How to Detect if my Android Phone Came With Pre-Installed Malware?

Question

I noticed my android is attempting to run tasks that I haven't authorized and am not aware of. When I factory reset this device, it attempts to open what I believe is some sort of malware. If there's no internet connection, it just loads a transparent screen. It remains this way until I kill the "app".

Is there any way to check if this is malware/adware, or if it has sent off any sensitive data? What tools would allow me to do this? (If I can get into it's apk binary with any tool built into Kali Linux that would be great).

I've tried to disconnect all of my devices from the network and listen to sent/received packets with Wireshark, but still can't see whatever it is, due to play_store connection, and so on.. :(

Thank you, LeFizzy.

Answer 1

Setting up a proxy to view network traffic

Is there any way to check if this is malware/adware, or if it has sent off any sensitive data? What tools would allow me to do this?

You can set up a proxy on your computer and set it on your phone, so you can see all the connections from and to your phone. OWASP ZAP is one possibility, and it's free. Download, install and start it. Then go to Tools > Options and select Local proxy on the left. Set the address to your computers internal network IP (usually 192.168.x.x or 10.x.x.x). Make sure your phone will be connected to the same network as your computer. Note the port (by default it is 8080, you can leave it this way). Click OK.

Now on your phone set this as a proxy. In your phone it might be different, but in my phone (Android 4.4) if I go to the wifi settings and click on the connected wifi it opens up the Network details page, scroll down and there is Proxy. Set it to Manual, then set the Hostname to your computer's IP (the one you used before) and the Port to 8080 (or if you have changed it, use that one). You can leave the Bypass for field empty.

From now on you will see all the http connections from your phone toward the internet in ZAP. To also see encrypted https traffic, you will need to add ZAP's root certificate to the phone's local certificate storage. To do this first go to ZAP, Tools, Options again and select Dynamic SSL Certificates. Click save and copy it to your phone's SD card. Then on your phone go to Settings, Additional settings, Privacy, Credential storage, Install from SD card, select the certificate file and add it. Please note, that your phone might have a different settings structure, so you need to search for Credential storage, most likely under Privacy or Security.

Now ZAP will also display your https traffic (unless certificate pinning was used by the app designer). ZAP will group the traffic by domain, so you can see what else your phone is doing apart from Google Play Services and alike.

Get the list of installed applications and their apk file

If I can get into it's apk binary with any tool built into Kali Linux that would be great

Install adb

To get the apk file you can use the android debug bridge, adb. It is not preinstalled on kali, but you can easily install it. Based on this tutorial all you need to do is to run:

sudo add-apt-repository ppa:phablet-team/tools && sudo apt-get update 

and

sudo apt-get install android-tools-adb

Setup your device driver(might be optional)

The next step is probably not necessary under kali, but under Ubuntu you need to do the followings:

Create an empty file in the /etc/udev/rules.d/ directory with the following name:

If you’re using the Ubuntu version Gusty/Hardy/Dapper, create the file with the name 50-android.rules. Execute the following command to do so:

sudo gedit /etc/udev/rules.d/50-android.rules

If you’re using the Ubuntu version Karmic Koala/Lucid Lynx/Maverick Meerkat, create the file with the name 70-android.rules. Execute the following command to do so:

sudo gedit /etc/udev/rules.d/70-android.rules

Type the following content in the editor and save it.

For Gusty/Hardy: SUBSYSTEM==”usb”, SYSFS{idVendor}==”USB-VENDOR-ID”, MODE=”0666″
For Dapper: SUBSYSTEM==”usb_device”, SYSFS{idVendor}==”USB-VENDOR-ID”, MODE=”0666″
For Karmic Koala: SUBSYSTEM==”usb”, SYSFS{idVendor}==”USB-VENDOR-ID”, MODE=”0666″
For Lucid Lynx: SUBSYSTEM==”usb”, SYSFS{idVendor}==”USB-VENDOR-ID”, MODE=”0666″
For Maverick Meerkat: SUBSYSTEM==”usb”, ATTR{idVendor}==”USB-VENDOR-ID”, MODE=”0666″ 

Source and vendor id here.

Enable USB debugging on the phone

This step is also for kali again: On your phone enable USB debugging in the Settings under Developer options. In Android 4.2.x and up Developer Options is hidden by default, to make it visible, tap seven times the Build Number (Settings > About Phone > Build Number), and developer options will appear.

Get the list of applications and the apk files

Now connect your phone to your computer via USB, and you can get the apk file with adb commands (as explained here):

1) Determine the package name of the app, e.g. "com.example.someapp".

adb shell pm list packages

2) Get the full path name of the APK file for the desired package.

adb shell pm path com.example.someapp

The output will look something like this: package:/data/app/com.example.someapp-2.apk

3) Pull the APK file from the Android device to the development box.

adb pull /data/app/com.example.someapp-2.apk path/to/desired/destination/on/your/computer