News for hackers. Stuff that matters.

A comment on 2FA app with 10k Google Play downloads loaded well-known banking trojan. Parent comment

Re:2FA app with 10k Google Play downloads loaded well-known ... by gruez on Friday January 28, 2022 @12:23PM (#30117625)
Half of the "extraordinary number and breadth of system permissions it required" listed in the article seem benign

* android.permission.INTERNET

* android.permission.FOREGROUND_SERVICE

* android.permission.RECEIVE_BOOT_COMPLETED

* android.permission.WAKE_LOCK

The rest are fishy, but not really anything that facilitates a virus.

* android.permission.QUERY_ALL_PACKAGES - allows you to enumerate what apps are installed

* android.permission.SYSTEM_ALERT_WINDOW - google says it's used for overlays. for a TOTP app this seems plausible for stuff like showing the code while you're entering it into the app that's requesting it

* android.permission.REQUEST_INSTALL_PACKAGES - I'm not even sure what this permission does. You can install an apk from chrome/firefox, which doesn't have this permission.

* android.permission.DISABLE_KEYGUARD - disables lockscreen. unless the attacker also has physical access, this is pointless.

[ Parent | on HN ]
Re:2FA app with 10k Google Play downloads loaded well-known ... by ffpip on Friday January 28, 2022 @01:06PM (#30118227)
> You can install an apk from chrome/firefox, which doesn't have this permission.

I thought they just ask the OS to open the file, and when it happens to be a .apk file, Android brings up the package installer. Is that not how they do it?

[ Parent | on HN ]
Re:2FA app with 10k Google Play downloads loaded well-known ... by leppr on Saturday January 29, 2022 @08:51AM (#30126252)
You have to give app installation permissions to the app you open the .apk file from.
[ Parent | on HN ]