Android.Opfake is malware written for Android devices that masquerades as various apps and content, including an installer for the Opera Web browser and a pornographic movie, which requires the user to pay for them. It demands payment for the app or content through Short Message Service (SMS) messages.
Refer to Symantec Security Response – Android.Opfake In-Depth
It primarily targets Russian.
The core operation of its function is to encourage user to press on buttons on the installed Android.Opfake app which is confused as other legitimate games download. Having pressed the buttons will result in users being cheated into agreeing to receive premium rate sms. It is your fault, you pressed the buttons, you made the orders!.
This will be followed by paid subscription for mobile contents which affected users didn’t consent to.
The app is written in Java.
The Main application saves the settings (Settings.saved) to a local file named “settings” in the device. The settings include server URL, wait time, list of SMS to intercept, and list of SMS messages to delete.
Servers can wake up the application any time by sending an SMS message to the device.
Premium SMS messages are sent when the Web page wapxload.ru/opera/ is displayed. But the application does not read the content of the HTTP response. Interestingly, it enables the JavaScript functionality in the browser and registers a callback method named onJsPrompt.
This callback method enables the application to be called back when the JavaScript on the Web view attempts to display a dialog box, usually used to ask users for input. This kind of callback is usually used to input into a prompt automatically or replace with a customized dialog box. But this callback takes the message of prompt as a command and the default value, if any, as a parameter. The commands are sendSms, getImei, getImsi, getPhone, and install. The command install will download another application and install it. Commands getImei, getImsi, and getPhone return the value of IMEI, IMSI, and the device’s phone number respectively as the return value of prompt, which may be used later in JavaScript.
Personally I appreciate this Symantec security response with high regards because it willingly and honestly, highlight to Symantec’s users a transparent view of how they handle security threats, as such that the following have been performed.
- Reverse engineering of the malware app.
- Analyse encrypted messages in a manner of binary, hex code via sniffing methods Perform decryption on messages for further analysis
The main intention of this security response is premised on the idea whether or not this malware which creatively ‘cheat’ user into subscribing to unwanted contents and services violated any law.
It concludes three things
- Yes, the law can be manipulated to a certain ways,
- and users should always read the end user license (EUL) for any illegal intents but,
- no matter whether it has a license agreement or not, a file with malicious intent is still malicious.
Security analysis should leverage on the power of cloud computing and big data technology to help with their cause.
