0

Today I visited my favorite news outlet using Firefox on my Android and suddenly I got malicious .apk file downloaded to my phone. Of course, I immediately reported the incident to the site owner.

While the site owner didn't fix the issue, what can I do to understand the attack more thoroughly? I don't have any control over the site.

I skimmed through the source of the main page but failed to find malicious JS. I plan to look at the .apk file itself after the issue is fixed, but for now I want to focus on the site.

BTW, I connect to the site over https.

  • You can start with any proxy-intercept tool like BurpSuite where you can see all the request that are hitting the server from your phone and what response the server is sending – one Jul 18 '16 at 8:30
  • use [F12]>network (w/ remote debugging if on mobile) to see all the http traffic that the page causes. – dandavis Jul 18 '16 at 13:34
0

This stuff usually happens not because of malicious scripts but because the ad provider has ads with malicious content. Contacting the site owner will only make him aware but since he probably still wants to display ads he will not do anything about it.

What can you do?

  1. Contact the ad provider and tell them they have malicious ads (Maybe they don't know?)

  2. Download a Firefox Android ad blocker extension to block these in the future (You can browse through the extensions here).

  • Thank you for the hint about ad provider now I want to determine which one is it. News sites have a lot of them. – Pavel Vergeev Jul 18 '16 at 8:38
  • I think he wants to analyze the attack that how and from where it got downloaded? He isn't looking for a remedial action. – one Jul 18 '16 at 8:38
  • @PaulVergeev For that you can set up a proxy and look at the requests. I suggest this app: play.google.com/store/apps/… – Bubble Hacker Jul 18 '16 at 8:41
  • @BubbleHacker wow virus was in one of the Google ads. Reported. – Pavel Vergeev Jul 18 '16 at 8:50
  • I think the last stap is simple. You have to whois the domain/ip the download came from. If you whois far enough you will find a link to an ad company probably. This is how I usually try to find persons associcated with malware. The world doesn't hide itself well on the internet yet. – Adam Sitemap Jul 18 '16 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.