J'ai remarqué un comportement inhabituel et indésirable de certaines de mes applications système, notamment Google Play Services, Google Account Manager et Google Services Framework. Ces applications provoquent des fermetures forcées de leurs propres opérations ainsi que de celles d'autres applications, elles semblent avoir la capacité de prendre complètement le contrôle des fonctionnalités de mon téléphone à certains moments.
J'ai donc utilisé l'outil Virustotal.com pour analyser les permissions de ces applications afin de déterminer si elles sont présentes avec les bonnes capacités intégrées dans la version préinstallée sur le téléphone. Pour chacune de ces applications, j'ai trouvé entre 10 et 20 autorisations supplémentaires qu'elles n'étaient pas censées avoir, ce qui suggère qu'elles ont été modifiées.
Mon téléphone n'est pas enraciné ni modifié d'aucune façon et je l'ai depuis moins d'un an. Ces permissions supplémentaires ont été étiquetées :
(Permission inconnue de la référence Android)
en désignant ces autorisations spécifiques comme n'étant pas natives de ces applications. Certaines de ces autorisations sont spécifiquement conçues pour la transmission et la communication de données via C2DM et Gtalk à d'autres appareils, ainsi que pour l'exposition des détails des comptes enregistrés, y compris les mots de passe. Cela m'amène à conclure que des informations personnelles sensibles ont été divulguées à des tiers. Voici le résultat pour Google Account Manager à titre d'exemple :
VirusTotal
SHA256: 602db0ceb05877fb6996fd2a3510721d0e32463a6e784ba5cc60ae1f71bb3226
File name: GoogleLoginService.apk
Detection ratio: 0 / 53
Analysis date: 2014-07-20 19:04:51 UTC ( 9 months, 1 week ago )
0
0
Analysis
File detail
Additional information
Comments 0
Votes
Behavioural information
The file being studied is Android related! APK Android file more specifically. The application's main package name is com.google.android.gsf.login. The internal version number of the application is 19. The displayed version string of the application is 4.4.4-1215936. The minimum Android API level for the application to run (MinSDKVersion) is 8. The target Android API level for the application to run (TargetSDKVersion) is 17.
Risk summary
The studied DEX file makes use of API reflection
Permissions that allow the application to access Internet
Permissions that allow the application to access private information
Other permissions that could be considered as dangerous in certain scenarios
Required permissions
android.permission.CHANGE_NETWORK_STATE (change network connectivity)
android.permission.READ_SYNC_SETTINGS (read sync settings)
com.google.android.providers.gsf.permission.READ_GSERVICES (Unknown permission from android reference)
android.permission.USE_CREDENTIALS (use the authentication credentials of an account)
android.permission.DUMP (retrieve system internal status)
android.permission.READ_LOGS (read sensitive log data)
android.permission.WRITE_PROFILE (write the user's personal profile data)
android.permission.CHANGE_COMPONENT_ENABLED_STATE (enable or disable application components)
android.permission.READ_SYNC_STATS (read sync statistics)
android.permission.RECEIVE_BOOT_COMPLETED (automatically start at boot)
android.permission.INTERNET (full Internet access)
com.google.android.googleapps.permission.GOOGLE_MAIL_SWITCH (Unknown permission from android reference)
android.permission.BACKUP (control system back up and restore)
com.google.android.googleapps.permission.GOOGLE_AUTH.youtube (Unknown permission from android reference)
android.permission.SUBSCRIBED_FEEDS_READ (read subscribed feeds)
android.permission.MANAGE_ACCOUNTS (manage the accounts list)
com.google.android.gtalkservice.permission.GTALK_SERVICE (Unknown permission from android reference)
com.google.android.permission.BROADCAST_DATA_MESSAGE (Unknown permission from android reference)
com.google.android.googleapps.permission.GOOGLE_AUTH.YouTubeUser (Unknown permission from android reference)
android.permission.PERSISTENT_ACTIVITY (make application always run)
com.google.android.googleapps.permission.GOOGLE_AUTH.ALL_SERVICES (Unknown permission from android reference)
com.android.vending.TOS_ACKED (Unknown permission from android reference)
android.permission.ACCESS_NETWORK_STATE (view network status)
com.google.android.providers.settings.permission.READ_GSETTINGS (Unknown permission from android reference)
com.google.android.providers.settings.permission.WRITE_GSETTINGS (Unknown permission from android reference)
com.google.android.googleapps.permission.GOOGLE_AUTH (Unknown permission from android reference)
android.permission.WRITE_CONTACTS (write contact data)
android.permission.WRITE_SYNC_SETTINGS (write sync settings)
android.permission.AUTHENTICATE_ACCOUNTS (act as an account authenticator)
android.permission.BROADCAST_STICKY (send sticky broadcast)
com.android.vending.billing.BILLING_ACCOUNT_SERVICE (Unknown permission from android reference)
android.permission.WRITE_SETTINGS (modify global system settings)
android.permission.READ_PHONE_STATE (read phone state and identity)
com.google.android.googleapps.permission.GOOGLE_AUTH.mail (Unknown permission from android reference)
com.android.vending.INTENT_VENDING_ONLY (Unknown permission from android reference)
com.google.android.providers.talk.permission.READ_ONLY (Unknown permission from android reference)
com.google.android.googleapps.permission.ACCESS_GOOGLE_PASSWORD (Unknown permission from android reference)
com.google.android.providers.talk.permission.WRITE_ONLY (Unknown permission from android reference)
android.permission.VIBRATE (control vibrator)
com.android.chrome.TOS_ACKED (Unknown permission from android reference)
android.permission.SUBSCRIBED_FEEDS_WRITE (write subscribed feeds)
android.permission.ACCESS_WIFI_STATE (view Wi-Fi status)
com.android.vending.billing.ADD_CREDIT_CARD (Unknown permission from android reference)
android.permission.WAKE_LOCK (prevent phone from sleeping)
android.permission.CHANGE_WIFI_STATE (change Wi-Fi status)
android.permission.READ_CONTACTS (read contact data)
com.android.vending.billing.IBillingAccountService.BIND2 (Unknown permission from android reference)
android.permission.READ_PROFILE (read the user's personal profile data)
com.google.android.gtalkservice.permission.SEND_HEARTBEAT (Unknown permission from android reference)
android.permission.GET_ACCOUNTS (discover known accounts)
Permission-related API calls
ACCESS_NETWORK_STATE
Landroid/net/ConnectivityManager;->getActiveNetworkInfo()Landroid/net/NetworkInfo; called from Lcom/google/android/gsf/loginservice/BaseActivity;->hasNetworkConnection()Z
READ_PHONE_STATE
Landroid/telephony/TelephonyManager;->getLine1Number()Ljava/lang/String; called from Lcom/google/android/gsf/login/RecoveryDataActivity;->initViews(Landroid/os/Bundle;)V
USE_CREDENTIALS
Landroid/accounts/AccountManager;->invalidateAuthToken(Ljava/lang/String; Ljava/lang/String;)V called from Lcom/google/android/gsf/loginservice/GoogleLoginService$GlsImplementation;->invalidateAuthToken(Ljava/lang/String;)V
INTERNET
Ljava/net/ServerSocket;-><init>(I)V called from Lcom/google/android/common/http/TestHttpServer;-><init>(I)V
Landroid/webkit/WebView;-><init>(Landroid/content/Context;)V called from Lcom/google/android/common/GoogleWebContentHelper;->initializeViews()V
Landroid/webkit/WebView;-><init>(Landroid/content/Context;)V called from Lcom/google/android/gsf/login/CustomWebView;-><init>(Landroid/content/Context;)V
VIBRATE
Landroid/app/NotificationManager;->notify(I Landroid/app/Notification;)V called from Lcom/google/android/gms/auth/GoogleAuthUtil;->a(Landroid/content/Context; Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;
ACCESS_WIFI_STATE
Landroid/net/wifi/WifiManager;->getWifiState()I called from Lcom/google/android/gsf/login/SetupWirelessActivity;->tryEnablingWifi()Z
GET_ACCOUNTS
Landroid/accounts/AccountManager;->getAccountsByType(Ljava/lang/String;)[Landroid/accounts/Account; called from Lcom/google/android/gsf/login/BaseActivity;->isFirstAccount()Z
Landroid/accounts/AccountManager;->getAccountsByType(Ljava/lang/String;)[Landroid/accounts/Account; called from Lcom/google/android/gsf/login/AccountIntroActivity;->maybeSkipAccountSetup()Z
Landroid/accounts/AccountManager;->getAccountsByType(Ljava/lang/String;)[Landroid/accounts/Account; called from Lcom/google/android/gsf/login/EduLoginActivity;->removeAnyNewAccounts()V
READ_SYNC_SETTINGS
Landroid/content/ContentResolver;->getIsSyncable(Landroid/accounts/Account; Ljava/lang/String;)I called from Lcom/google/android/gsf/login/SyncSettingsFragment;->updateListViewData(Landroid/accounts/Account;)V
CHANGE_COMPONENT_ENABLED_STATE
Landroid/content/pm/PackageManager;->setApplicationEnabledSetting(Ljava/lang/String; I I)V called from Lcom/google/android/gsf/login/ShowErrorActivity;->onClick(Landroid/view/View;)V
MANAGE_ACCOUNTS
Landroid/accounts/AccountManager;->removeAccount(Landroid/accounts/Account; Landroid/accounts/AccountManagerCallback; Landroid/os/Handler;)Landroid/accounts/AccountManagerFuture; called from Lcom/google/android/gsf/login/EduLoginActivity;->removeAnyNewAccounts()V
Landroid/accounts/AccountManager;->removeAccount(Landroid/accounts/Account; Landroid/accounts/AccountManagerCallback; Landroid/os/Handler;)Landroid/accounts/AccountManagerFuture; called from Lcom/google/android/gsf/loginservice/GoogleLoginService$GlsImplementation;->deleteAllAccounts()V
Landroid/accounts/AccountManager;->removeAccount(Landroid/accounts/Account; Landroid/accounts/AccountManagerCallback; Landroid/os/Handler;)Landroid/accounts/AccountManagerFuture; called from Lcom/google/android/gsf/loginservice/GoogleLoginService$GlsImplementation;->deleteOneAccount(Ljava/lang/String;)V
AUTHENTICATE_ACCOUNTS
Landroid/accounts/AccountManager;->getUserData(Landroid/accounts/Account; Ljava/lang/String;)Ljava/lang/String; called from Lcom/google/android/gsf/loginservice/GoogleLoginService;->accountHasFeatures(Landroid/accounts/AccountManager; Landroid/accounts/Account; [Ljava/lang/String;)Z
Activities
com.google.android.gsf.login.AccountIntroActivity
com.google.android.gsf.login.AccountPreIntroUIActivity
com.google.android.gsf.login.AccountIntroUIActivity
com.google.android.gsf.login.PlusQueryActivity
com.google.android.gsf.login.PlusFaqActivity
com.google.android.gsf.login.NameActivity
com.google.android.gsf.login.BadNameActivity
com.google.android.gsf.login.PhotoActivity
com.google.android.gsf.login.LearnMoreActivity
com.google.android.gsf.login.WaitForDeviceCountryActivity
com.google.android.gsf.login.CaptchaActivity
com.google.android.gsf.login.SetupWirelessIntroActivity
com.google.android.gsf.login.SetupWirelessActivity
com.google.android.gsf.login.LoginActivity
com.google.android.gsf.login.EduLoginActivity
com.google.android.gsf.login.UsernamePasswordActivity
com.google.android.gsf.login.PrepareAccountSetupActivity
com.google.android.gsf.login.LoginActivityTask
com.google.android.gsf.login.ShowErrorActivity
com.google.android.gsf.login.SyncIntroActivity
com.google.android.gsf.login.CreateAccountActivity
com.google.android.gsf.login.PlusActivity
com.google.android.gsf.login.PlusCheckTask
com.google.android.gsf.login.UsernameActivity
com.google.android.gsf.login.CreateAccountTask
com.google.android.gsf.login.ProfileTask
com.google.android.gsf.login.NameCheckTask
com.google.android.gsf.login.CheckAvailTask
com.google.android.gsf.login.SuggestUsernameActivity
com.google.android.gsf.login.VerifyProfileActivity
com.google.android.gsf.login.ChoosePasswordActivity
com.google.android.gsf.login.RecoveryIntroActivity
com.google.android.gsf.login.GetCountryListTask
com.google.android.gsf.login.RecoveryDataActivity
com.google.android.gsf.login.AccountSecurityActivity
com.google.android.gsf.login.PicassaInfoActivity
com.google.android.gsf.login.GoogleServicesActivity
com.google.android.gsf.login.TermsOfServiceActivity
com.google.android.gsf.login.BrowserActivity
com.google.android.gsf.loginservice.GrantCredentialsPermissionActivity
Services
com.google.android.gsf.loginservice.GoogleLoginService
Receivers
com.google.android.gsf.login.DevicePolicyActivatedReceiver
Service-related intent filters
com.google.android.gsf.loginservice.GoogleLoginService
actions: android.accounts.AccountAuthenticator, com.google.android.gsf.action.GET_GLS
Activity-related intent filters
com.google.android.gsf.login.AccountIntroActivity
actions: com.google.android.accounts.AccountIntro, android.intent.action.MAIN
categories: android.intent.category.DEFAULT
Receiver-related intent filters
com.google.android.gsf.login.DevicePolicyActivatedReceiver
actions: com.google.android.apps.enterprise.dmagent.AUTO_REGISTRATION_FINISHED
Code-related observations
The application does not load any code dynamically
The application contains reflection code
The application does not contain native code
The application does not contain cryptographic code
Application certificate information
Issuer
DN: C=US, ST=California, L=Mountain View, O=Google Inc., OU=Android, CN=Android
C: US
CN: Android
L: Mountain View
O: Google Inc.
S: California
OU: Android
Subject
DN: C=US, ST=California, L=Mountain View, O=Google Inc., OU=Android, CN=Android
C: US
CN: Android
L: Mountain View
O: Google Inc.
S: California
OU: AndroidA qui dois-je porter cette information à l'attention ? Est-il à peu près certain que mon téléphone est complètement compromis ?
