I have recently been doing some security evaluation work on our Android applications, by proxying all the communication through Burp Suite.

I noticed one of our devices was sending requests to a domain I did not recognise, one that is registered in China. It turns out the application sending these requests is a file manager app that came pre-installed on the device (cheap Chinese tablet).

It mostly seems to send requests when the application is in use, though occasionally appears to send requests in the background too. The app doesn't display adds or related content so it isn't that, also when it does load content such as help, it comes from a different domain. My suspicion is it is posting some sort of tracking or snooping data.

I am obviously concerned and curious as to what data this application is sending but I am struggling to work out the payloads. The headers do not indicate a content type, I have used all of the decoders in Burp Suite to no avail. Firstly I considered binary and gzip but I end up with the same data, I've also attempted to convert the data to Chinese with zero success.

If anyone can shed any light on my next steps to decoding this request content, that would be much appreciated.

Here's the request / response screenshots

Initial request - enter image description here

Changed encoding to form: enter image description here

Run through the decoder: enter image description here

The response is always the same enter image description here

  • I think it is not encoded but is encrypted, you can perform reverse engineering of the application to confirm the same. – Shiv Sahni Feb 22 '18 at 17:36
  • While this doesn't help decode / decrypt the message, one valuable piece of information might be a "whois" on the website. You may also want to block traffic to and from the website and see if anything "breaks". I certainly wouldn't use this device for anything important (other than researching the likely malware). – Jonathan Feb 22 '18 at 21:24
  • 1
    That is a good point @jonathan , I did this by dropping the request in burp rather than forwarding it. There was no apparent change in functionality. I guess this proves it is not required for the app to function and it makes me more suspicious that is tracking activity. – iainpb Feb 22 '18 at 22:30

Yes, this is malware. Or 'Spyware', depending on which book on the subject you last read and which side of the bed you got out of this-morning. Your question piqued my interest when i saw that i've actually seen the same domain while looking at another app myself. I thought it seemed unlikely we were alone, so i google'd it and found this:

The Airbnb Android App contains Spyware.

Based on this post we can assume that the suspect-at-best code now uses a secret key to encrypt data rather than gzip it.

I think its most likely that this is code that has made its way into some popular library/framework for the purposes of gathering statistical information about users/devices, or that it's part of another ad-platform library. Regardless, the term 'spyware' still fits. This data harvesting is clearly going far beyond what the app has a legitimate purpose for, and neither the Android or iOS ecosystems are particularly friendly to this sort of thing.

The subdomain even has a pretty big malware ring to it. 'infoc2'... as in C2... as in Command and Control.

I recommend emailing the company behind the app, they might not know what is going on here and they might thank you. If it was legitimately added, you might scare them into removing it. And if you don't get a response at all i would report the developers to Android/Google.

I you are still keen to get the plaintext of the payload, i would suggest decompiling the app and looking at its strings, you might get lucky and find the key. Without knowing the encryption scheme you would have to loop over a bunch of them in a script and just brute-force it. However, my hunch would be that the developers of this have probably rolled their own basic crypto, in which case you would need to reverse engineer this function from the binary or attempt to force the app to bypass it with dynamic runtime modifications so that requests contained plaintext (look at a framework called 'Substrate' for this).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.