2

I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features:

  1. The file contained Swf.Exploit.CVE_2015_0323-1
  2. It required android.permission.INTERNET (full Internet access)
  3. It contained an ELF file.

Other than that, interesting strings found in the file were following:

http://airdownload2.adobe.com/air?
https://www.adobe.com/airgames/5/
https://www.adobe.com/airgames/4/
http://s3-us-west-1.amazonaws.com/gamepreview/prod/airandroid/air.properties
http://www.adobe.com/airgames/3/
https://www.adobe.com/gamepreview/?game=notification/notificationClicked.html_
http://gamespace.adobe.com
https://dh8vjmvwgc27o.cloudfront.net
http://dh8vjmvwgc27o.cloudfront.net/AIRGamepad/connect_ping.txt
http://dh8vjmvwgc27o.cloudfront.net/AIRGamepad/connect_ping.txt?publisher=

National Vulnerability Database defines the SWF Exploit detected as:

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0327.

McAfee further explains:

The files are highly obfuscated and won't run as they are since they are part of an infection chain created by Angler when the user access a web page compromised by it (known as "landing page")

The big string passed as parameter to the page is a Base-64 encoded data, which is converted to the string below:

Subject=Ping&key=AFC095B821F238B75D827C52804B8C907BC1E546ED8FF102104C4A106

I can see a weird link of Cloud front and a connect_ping.txt file present there. If I use the app without internet on, should I be okay?

The other suspicious thing is why does the app want full internet access since it does not need it at all? It is just an offline game. The strings make me think that it requires access to display ads and notify about clicks.

ELF file is something I am not quite certain. It maybe a framework. But what if it is being used as a Malware?

TL;DR, Should I install the app? If that is off-topic, I would be grateful to get a more detailed view of the mentioned exploits in order to make a decision.

My Device is SGH-T999L running Android 4.3.

PS: Out of 56 different sources, Only ClamAV detected the SWF exploit. All others did not detect anything. So it might be a false positive. I used Virus-Total.com scan.

Also Adobe did release security patches to counter this exploit, if it makes any difference.

1 Answer 1

3

You should NOT.

First, you don't know if the file is trustable, you got it from some "source". It is never advisable to install APKs from untrustworthy sources, especially on your primary device.

Second, it contains a known vulnerability.

Third, it is an offline game, and it requires full internet connection(it may be because of ads, but you never know what all it is transmitting and receiving).

Fourth, you have a pretty much old version of Android, and it is not up to date with all the security patches.

UPDATE: If the app has permission for writing/modifying files on your device's storage, the files might remain even after uninstallation of the app.

7
  • As McAfee explains that this exploit can not work until landing page is accessed, If I were to turn my internet off during the time I install, play and delete this app, Would I be safe?
    – NSNoob
    May 24, 2016 at 8:55
  • Well, the safety of the app depends on the permissions as well. Does it require some other permission like calling, access to camera/mic, modifying or deleting contacts, or the like? If yes, it could also play around with your data without an internet connection. It might leave junk/malicious files in your phone's storage. It might also be the case that some malicious code went undetected from AVs... Also, though this is unlikely, it might make use of some unpatched vulnerability in your version of Android
    – pri
    May 24, 2016 at 9:28
  • If you really want to install and try that app, you might think about installing it on some non-primary device, with no internet access, and then uninstall it, so that even if it wreaks havoc with data, you do not get affected
    – pri
    May 24, 2016 at 9:30
  • no It requires only two permission. Full internet access & writing for saving game state. I was thinking about installing it into some Android emulator like Blue Stack or something with wi-fi turned on seeing as I don't really want such an app in my phone. Will it protect me?
    – NSNoob
    May 24, 2016 at 9:47
  • It says that it requires writing for game state. How can you be sure that it is going to write only game state and nothing else? Testing apps for malicious activity in isolated sandboxes/emulators is a good way. Make sure that it is isolated...
    – pri
    May 24, 2016 at 10:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .