Found AndroSpy rootkit on Galaxy Note 2; Help?

The Something Awful Forums > Archives > Comedy Goldmine > The Goodmine > Found AndroSpy rootkit on Galaxy Note 2; Help?

ClassActionFursuit: Mar 15, 2006

Obviously this is a state actor. I'd probably travel to southeast Asia under an assumed name at this point.

What are you asking here, exactly? Like what's the point of the thread or the question you need answered?

# ¿ Jul 24, 2014 10:41

Adbot: ADBOT LOVES YOU

# ¿ Apr 29, 2024 19:07

ClassActionFursuit: Mar 15, 2006

Method Loser posted:

For any ideas on seeing what files I may be able to snoop to see who's behind this. I know what I'm doing, but more knowledge before I lawyer up is never bad.

Method Loser posted:

We've yanked the pertinent info off the phone, and took the sim and battery out. Past that, it's now evidence; no battery, in a box. I have to see my (US) lawyer anyway soon so we'll see what kind of case I have.

The answer is that with the phone off you can snoop none of the files.

# ¿ Jul 25, 2014 10:43

ClassActionFursuit: Mar 15, 2006

Install the app on another phone and see.

# ¿ Jul 25, 2014 13:49

ClassActionFursuit: Mar 15, 2006

Method Loser posted:

Completely hidden, there's no 'app' in the conventional nature. Honestly, I have no idea who put it there, what it looks like, nothing, since it also makes downloading diag tools error out trying to get them off the play store.

There is an app, you just don't know how to find it.

# ¿ Jul 25, 2014 14:32

ClassActionFursuit: Mar 15, 2006

I hate to have to point this out, but the kawaiiest is correct, there's no way a non-system app can present an icon on the right near the time. It simply isn't a thing that can be done and I must've missed that in the OP because I would've pointed it out then. Even if you had root and installed the app as a system app (which can be done without rooting the device through recovery assuming a custom recovery is installed) it still can't put the icon on the right near the clock.

Since the OP's "expert" is anything but, I'll spell out the technical reason. It's because in order to modify that part of the statusbar you need to modify SystemUI and for that you'd also need root. Now there are a few ways to approach that problem if for some reason you wanted your surveillance app to throw a notification to alert the user that they're being spied upon but all of them would carry a lot of dependencies. The only way you could do it for every device without making a bespoke modified SystemUI for every type of device and every variant of those software versions would be via Xposed. Only now you've got the problem where you can't hide the presence of Xposed, system root, and an Xposed module to modify SystemUI on the fly.

But let's assume, as a thought exercise (since this is obviously far from reality) that there is an unauthorized surveillance app on the phone, and it has solved the "problem" of throwing a notification in the system area of the notification bar.

How did it get on there? As already established, for it to be hidden from a user with a modicum of sense it would need to be done with root. It would need to install itself to /system/app since without that a user could see and uninstall it. It would need to obfuscate the name of package much like Lookout used to (still does?) to make it difficult to detect looking through /system/app or checking for running services. Could that be done? Yes, if the person installing it had access to the device, used a root exploit to install it, then unrooted. Could it be installed remotely? Definitely not if the device was unrooted. Even if it was rooted it wouldn't work without a reboot.

So as someone who has a pretty good grasp on how Android can be altered at the system level there are simply too many things that aren't possible for this to be real:

The phone would have to be rooted, at least temporarily, to hide an app from the user.
To put the icon on the right, the phone would need to be rooted (again, at least temporarily) to make very involved changes that do nothing to aid in the app in its supposed function. Again, lots of things would have to be done just to show a notification to the user that they were being spied on with an icon on the right instead of the left which would require no work at all.
A developer would have to want to make a spying app that notifies the user of what it was doing. It would be less work to not tell the user, either by simply making the icon transparent if there had to be a notification or making the notification innocuous so that it didn't alarm the user.
Such an app would have to have to be made specifically for your device, carrier, and software version. This is not a trivial task.

One doesn't need to know much about Android to know that if the user a) can't think of anyone who'd want to spy on him, b) can't think of anyone who'd have the opportunity to install it, c) can't explain why a surveillance app would throw a notification at all, d) can't provide anything pulled from the device, including even a screenshot of the alleged notification, and e) is claiming something technically not possible then it's probably the case that the user's claims are wrong or false.

Also I looked at the Play Store page for the app in that Github--it shows a satellite shaped notification on the left and isn't for spying but marking coordinates. There's nothing surreptitious about it at all. And I told you how to easily determine where the app you claim it is would be: install it on another, clean device and look for the new files.

Still a pretty good troll though and I'm glad to have been here since the beginning.

ClassActionFursuit fucked around with this message at 10:27 on Jul 26, 2014

# ¿ Jul 26, 2014 10:23