This kind of blended attacks are real but don't cause large scale compromises worthy of media attention .... until they steal 36 million euros.

enter image description here

share|improve this answer
    
Even if the setting was enabled the user has to confirm the installation on Android. –  Ramhound Feb 1 '13 at 17:33
    
@Ramhound agreed. However, do note that there are users who will install these apps blindly on their phone without knowing the impact :) –  wcypierre Feb 1 '13 at 17:38
    
@wcypierre - You have to display the notifications bar and click on the package and confirm the installation package. –  Ramhound Feb 1 '13 at 17:43
    
@Ramhound I get what you mean. What I meant is that the user can be social engineered to install that app, saying that the app would give you benefits(like able to crack wifi passwords within seconds, hack facebook accounts, gmail accounts and etc) and the user will follow blindly what the app instructs. –  wcypierre Feb 1 '13 at 17:47
    
I did not click anything, what happened is I was googling something and entered a website, that website pushed the apk first time and then it kept pushing it until I denied the downloads, as far as clicking on messages nothing of that sort happened it just stayed in my downloads folder and DrWeb deleted it right away –  Meldar Feb 1 '13 at 18:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.