I was browsing some website last night and that website suddenly sent me an apk called 'browser_update_install.apk', DrWeb light detect it and was able to delete it.

My question here is about the apk itself, was there any incidents where apks are able to self execute and override permissions of 'install from unknown source'?

I've googled this topic but found nothing but speculations and guides about best practices.

Here is a picture of what was detected (DrWeb detection)


Edit: forgot to say that the malware I'm talking about is at the bottom in case it wasn't obvious.

  • As long as it is not installed, then you will be safe as it will not self execute and it will not be able to enable 'Unknown Sources'.
    – wcypierre
    Feb 1 '13 at 16:17
  • Thanks for your answer, it's relief to know that things cannot happen silently like in Windows lol.
    – ymg
    Feb 1 '13 at 17:06
  • you're welcome :) Well, Android is made based on Linux, so of course it would inherit its characteristics(most if not all). Not all of the malware in Windows are self-triggered, although some are(Java driveby, autorun of virus through thumbdrive and etc). I guess that the rule of thumb is not to trust any files that you've downloaded from the Internet :)
    – wcypierre
    Feb 1 '13 at 17:27

I've seen an Android 2 Gingerbread PoC game app in which you were supposed to tap moving objects. The trick was that after tapping a few objects, the app would call the settings page where the "unknown sources" is. The next object to be tapped was right where the check box appeared so it would trick the user into tapping it. Then the game would focus on itself so the trick was barely noticeable.

Android 4 still allows apps to pop settings pages (the Maps app pops up the GPS settings screen) but it added a confirmation message for when you allow unknown sources. This confirmation message would still be vulnerable to the same trick but it would be more noticeable.

The name of the APK above suggests a social engineering trick to get the user to install the APK on a phone that hopefully has "Allow installation of non-Market apps" (aka "Unknown sources") setting checked. But a legitimate Play store app could trick a user into allowing unknown sources and then it could direct to a site similar to the one mentioned in this question.

This kind of blended attacks are real but don't cause large scale compromises worthy of media attention .... until they steal 36 million euros.

enter image description here

  • Even if the setting was enabled the user has to confirm the installation on Android.
    – Ramhound
    Feb 1 '13 at 17:33
  • @Ramhound agreed. However, do note that there are users who will install these apps blindly on their phone without knowing the impact :)
    – wcypierre
    Feb 1 '13 at 17:38
  • @wcypierre - You have to display the notifications bar and click on the package and confirm the installation package.
    – Ramhound
    Feb 1 '13 at 17:43
  • @Ramhound I get what you mean. What I meant is that the user can be social engineered to install that app, saying that the app would give you benefits(like able to crack wifi passwords within seconds, hack facebook accounts, gmail accounts and etc) and the user will follow blindly what the app instructs.
    – wcypierre
    Feb 1 '13 at 17:47
  • I did not click anything, what happened is I was googling something and entered a website, that website pushed the apk first time and then it kept pushing it until I denied the downloads, as far as clicking on messages nothing of that sort happened it just stayed in my downloads folder and DrWeb deleted it right away
    – ymg
    Feb 1 '13 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.