0

Today I visited my favorite news outlet using Firefox on my Android and suddenly I got malicious .apk file downloaded to my phone. Of course, I immediately reported the incident to the site owner.

While the site owner didn't fix the issue, what can I do to understand the attack more thoroughly? I don't have any control over the site.

I skimmed through the source of the main page but failed to find malicious JS. I plan to look at the .apk file itself after the issue is fixed, but for now I want to focus on the site.

BTW, I connect to the site over https.

Improve this question
2
  • You can start with any proxy-intercept tool like BurpSuite where you can see all the request that are hitting the server from your phone and what response the server is sending
    – one
    Jul 18, 2016 at 8:30
  • use [F12]>network (w/ remote debugging if on mobile) to see all the http traffic that the page causes.
    – dandavis
    Jul 18, 2016 at 13:34

1 Answer 1

Reset to default
0

This stuff usually happens not because of malicious scripts but because the ad provider has ads with malicious content. Contacting the site owner will only make him aware but since he probably still wants to display ads he will not do anything about it.

What can you do?

  1. Contact the ad provider and tell them they have malicious ads (Maybe they don't know?)

  2. Download a Firefox Android ad blocker extension to block these in the future (You can browse through the extensions here).

Improve this answer
5
  • Thank you for the hint about ad provider now I want to determine which one is it. News sites have a lot of them.
    – Pavel Vergeev
    Jul 18, 2016 at 8:38
  • 1
    I think he wants to analyze the attack that how and from where it got downloaded? He isn't looking for a remedial action.
    – one
    Jul 18, 2016 at 8:38
  • @PaulVergeev For that you can set up a proxy and look at the requests. I suggest this app: play.google.com/store/apps/…
    – Bubble Hacker
    Jul 18, 2016 at 8:41
  • @BubbleHacker wow virus was in one of the Google ads. Reported.
    – Pavel Vergeev
    Jul 18, 2016 at 8:50
  • 1
    I think the last stap is simple. You have to whois the domain/ip the download came from. If you whois far enough you will find a link to an ad company probably. This is how I usually try to find persons associcated with malware. The world doesn't hide itself well on the internet yet.
    – Adam Sitemap
    Jul 18, 2016 at 9:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .