China forces one of its Muslim minorities to install spyware on their phones

Re:China forces one of its Muslim minorities to install spyw... by ascom on Saturday July 22, 2017 @11:40AM (#14827708)

I downloaded it and decompiled it here, if anyone wants to take a look: https://mirrors.asun.co/chinese-spyware/

[ Parent | on HN ]

Re:China forces one of its Muslim minorities to install spyw... by aaron695 on Sunday July 23, 2017 @12:31AM (#14830900)

So the QR code linked to - http://47.93.5.238:8081/APP/GA_AJ_JK/GA_AJ_JK_GXH.apk?AJLY=6...

Worst game ever. Is it just OK and Cancel? then it seems to do nothing?

Going up to http://47.93.5.238:8081/APP/ there are two other apk's [GT - "Download the security security project" "Download the public security project" ]

[ Parent | on HN ]

Re:China forces one of its Muslim minorities to install spyw... by sl4i6j3o4i98g on Saturday July 22, 2017 @11:48AM (#14827743)

Legend! thank you.

[ Parent | on HN ]

Re:China forces one of its Muslim minorities to install spyw... by sl4i6j3o4i98g on Saturday July 22, 2017 @02:11PM (#14828478)

Product: Landa iTAP Vendor: http://www.landasoft.com/html/class/dsjfx/index.html

C2 URL: http://bxaq.landaitap.com:22222/BXAQ/servlet/front/APPS?type... (HTTP POST)

Update URL: http://47.93.5.238:8081/APP/VERSION/jingwangweishi_version/v...

Interesting features:

MainActivity.this.scan = new SdcardScan("3GP,AMR,AVI,WEBM,FLV,IVX,M4A,MP3,MP4,MPG,RMVB,RAM,WMA,WMV,TXT,HTML,CHM,PNG,JPG", MainActivity.this.sdcardCallBack, true);

String SBMC = isTRN(isNull(EssentialInformation.getSBMC()));

        String IMEI = isTRN(isNull(EssentialInformation.getIMEI(this)));

        String MAC = isTRN(isNull(EssentialInformation.getMacAddress(this)));

        String CSMC = isTRN(isNull(EssentialInformation.getPhoneCsModel()));

        String XH = isTRN(isNull(EssentialInformation.getPhoneModel()));

        String SJH = isTRN(isNull(EssentialInformation.getLineNum(this)));

[ Parent | on HN ]

Re:China forces one of its Muslim minorities to install spyw... by aaron695 on Sunday July 23, 2017 @12:54AM (#14830966)

GA_AJ_JK_GXH_source_from_JADX\res\raw\test.txt

The md5's they are looking for you reckon?

[ Parent | on HN ]