Timeline for Which functions should I hook to check if the app contains malicious code or use deprecated methods?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 9, 2018 at 14:18 | answer | added | user182148 | timeline score: 1 | |
| Nov 13, 2016 at 0:43 | history | edited | noobsharp | CC BY-SA 3.0 |
added 1 character in body
|
| Nov 13, 2016 at 0:42 | comment | added | CommonsWare |
Well, you could look at the deprecated methods on ActivityManager, such as getRecentTasks() and getRunningTasks(). While those have some nominally valid uses, they were deprecated in Android 5.0 and dumbed down, as malware was using them to identify the foreground app. Many times, if the method is not only deprecated but described to have changed its behavior, as is the case for those two, the deprecation and changes were made for security reasons.
|
|
| Nov 13, 2016 at 0:41 | history | edited | noobsharp | CC BY-SA 3.0 |
added 213 characters in body
|
| Nov 13, 2016 at 0:39 | comment | added | noobsharp | @CommonsWare Interesting. Could you suggest a good starting point (e.g. any known case of deprecated classes or methods for security reasons or possible area of interest)? | |
| Nov 13, 2016 at 0:10 | comment | added | CommonsWare | "some of them could have been deprecated for security reasons?" -- agreed. If you want to cook up a list of deprecated stuff, and try to sift through that to determine what is and is not security-related, you are welcome to do so. That's going to be a lot of work. | |
| Nov 13, 2016 at 0:06 | comment | added | André Borie | @BranStark looking at the actual traffic (and tampering with it to make sure the app implements crypto correctly. | |
| Nov 13, 2016 at 0:04 | comment | added | noobsharp | @AndréBorie You're right. What would be a correct way to separate http from https connections? | |
| Nov 13, 2016 at 0:04 | comment | added | noobsharp | @CommonsWare Sounds legit. What would you suggest instead? Would you avoid dealing with deprecated methods at all? Maybe not all of them, but some of them could have been deprecated for security reasons? | |
| Nov 12, 2016 at 23:58 | comment | added | André Borie | detect connections that use http (80) instead of https (443) you can perfectly run an HTTP (not Secure) server on port 443. The port alone doesn't mean anything. | |
| Nov 12, 2016 at 23:48 | comment | added | CommonsWare | "Would you agree with this?" -- absolutely not. The vast majority of deprecated classes and methods have no security ramifications whatsoever. Using them is typically necessary for backwards compatibility. Blindly flagging all deprecated methods will give you so many false positives that it will make your head spin. "Same thing for weak encryption API" -- MD5 is not encryption, and simply using MD5 is not indicative of a security problem. It depends on what the hash is being used for. | |
| Nov 12, 2016 at 23:42 | review | First posts | |||
| Nov 13, 2016 at 3:46 | |||||
| Nov 12, 2016 at 23:41 | history | asked | noobsharp | CC BY-SA 3.0 |