Android Ransomware - Porn Droid

Recently, we came across a new variant of Porn Droid - an Android ransomware variant claiming to be from the FBI, which accuses people of watching child porn and then demands a fine of USD 500.

File information:

• Dropped URL : hxxp://sbqujqosyw[.]offer-mobi.com/mmesuofyqq1/pornvideo[.]apk
• MD5 : 857b887982f11493b4a1db953161e627
• Virustotal Detection : 5/56

It initially appears to the user as if they are downloading a pornographic video, but once the user clicks on the file, it masquerades as the Google patch update and tricks the user into installing the application.

 

Disguise as patch application

After clicking "Continue", the malware asks for administrator access to the device requesting permissions such as "Erase all data", "Set storage encryption", "Change the screen-unlock password" as shown in screenshot below.

 

Admin access

Once the user clicks on the "ACTIVATE" button, the malware gets administrator control of the device and locks it while displaying a fake FBI warning as seen below. It locks the user's phone by disabling keyguard and sets top priority for the malware application which ensures that no other application or user activity can override the malware application's activity.

FBI warning message

FBI warning - Payment tab

FBI warning screen with user information

The FBI warning screen also contains dynamic information relevant to the infected device such as the browser history, IMEI number, phone number and victim's picture, which has been taken by the malicious app. This is done to intimidate the end user as a warning message suggests that the information will be used by the FBI to identify the user if the fine is not paid.

Porn Droid Static Analysis

The screenshot below shows the malicious app accessing the browser history and bookmarks to display on the ransom screen. 

Browser history

It then appends the hard coded fake FBI warning message asking for ransom.

Ransom screen text code

The code below shows the malware author's attempt to evade string pattern matching based antivirus (AV) heuristic detection by leveraging a string concatenate function. This is one of the reasons why this sample has a very low (5/56) AV detection rate at the time of our analysis.

"concate" usage to evade AV detection

Another unique functionality that we observed in this mobile ransomware, that we more commonly see in PC malware, involves checking for the presence of installed AV applications such as ESET, Avast and DrWeb. It then attempts to terminate any AV applications identified.

AV Application check & terminate

In order to stay active on the screen and lock out the phone, it disables the keyguard so the user cannot exit the application.

Disable keyguard

We also observed the following commands that the malicious app may receive from a remote server:

• destroy - wipe all user data
• unlock - deactivate the Admin access and unlock the device

Commands

The app is also capable of taking pictures using the front facing camera  that it can then display on the ransom screen:

Front facing camera picture

The malware's Command & Control (C&C) server information is hardcoded in the configuration class as seen below.

Bot configuration

C&C message parameters

• Server :  "http://facebook-tw.zp.ua"
• URI:  "/pafumokat/bloqyxpn.php"
• paramString1 : random number in the range of 1 to 3 
• paramString2 :  String made of BotID, network, location, phone number, bot version, SDK.
• paramString3 : "Protection"
• paramStrong4 : "Bot"

Below is a sample C&C POST request that we captured during our analysis:

C&C request

The best way to avoid such malware is to stick with installing Android apps only from 'official' app stores such as Google Play or the Amazon Appstore.

Mobile App Wall of Shame: Wattpad

Wattpad

Price : Free
Category : Books & Reference
Platform : Android
Updated : Mar. 23, 2015
Version : 4.21
Size : 11.18 MB
Language : English
Vendor : Wattpad.com

Background:

Wattpad is the world's largest community for readers and writers and was established since 2006. Users are able to post articles, stories, fan fiction and poems about anything they like. The content includes work by undiscovered writers, published writers, new writers, or people just looking for somewhere to write all their ideas down. Users are able to comment and like stories or join different groups. Wattpad has released dedicated applications for Android, iPhone, Blackberry and iPad.

Application chart (Courtesy: Appannie, xyo.net)

	Android
Global Ranking	170
Category Ranking	5 (Books & Reference)
Total number of Downloads	~42 million
Rating	4.5/5

Before using the app, a user is required to create an account in Wattpad by providing an email address and password. After creating an account they can post stories, read other user's posts, follow users and like or comment on existing content. The application also provides feature to sync Gmail, Facebook and Twitter accounts with a Wattpad account. There is also a provision to send private messages to other users from within Wattpad.

Vulnerability: cleartext username/password

Wattpad app

The current version of Wattpad for Android application has a major security issue. By analyzing the traffic during the user registration as well as the account login process, it has been observed that user credentials are being sent to the server via HTTP. Anyone who monitors the network traffic can easily get a hold of the username/password being sent to the application server and compromise the user's account. As the application permits users to buy books, an attack could also result in financial loss.

When a user tries to register for an account using the Wattpad Android application, or subsequently login, clear text user credentials as sent via an HTTP request as shown below. 

  Account registration:

[-]http://www.wattpad.com/v4/users 

Method: POST

Host: www.wattpad.com

User-Agent: Android App v4.19.17; Model: Nexus 7; Android SDK: 21; Connection: WiFi; Locale: en_US;

Request Body: type=wattpad&username=fnzscaler&password=p%40ssword123&email=vulapps%40zscaler.com&language=1&fields=token%2Cga%2Cuser%28username%2Cdescription%2Cavatar%2Cname%2Cemail%2Cverified%2Cfollower%2Cfollowing%2CbackgroundUrl%2CvotesReceived%2CnumFollowing%2CnumFollowers%2Clanguage%2Cinbox%28unread%29%2Chas_password%29

Server Response: {"token":"52708887:2129beadf9030d8725750694ec5ee4a1928dbed9891db7bfa0bc432713037a7b","user":{"username":"fnzscaler","name":"","description":"","avatar":"http:\/\/a.wattpad.com\/useravatar\/b.128.jpg","language":1,"verified":false,"votesReceived":0,"numFollowing":0,"numFollowers":0,"backgroundUrl":"","inbox":{"unread":0},"email":"vulapps@zscaler.com","has_password":true,"follower":false,"following":false},"ga":{"logged":"1","created":"20150316","group":0}}

Likewise, when an existing user tries to login, the username/password will be sent in cleartext.

Below is the traffic capture for a login session.

Login:

[-]http://www.wattpad.com/v4/sessions 

Method: POST

Host: www.wattpad.com

User-Agent: Android App v4.19.17; Model: Nexus 7; Android SDK: 21; Connection: WiFi; Locale: en_US;

Request Body: type=wattpad&username=fnzscaler&password=p%40ssword123&fields=token%2Cga%2Cuser%28username%2Cdescription%2Cavatar%2Cname%2Cemail%2Cverified%2Cfollower%2Cfollowing%2CbackgroundUrl%2CvotesReceived%2CnumFollowing%2CnumFollowers%2Clanguage%2Cinbox%28unread%29%2Chas_password%29

Server Response: {"token":"52708887:2129beadf9030d8725750694ec5ee4a1928dbed9891db7bfa0bc432713037a7b","user":{"username":"fnzscaler","name":"","description":"","avatar":"http:\/\/a.wattpad.com\/useravatar\/b.128.jpg","language":1,"verified":false,"votesReceived":0,"numFollowing":0,"numFollowers":0,"backgroundUrl":"","inbox":{"unread":0},"email":"vulapps@zscaler.com","has_password":true,"follower":false,"following":false},"ga":{"logged":"1","created":"20150316","group":0}}

ZAP Analysis:

Zap in action.

Conclusion:

The rapidly growing list of applications that do not implement even the most basic security checks makes it necessary for users to take care when accessing their accounts on public networks. It is also important important to avoid password reuse in multiple applications.

Credit - Lakshmi Devi.

Mobile App Wall of Shame: Shaadi.com

Shaadi.com

Price : Free
Category : Social
Platform : iOS and Android
Updated : Mar. 9, 2015 (Android), Mar. 10 2015 (iOS)
Version : 4.2.2 (Android), 4.2.1 (iOS)
Size : 8.28 MB (Android), 17.7 MB (iOS)
Language : English
Vendor : People Interactive (I) Pvt. Ltd.

Background:

Shaadi.com is the world's largest matrimonial website, active since 1995. This matrimonial site permits individuals to post their profiles and responses including horoscope, caste, language and religion. Shaadi.com provides applications designed for the two main mobile platforms – iOS and Android.

Application Chart (information retrieved from Appannie & xyo.net):

	Android	iOS
Global Ranking	15	92
Category Ranking	12 (Social)	24 (Social networking)
Total number of Downloads	~1 million	~0.3 million
Rating	3.9/5	2.7/5

A new user is required to register by providing an email address and a password, along with basic personal details. After registering the account, the user can surf profiles created by others. The application also provides a chat facility.

Vulnerability - Cleartext username/password

Login screen

The current version of the Shaadi.com application has a serious security flaw. It has been verified that both the iOS and Android versions of the application transmit the username and password via HTTP in cleartext. This flaw allows an attacker to capture the credentials sent by a user to the application server and thus compromise the user's account, which may lead to compromise of user's personal data. The service also provides premium accounts to paid customers. 

The application was tested on both the Android and iOS platforms. The vulnerability has been confirmed on Android (v4.2.2 - latest version, updated on Mar. 9, 2015) and iOS (v4.2.1 - latest version, updated on Mar. 10, 2015).  

Vulnerability in iOS version

When a user tries to register for an account on the Shaadi.com application, an HTTP request is generated. In the request the userid, password and mobile number of the user is sent in cleartext as seen below:

Account Registration

[-]http://www.shaadi.com/registration/user/?regmode=app&OS=native-iphone

Method: POST 

Host: www.shaadi.com 

User-Agent: native-iphone|4.1.0 

Request Body: form_referral_url=&form_url=http%3A%2F%2Fwww.shaadi.com%2Fregistration%2Fuser%3Fregmode%3Dapp%26appver%3D4.1.0%26os%3Dnative-iphone%26deviceid%3D---%257C---&form_name=MOB_DR_SEO_REG1&frompage=From+Reg+Page&go=&olmt_home_regpage=&hid_year=&oscode=2&email=fnzscalerlnzscaler%40gmail.com&password1=p%40ssword123&postedby=Self&first_name=fnzscaler&last_name=lnzscaler&gender=Male&day=01&month=01&year=1994&community=No+Religion&mother_tongue=Konkani&countryofresidence=USA&contact_tel_number=Landline+No.

Similarly, when an already existing user tries to login to his account by providing his username and password, these credentials are also being sent in cleartext. Below is the traffic capture when a user tries to login to an existing account:

Login

[-]http://www.shaadi.com/native-apps2/user/login?email=fnzscalerlnzscaler@gmail.com&password=p@ssword123&appver=4.1.0&os=native-iphone&deviceid=---%7C--- 

Method: GET            

Host: www.shaadi.com            

User-Agent: Shaadi/462 CFNetwork/711.1.16 Darwin/14.0.0            

Server Response: {"status":"200","data":{"sid":"7B16D793AFF0443EE1320F85EFD1B4C51425446439","abc":"0CE03847FB4B0C981EB552E34E1C96B61425446522|ZSH82845405|","premium":false,"gender":"Male","age":"21","memberstatus":"ToBeScreened","memberlogin":"ZSH82845405","photograph_status":"photo_request","update_available":false,"has_notification":"N","has_chat_notification":"N","content_settings":{"eoi":"Y","acc":"Y","msg":"Y","nf1":"N","dr":"Y"},"display_name":"SH82845405","username":"SH82845405","email":"fnzscalerlnzscaler@gmail.com","use_connect":1,"upgrade_message":"UPGRADE TO PREMIUM","support_telephone":"1860-200-3456","payment_telephone":"1860-200-3456"},"expdt":"20150403002202","banner_images":{"banner_search_results":{"title":"Become a Premium Member & connect directly via","subtitle":"EMAIL, CHAT & PHONE","details":"","version":"","img":"http:\/\/img.shaadi.com\/community\/images\/app\/banner_search_results_male_free_high.png"},"banner_accepted":{"title":"Upgrade to Premium & start chatting with your Accepted Members!","subtitle":"","details":"","version":"","img":"http:\/\/img.shaadi.com\/community\/images\/app\/banner_accepted_free.png"},"banner_inbox_single":{"title":"1 Member like your profile!","subtitle":"Become a Premium member & write back to them today","details":"","version":"","img":"http:\/\/img.shaadi.com\/community\/images\/app\/banner_inbox_single_male_free_high.png"},"banner_inbox_multiple":{"title":"#count# Members like your profile!","subtitle":"Become a Premium member & write back to them today","details":"","version":"","img":"http:\/\/img.shaadi.com\/community\/images\/app\/banner_inbox_multiple_male_free_high.png"}}} 

Vulnerability in Android version

Account Registration

[-]http://www.shaadi.com/registration/user/?regmode=app&OS=native-android 

Method: POST            

Host: www.shaadi.com            

User-Agent: Mozilla/5.0 (Linux; Android 5.0.2; Nexus 7 Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/37.0.0.0 Safari/537.36            

Request Body: form_referral_url=&form_url=http%3A%2F%2Fwww.shaadi.com%2Fregistration%2Fuser%3Fregmode%3Dapp%26os%3Dnative-android%26deviceid%3D--%7C--%26appver%3D4.1.3&form_name=MOB_DR_SEO_REG1&frompage=From+Reg+Page&go=&olmt_home_regpage=&hid_year=&oscode=1&email=vulapps%40zscaler.com&password1=p%40ssword1234&postedby=Self&first_name=fnzscaler&last_name=lnzscaler&gender=Male&day=10&month=10&year=1985&community=Spiritual+-+not+religious&mother_tongue=Marathi&countryofresidence=USA&contact_tel_number=Landline+No. 

Login

[-]http://www.shaadi.com/registration/user/login-submit 

Method: POST            

Host: www.shaadi.com            

User-Agent: Mozilla/5.0 (Linux; Android 5.0.2; Nexus 7 Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/37.0.0.0 Safari/537.36            

Request Body: go=&email=vulapps%40zscaler.com&password=p%40ssword123&autologin=0&autologin=Y

ZAP analysis:

ZAP in action - Android

ZAP in action - iOS

Conclusion

The list of mobile applications in Google Play and the iTunes App Store that send out sensitive information in cleartext continues to grow. Therefore, it is extremely important to keep separate passwords for different applications and never use the password of your financial applications anywhere else.

Credit: Lakshmi Devi.

Mobile App Wall of Shame: Quikr

Quikr Local Classifieds

Quikr app logo 

Price : Free

Category : Lifestyle/Shopping

Platform : iOS and Android

Updated : February 12, 2015(Android), 22 January 2015(iOS) 

Version : 7.42(Android), 2.8.2(iOS)

Size : 3.89 MB(Android),10 MB(iOS)

Language : English

Vendor : Quikr India

Background:

Quikr is India's largest online and mobile classifieds portal. Like Craigslist, Quikr provides the users with a platform to help them buy, sell, rent and advertise across multiple categories like real estate, jobs, entertainment, education, matrimonial, etc. Quikr also has a mobile app on both the Android and iOS platforms. 

Application Chart (information retrieved from Appannie & xyo.net)

	Android	iOS
Overall Ranking(India)	20	90
Category Ranking(India)	5 (Shopping)	8 (Lifestyle)
Total number of Downloads	12 Million	108 Thousand
Rating	4/5	3.5/5

A user is required to provide an email address and password when creating an account. After creating an account, the user can the post advertisements on Quikr. The application also provides functionality wherein different users can chat with each other.

Vulnerability - Clear text username/password

The current version of Quikr mobile application has a serious data leakage vulnerability. It has been verified that both the current Android and iOS versions of the application are sending username and password information via the HTTP protocol in cleartext. This security vulnerability allows an attacker on the same network to capture the credentials sent by a Quikr user to the application server and thus compromise the user's account which may lead to posting fake ads on account owner's behalf, selling and buying products and sending spam messages via chat to other users.

The flaw has been confirmed on versions 7.42 (latest versions available on Feb 12, 2015) on the Android platform and version 2.8 (latest version available on Jan 22, 2015) on the iOS platform. 

Vulnerability in iOS version

When a user tries to register for an account in the Quikr application, an HTTP request is generated as shown below. In this request, the userid, password and mobile number of the user are sent in cleartext. 

Account Registration:

[-]  Method: POST

Url: http://services.quikr.com/api?                 method=registerUser&secCode=fd1f2276c71627c35e2a9c5f8838c09c&version=1.5

Host: services.quikr.com

User-Agent: Quikr/2.8.2 CFNetwork/711.1.16 Darwin/14.0.0

Request Body:cityId=23&userId=zscalerappscan%40zscaler.com&password=password123&mobile=9876543210&demail=969eac57dbfc4079a935fadf7ab261d6%40quikr.com

Server Response: AJBiY , N , .E]n3 , i^0%] , 1}qa , K;\OU4

Similarly, below is the traffic capture when an already existing user tries to login to their account. The userid and password are passed in cleartext.

Login:

[-]  Method: POST

Url: http://services.quikr.com/api?method=login&secCode=fd1f2276c71627c35e2a9c5f8838c09c&version=1.5

Host: services.quikr.com

User-Agent: Quikr/2.8.2 CFNetwork/711.1.16 Darwin/14.0.0

Request Body: demail=969eac57dbfc4079a935fadf7ab261d6@quikr.com&userId=zscalerappscan@zscaler.com&password=password123

Server Response: 1`QaL , B*RD , , ,

Vulnerability in Android version

We will first test the Quikr application installed on a Google Nexus tablet. The Quikr application version available in the Google Play store for the tablet was v6.9. Below is the sample traffic capture when a user tries to register a new Quikr account or login to their existing Quikr account.

Account Registration:

[-]  Method: POST

Url: http://services.quikr.com/api?method=registerUser&version=1.5&secCode=zXcv80386Mdp1hs0q7o0p9uiLZV37TdF&consumerVersion=7.42&density=2.0&demail=qaf4cd1713f1f62078magnumsnip@gmail.com

Host: services.quikr.com

User-Agent: QuikrConsumer

Request Body: --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="cityId" , , 23 , --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="demail" , , qaf4cd1713f1f62078magnumsnip@gmail.com , --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="mobile" , , 8234567890 , --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="userId" , , appscan@zscaler.com , --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="opf" , , json , --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="password" , , p@ssword123

Server Response: {"login":{"auth":1,"code":"usercreated","message":[{"direct":"New user created"}],"email":"appscan@zscaler.com","mobile":"8234567890","city":"23","name":"","UserSession":"PGR8fU59OHVzOWMhfFI+fll0Qj5mdnIjRXd0Rm57T0dZPXw\/Q0RDYCE4amJ5L3R5PHVdTGpORSY6KDhjbl40LlliaztN","emailCRC":null,"cityName":"Bangalore","cityId":"23","app_notif_status":1,"sound_preference":1,"notif_alarmtime":"08:00 PM","userClassification":null,"isSharedPB":0,"isSharedFB":0,"userType":1,"numAlerts":0,"numAds":"0"}}

Login:

[-]  Method: POST

Url: http://services.quikr.com/api?method=login&version=1.5&secCode=zXcv80386Mdp1hs0q7o0p9uiLZV37TdF&consumerVersion=7.42&density=2.0&demail=qaf4cd1713f1f62078magnumsnip@gmail.com

Host: services.quikr.com

User-Agent: QuikrConsumer

Request Body: --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="demail" , , qaf4cd1713f1f62078magnumsnip@gmail.com , --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="userId" , , appscan@zscaler.com , --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="opf" , , json , --s2retfgsGSRFsERFGHfgdfgw734yhFHW567TYHSrf4yarg , Content-Disposition: form-data; name="password" , , password123

Server Response: {"login":{"auth":1,"code":"success","message":[{"direct":"You are successfully logged in"}],"email":"appscan@zscaler.com","mobile":"8234567890","city":"23","name":"","UserSession":"PGR8fU59OHVzOWMhfFI+fll0Qj5mdnIjRXd0Rm57T0dZPXw\/Q0RDYCE4amJ5L3R5PHVdTGpORSY6KDhjbl40LlliaztN","emailCRC":null,"cityName":"Bangalore","cityId":"23","app_notif_status":1,"sound_preference":1,"notif_alarmtime":"08:00 PM","userClassification":"0","isSharedPB":0,"isSharedFB":0,"userType":1,"numAlerts":0,"numAds":"0"}}

As you can see in the above requests, all communication between the mobile app and server is in sent via cleartext, which includes sensitive user information.

ZAP Analysis:

ZAP in action - Android

ZAP in action - iOS

This flaw was identified using the Zscaler Application Profiler (ZAP). ZAP is a free online tool that can be used to analyze mobile applications for vulnerabilities and privacy issues as seen in the above screenshots.

Conclusion:

We continue to find new popular applications in the Apple and Google app stores that are leaking device data and sending out sensitive user information in cleartext. This is a good argument for the use of one time passwords when establishing accounts on mobile apps. As a user, you can never know with certainly if your credentials are being transmitted/stored securely. By leveraging a password manager and ensuring that passwords are unique for all apps, at least you can be assured that if your credentials are compromised due to poor app security, only that specific account will be impacted.

Credit: Lakshmi Devi.

Mobile App Wall of Shame: Tinychat for iPhone

Tinychat

Price : Free

Category : Social Networking

Updated : December 29, 2014

Version : 5.0

Size : 19.41 MB

Language : English

Vendor : Tinychat Co

Operating system : iOS

Background:

Tinychat is a group video chat application that allows users to chat online and also create their own chart rooms. Currently, this application is ranked among the top 200 apps in the Social Networking category on the iTunes app store. Tinychat claims 5 million minutes of usage per day, making it one of the largest voice and video chat communities on the Internet today.

A user must submit their email address and password in order to create an account. Alternately, a user can also use their Facebook or Twitter account to login to this application.

 Vulnerability - Clear text username/password

App Login page

The current Tinychat App (verified on Version 5.0) has a serious information leakage flaw whereby username & password information for the Tinychat user is sent in clear text (unencrypted) to the application server. This vulnerability woud make it possible for an attacker to easily sniff network traffic and compromise the user account.

Below is the sample capture of a Tinychat user login attempt. As seen in the request, the username & password information is sent in clear text.

Login:

Login Capture

Similarly, when a user attempts to register an account on Tinychat, the following HTTP request is generated. The username, password and email address information of the user passes in clear text as seen in the request below:

Account registration:

Registration Capture

An attacker can easily takeover the victim's account by sniffing the vulnerable application's network traffic. This can further lead to more sophisticated attacks and can often lead to the compromise of other applications/services due to password reuse.

ZAP Analysis:

ZAP in action.

This flaw was identified using Zscaler Application Profiler (ZAP). ZAP is a free online tool that can be used to analyze mobile applications for vulnerabilities and privacy issues as seen in the above screenshot. We have reached out to Tinychat developers, informing them of this security flaw.

Conclusion:

This type of security flaw can be uncovered by simply analyzing the network traffic sent by the application. It is disappointing to see such applications getting uploaded to Apple iTunes store without basic security tests like checking for clear text username/passwords being conducted. This is not the first time we have seen a popular iOS application with this security flaw, but Apple continues to ignore performing a basic security check as part of their vetting process for adding new applications to the app store.

Credit: Analysis by Lakshmi.