He notado un comportamiento inusual y no deseado de algunas de mis aplicaciones del sistema, sobre todo Google Play Services, Google Account Manager y Google Services Framework. Estas aplicaciones causan cierres forzados en sus propias operaciones, así como en las de otras aplicaciones, parecen tener la capacidad de tomar el control de la funcionalidad de mi teléfono por completo a veces.
Así que utilicé la herramienta Virustotal.com para analizar los permisos de estas aplicaciones y determinar si están presentes con las capacidades correctas incorporadas para la versión que venía preinstalada en el teléfono. Para cada una de estas aplicaciones, devolvieron entre 10 y 20 permisos adicionales cada una que no fueron diseñados para tener, lo que sugiere que han sido manipulados.
Mi teléfono no está rooteado ni modificado de ninguna manera y lo tengo desde hace menos de un año. Estos permisos adicionales fueron etiquetados:
(Permiso desconocido de la referencia de Android)
designando estos permisos específicos como no nativos de estas aplicaciones. Algunos de estos permisos están específicamente diseñados para la transmisión y comunicación de datos a través de C2DM y Gtalk a otros dispositivos, así como la exposición de los detalles de las cuentas guardadas, incluyendo las contraseñas. Esto me lleva a concluir que se ha filtrado información personal sensible a terceros. Aquí está la salida para el Administrador de cuentas de Google como ejemplo:
VirusTotal
SHA256: 602db0ceb05877fb6996fd2a3510721d0e32463a6e784ba5cc60ae1f71bb3226
File name: GoogleLoginService.apk
Detection ratio: 0 / 53
Analysis date: 2014-07-20 19:04:51 UTC ( 9 months, 1 week ago )
0
0
Analysis
File detail
Additional information
Comments 0
Votes
Behavioural information
The file being studied is Android related! APK Android file more specifically. The application's main package name is com.google.android.gsf.login. The internal version number of the application is 19. The displayed version string of the application is 4.4.4-1215936. The minimum Android API level for the application to run (MinSDKVersion) is 8. The target Android API level for the application to run (TargetSDKVersion) is 17.
Risk summary
The studied DEX file makes use of API reflection
Permissions that allow the application to access Internet
Permissions that allow the application to access private information
Other permissions that could be considered as dangerous in certain scenarios
Required permissions
android.permission.CHANGE_NETWORK_STATE (change network connectivity)
android.permission.READ_SYNC_SETTINGS (read sync settings)
com.google.android.providers.gsf.permission.READ_GSERVICES (Unknown permission from android reference)
android.permission.USE_CREDENTIALS (use the authentication credentials of an account)
android.permission.DUMP (retrieve system internal status)
android.permission.READ_LOGS (read sensitive log data)
android.permission.WRITE_PROFILE (write the user's personal profile data)
android.permission.CHANGE_COMPONENT_ENABLED_STATE (enable or disable application components)
android.permission.READ_SYNC_STATS (read sync statistics)
android.permission.RECEIVE_BOOT_COMPLETED (automatically start at boot)
android.permission.INTERNET (full Internet access)
com.google.android.googleapps.permission.GOOGLE_MAIL_SWITCH (Unknown permission from android reference)
android.permission.BACKUP (control system back up and restore)
com.google.android.googleapps.permission.GOOGLE_AUTH.youtube (Unknown permission from android reference)
android.permission.SUBSCRIBED_FEEDS_READ (read subscribed feeds)
android.permission.MANAGE_ACCOUNTS (manage the accounts list)
com.google.android.gtalkservice.permission.GTALK_SERVICE (Unknown permission from android reference)
com.google.android.permission.BROADCAST_DATA_MESSAGE (Unknown permission from android reference)
com.google.android.googleapps.permission.GOOGLE_AUTH.YouTubeUser (Unknown permission from android reference)
android.permission.PERSISTENT_ACTIVITY (make application always run)
com.google.android.googleapps.permission.GOOGLE_AUTH.ALL_SERVICES (Unknown permission from android reference)
com.android.vending.TOS_ACKED (Unknown permission from android reference)
android.permission.ACCESS_NETWORK_STATE (view network status)
com.google.android.providers.settings.permission.READ_GSETTINGS (Unknown permission from android reference)
com.google.android.providers.settings.permission.WRITE_GSETTINGS (Unknown permission from android reference)
com.google.android.googleapps.permission.GOOGLE_AUTH (Unknown permission from android reference)
android.permission.WRITE_CONTACTS (write contact data)
android.permission.WRITE_SYNC_SETTINGS (write sync settings)
android.permission.AUTHENTICATE_ACCOUNTS (act as an account authenticator)
android.permission.BROADCAST_STICKY (send sticky broadcast)
com.android.vending.billing.BILLING_ACCOUNT_SERVICE (Unknown permission from android reference)
android.permission.WRITE_SETTINGS (modify global system settings)
android.permission.READ_PHONE_STATE (read phone state and identity)
com.google.android.googleapps.permission.GOOGLE_AUTH.mail (Unknown permission from android reference)
com.android.vending.INTENT_VENDING_ONLY (Unknown permission from android reference)
com.google.android.providers.talk.permission.READ_ONLY (Unknown permission from android reference)
com.google.android.googleapps.permission.ACCESS_GOOGLE_PASSWORD (Unknown permission from android reference)
com.google.android.providers.talk.permission.WRITE_ONLY (Unknown permission from android reference)
android.permission.VIBRATE (control vibrator)
com.android.chrome.TOS_ACKED (Unknown permission from android reference)
android.permission.SUBSCRIBED_FEEDS_WRITE (write subscribed feeds)
android.permission.ACCESS_WIFI_STATE (view Wi-Fi status)
com.android.vending.billing.ADD_CREDIT_CARD (Unknown permission from android reference)
android.permission.WAKE_LOCK (prevent phone from sleeping)
android.permission.CHANGE_WIFI_STATE (change Wi-Fi status)
android.permission.READ_CONTACTS (read contact data)
com.android.vending.billing.IBillingAccountService.BIND2 (Unknown permission from android reference)
android.permission.READ_PROFILE (read the user's personal profile data)
com.google.android.gtalkservice.permission.SEND_HEARTBEAT (Unknown permission from android reference)
android.permission.GET_ACCOUNTS (discover known accounts)
Permission-related API calls
ACCESS_NETWORK_STATE
Landroid/net/ConnectivityManager;->getActiveNetworkInfo()Landroid/net/NetworkInfo; called from Lcom/google/android/gsf/loginservice/BaseActivity;->hasNetworkConnection()Z
READ_PHONE_STATE
Landroid/telephony/TelephonyManager;->getLine1Number()Ljava/lang/String; called from Lcom/google/android/gsf/login/RecoveryDataActivity;->initViews(Landroid/os/Bundle;)V
USE_CREDENTIALS
Landroid/accounts/AccountManager;->invalidateAuthToken(Ljava/lang/String; Ljava/lang/String;)V called from Lcom/google/android/gsf/loginservice/GoogleLoginService$GlsImplementation;->invalidateAuthToken(Ljava/lang/String;)V
INTERNET
Ljava/net/ServerSocket;-><init>(I)V called from Lcom/google/android/common/http/TestHttpServer;-><init>(I)V
Landroid/webkit/WebView;-><init>(Landroid/content/Context;)V called from Lcom/google/android/common/GoogleWebContentHelper;->initializeViews()V
Landroid/webkit/WebView;-><init>(Landroid/content/Context;)V called from Lcom/google/android/gsf/login/CustomWebView;-><init>(Landroid/content/Context;)V
VIBRATE
Landroid/app/NotificationManager;->notify(I Landroid/app/Notification;)V called from Lcom/google/android/gms/auth/GoogleAuthUtil;->a(Landroid/content/Context; Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;
ACCESS_WIFI_STATE
Landroid/net/wifi/WifiManager;->getWifiState()I called from Lcom/google/android/gsf/login/SetupWirelessActivity;->tryEnablingWifi()Z
GET_ACCOUNTS
Landroid/accounts/AccountManager;->getAccountsByType(Ljava/lang/String;)[Landroid/accounts/Account; called from Lcom/google/android/gsf/login/BaseActivity;->isFirstAccount()Z
Landroid/accounts/AccountManager;->getAccountsByType(Ljava/lang/String;)[Landroid/accounts/Account; called from Lcom/google/android/gsf/login/AccountIntroActivity;->maybeSkipAccountSetup()Z
Landroid/accounts/AccountManager;->getAccountsByType(Ljava/lang/String;)[Landroid/accounts/Account; called from Lcom/google/android/gsf/login/EduLoginActivity;->removeAnyNewAccounts()V
READ_SYNC_SETTINGS
Landroid/content/ContentResolver;->getIsSyncable(Landroid/accounts/Account; Ljava/lang/String;)I called from Lcom/google/android/gsf/login/SyncSettingsFragment;->updateListViewData(Landroid/accounts/Account;)V
CHANGE_COMPONENT_ENABLED_STATE
Landroid/content/pm/PackageManager;->setApplicationEnabledSetting(Ljava/lang/String; I I)V called from Lcom/google/android/gsf/login/ShowErrorActivity;->onClick(Landroid/view/View;)V
MANAGE_ACCOUNTS
Landroid/accounts/AccountManager;->removeAccount(Landroid/accounts/Account; Landroid/accounts/AccountManagerCallback; Landroid/os/Handler;)Landroid/accounts/AccountManagerFuture; called from Lcom/google/android/gsf/login/EduLoginActivity;->removeAnyNewAccounts()V
Landroid/accounts/AccountManager;->removeAccount(Landroid/accounts/Account; Landroid/accounts/AccountManagerCallback; Landroid/os/Handler;)Landroid/accounts/AccountManagerFuture; called from Lcom/google/android/gsf/loginservice/GoogleLoginService$GlsImplementation;->deleteAllAccounts()V
Landroid/accounts/AccountManager;->removeAccount(Landroid/accounts/Account; Landroid/accounts/AccountManagerCallback; Landroid/os/Handler;)Landroid/accounts/AccountManagerFuture; called from Lcom/google/android/gsf/loginservice/GoogleLoginService$GlsImplementation;->deleteOneAccount(Ljava/lang/String;)V
AUTHENTICATE_ACCOUNTS
Landroid/accounts/AccountManager;->getUserData(Landroid/accounts/Account; Ljava/lang/String;)Ljava/lang/String; called from Lcom/google/android/gsf/loginservice/GoogleLoginService;->accountHasFeatures(Landroid/accounts/AccountManager; Landroid/accounts/Account; [Ljava/lang/String;)Z
Activities
com.google.android.gsf.login.AccountIntroActivity
com.google.android.gsf.login.AccountPreIntroUIActivity
com.google.android.gsf.login.AccountIntroUIActivity
com.google.android.gsf.login.PlusQueryActivity
com.google.android.gsf.login.PlusFaqActivity
com.google.android.gsf.login.NameActivity
com.google.android.gsf.login.BadNameActivity
com.google.android.gsf.login.PhotoActivity
com.google.android.gsf.login.LearnMoreActivity
com.google.android.gsf.login.WaitForDeviceCountryActivity
com.google.android.gsf.login.CaptchaActivity
com.google.android.gsf.login.SetupWirelessIntroActivity
com.google.android.gsf.login.SetupWirelessActivity
com.google.android.gsf.login.LoginActivity
com.google.android.gsf.login.EduLoginActivity
com.google.android.gsf.login.UsernamePasswordActivity
com.google.android.gsf.login.PrepareAccountSetupActivity
com.google.android.gsf.login.LoginActivityTask
com.google.android.gsf.login.ShowErrorActivity
com.google.android.gsf.login.SyncIntroActivity
com.google.android.gsf.login.CreateAccountActivity
com.google.android.gsf.login.PlusActivity
com.google.android.gsf.login.PlusCheckTask
com.google.android.gsf.login.UsernameActivity
com.google.android.gsf.login.CreateAccountTask
com.google.android.gsf.login.ProfileTask
com.google.android.gsf.login.NameCheckTask
com.google.android.gsf.login.CheckAvailTask
com.google.android.gsf.login.SuggestUsernameActivity
com.google.android.gsf.login.VerifyProfileActivity
com.google.android.gsf.login.ChoosePasswordActivity
com.google.android.gsf.login.RecoveryIntroActivity
com.google.android.gsf.login.GetCountryListTask
com.google.android.gsf.login.RecoveryDataActivity
com.google.android.gsf.login.AccountSecurityActivity
com.google.android.gsf.login.PicassaInfoActivity
com.google.android.gsf.login.GoogleServicesActivity
com.google.android.gsf.login.TermsOfServiceActivity
com.google.android.gsf.login.BrowserActivity
com.google.android.gsf.loginservice.GrantCredentialsPermissionActivity
Services
com.google.android.gsf.loginservice.GoogleLoginService
Receivers
com.google.android.gsf.login.DevicePolicyActivatedReceiver
Service-related intent filters
com.google.android.gsf.loginservice.GoogleLoginService
actions: android.accounts.AccountAuthenticator, com.google.android.gsf.action.GET_GLS
Activity-related intent filters
com.google.android.gsf.login.AccountIntroActivity
actions: com.google.android.accounts.AccountIntro, android.intent.action.MAIN
categories: android.intent.category.DEFAULT
Receiver-related intent filters
com.google.android.gsf.login.DevicePolicyActivatedReceiver
actions: com.google.android.apps.enterprise.dmagent.AUTO_REGISTRATION_FINISHED
Code-related observations
The application does not load any code dynamically
The application contains reflection code
The application does not contain native code
The application does not contain cryptographic code
Application certificate information
Issuer
DN: C=US, ST=California, L=Mountain View, O=Google Inc., OU=Android, CN=Android
C: US
CN: Android
L: Mountain View
O: Google Inc.
S: California
OU: Android
Subject
DN: C=US, ST=California, L=Mountain View, O=Google Inc., OU=Android, CN=Android
C: US
CN: Android
L: Mountain View
O: Google Inc.
S: California
OU: Android¿A quién debo comunicar esta información? Es bastante seguro que mi teléfono está completamente comprometido?
