Hacker News Reader

Comment by batch12 | Hacker News Reader

Based on this, I just reversed both Android apps and am not seeing strings related to wikimedia nor asternovi. This doesn't mean it's not obfuscated somehow though. The only app I've found the strings in so far is the "ravn" app proposed by @taviso. As mentioned in the twitter thread though it doesn't seem to have the install base to cause this traffic--

View on HN

Thanks batch12. In my edit, it could also be related to a check-in app used at public spaces in India - as it increases from the 8th of June which matches when the India-wide lockdown began to lift. Perhaps a reverse of qr code scan checkin apps in India could be useful?

Could be-- I checked about 50 apps from alternative lists that popped up after the ban with no luck except for that one I mentioned before.

Looks like they posted shortly after yours on the ticket that they found the culprit. Guess we'll find out tomorrow if we were on the right path.

Yeah hopefully they have a bit of a write up too about how they worked it out - interesting problem to solve!

I took a look at the apk and noticed this in the manifest. "com.blockeq.stellarwallet.WalletApplication" Stellar Lumens is a fairly popular crypto currency. I wonder if the app has built in support for crypto transactions. If not, maybe it's malware to mine crypto coins.

https://i.imgur.com/o8DllVd.png

It is a crypto chat application:

>Ravn is your portal to the most private messenger as well as Korrax our proprietary token. Stay up to date with Korrax and other Cryptos and join the crypto group chats.

>Messages, images and docs are never stored on a server (after delivery), they’re only locally stored on your own phone. Ravn is not tied to your phone number or email, you only sign up with a username that isn’t searchable or discoverable.

Stupid question: how did you reverse the app in Android Studio?

I downloaded the APK and then used "Profile or Debug APK" under file in Android Studio and ctrl/cmd+shift+f to search for strings.

I don't know much about Android development or APKs but it's not exactly "reversing." from what I understand the profile/debug converts the .dex files from the APK to .smali which is human readable.

You can use the "Analyse APK" feature, but you probably rather want to use tools like jadx or apktool that provides fairly good decompilation.

Reply on news.ycombinator.com