Hacker News Reader

Comment by voltagex_ | Hacker News Reader

Can someone get me a copy of the APK for https://play.google.com/store/apps/details?id=com.teleca.sam...? It's likely that this has the SilverPush SDK.

View on HN

https://tusfiles.net/3d5ea3kw8nky

A very cursory look seems to indicate the microphone permission is used by Gracenote (https://developer.gracenote.com/) music recognition SDK.

Thanks - just for next time, tusfiles seems to use very shady advertisers and I happened to open it in Chrome for Android. I was redirected to another APK download!

Sorry about that. I've had problems with Dropbox removing APKs in the past. Tusfiles is very lenient with that sort of thing but clearly there's a downside I hadn't noticed (ad block was enabled).

No worries. If you've got some time, the SilverPush demo apps seem to be obfuscated and are out of my league.

Yeah I'm looking over it right now... I'll see what I can find out, if anything.

Damn, looks like I missed the mark on that one.

I was basing my assumptions on http://stackoverflow.com/questions/32432785/i-have-updated-a... which shows that the package we're looking for is com.silverpush.sdk.

The developer who asked that question works for the company who released that app.

The app description also says "Download MI Mobile and activate today, then just keep your phone with you throughout the day (including while you watch TV) with MI Mobile running in the background." which made me suspicious.

I'm a little dumbfounded that someone who works for SilverPush is soliciting StackOverflow for help integrating the their own SDK within an app.

Anyways... Here's the (clean) link to com.silverpush.sdk: https://www.dropbox.com/s/i9uaoqp10k4lmaf/SilverPush%20Beaco...

Below is just a little bit of relevant source from the demo app. As you can see it certainly appears to be listening for audio beacons. Now the interesting part would be to find an easy way to determine which other apps are using this.

    void a(String s1, String s2, String s3, String s4)
    {
        i();
        p.setVisibility(8);
        w.setVisibility(8);
        s.setVisibility(0);
        s2 = Uri.decode(Uri.encode(s2));
        if ("video".equals(s4.toLowerCase()))
        {
            s2 = new StringBuilder();
            s2.append(s3);
            t.loadDataWithBaseURL("file:///android_asset/", s2.toString(), "text/html", "utf-8", null);
            q.setText("Demo : Audio Beacon Detected");
            r.setText(s1);
            q.setText("Found a match !!");
            return;
        } else
        {
            StringBuilder stringbuilder = new StringBuilder();
            stringbuilder.append("<html><body style='margin:0;padding:0;background-color:black;'><a href='").append(s2).append("' ><img src='").append(s3).append("' height=250 style='margin:0 auto;display:block;' /></a></body></html>");
            t.loadDataWithBaseURL("file:///android_asset/", stringbuilder.toString(), "text/html", "utf-8", null);
            s3 = new StringBuilder();
            s3.append("<html><body style='margin:0;padding:0;background-color:black;'><a href='").append(s2).append("' ><img src='").append(s4).append("' height=50 style='margin:0 auto;display:block;' /></a></body></html>");
            u.loadDataWithBaseURL("file:///android_asset/", s3.toString(), "text/html", "utf-8", null);
            q.setText("Demo : Audio Beacon Detected");
            r.setText(s1);
            q.setText("Found a match !!");
            return;
        }
    }

The package name is obfuscated, correct?

I'm not sure what you're referring to. An aapt dump shows the package name as 'SilverPush Demo App' (version 1.0.3). It appears the same in the app drawer. If you mean the class files, then yes they are obfuscated. ProGuard (or something like it) was used to obfuscate the Java, but that is pretty par for the course.

It is connecting to a few servers:

  http://54.243.149.109:8040/register
  http://54.243.149.109:8086/receiver
  http://ad-x.co.uk/API/click/Hungind45789jo/am554ec53dd8d021/NET/aff_sub/SilverPush?subid=aff_sub2&ord=[random]
  http://mobext.com
  http://silverpush.com

So presumably these (along with other mobile ad networks) can be blocked via hosts file or MinMinGuard (Xposed). Not great, but probably a good course of action for now.

More like we can't scan APKs for particular API calls because it looks like a call to a.a.b.a() internally. I guess package name was the incorrect term to use.

Oh right, yes exactly... Though some of the "Anti-virus" apps are pretty good about identifying ad networks, so I suspect it's not a big problem to detect one way or another. Of course SilverPush could get pretty nefarious if they wanted to, but if that demo app is a proper exhibition of their products then I don't think we should be very afraid :)

Right under my nose instead: https://play.google.com/store/apps/details?id=com.silverpush...

Reply on news.ycombinator.com