Added activity overlay, updated README

geeksonsecurity · Aug 8, 2016 · 12c8acc · 12c8acc
1 parent ab5d8ee
commit 12c8acc
Show file tree

Hide file tree

Showing 20 changed files with 390 additions and 119 deletions.
diff --git a/README.md b/README.md
@@ -2,16 +2,28 @@
 
 Harmless Android malware using the overlay technique to steal user credentials.
 
-> **UPDATE** starting with Android 5.1 the [ActivityManager.getRunningAppProcess](http://developer.android.com/reference/android/app/ActivityManager.html#getRunningAppProcesses) API don't return all processes running on the system anymore. We moved to Usage Stats API which requires the user to enable this permission manually. If you want to test on this version you need to enable the application via Settings -> Security -> Apps with usage access
+> **UPDATE** starting with Android 5.1 the [ActivityManager.getRunningAppProcess](http://developer.android.com/reference/android/app/ActivityManager.html#getRunningAppProcesses) API don't return all processes running on the system anymore. We moved to a more *naive* solution which doesn't require any permissions, for more information [press here](http://stackoverflow.com/questions/30619349/android-5-1-1-and-above-getrunningappprocesses-returns-my-application-packag).
 
 ## Disclamier
 This software is intended to sensitize users to this kind of attacks.
 Don't use it for any other purposes!
 
+## Quick Start
+In the main screen you can select which application are going to be overlayed (currently between Linkedin, Skype, and UBS Mobile App).
+Furthermore you can choose the type of overlay between:
+* View overlay with `WindowsManager.addView`
+* Activity overlay with `startActivity`
+
+The application has been tested on Nexus 5 with Android 6 (Real device) and Nexus 5X with Android 4.4.2 (Emulator).
+
+For more background information about overlays please check our [last blog post](http://www.geeksonsecurity.com/android-overlay-malware/2016/07/27/android-overlay-malware-analysis/).
+
 ## Some screenshots
 ### Home Screen
 <img src="images/home.png" width="450" height="800"/>
+
 ### Skype Overlay
 <img src="images/skype_overlay.png" width="450" height="800"/>
+
 ### UBS Overlay
 <img src="images/ubs_overlay.png" width="450" height="800"/>
diff --git a/android-overlay-malware-example.iml b/android-overlay-malware-example.iml
@@ -13,7 +13,7 @@
     <content url="file://$MODULE_DIR$">
       <excludeFolder url="file://$MODULE_DIR$/.gradle" />
     </content>
-    <orderEntry type="inheritedJdk" />
+    <orderEntry type="jdk" jdkName="1.7" jdkType="JavaSDK" />
     <orderEntry type="sourceFolder" forTests="false" />
   </component>
 </module>
diff --git a/app/app.iml b/app/app.iml
@@ -12,10 +12,7 @@
         <option name="SELECTED_TEST_ARTIFACT" value="_android_test_" />
         <option name="ASSEMBLE_TASK_NAME" value="assembleDebug" />
         <option name="COMPILE_JAVA_TASK_NAME" value="compileDebugSources" />
-        <option name="ASSEMBLE_TEST_TASK_NAME" value="assembleDebugAndroidTest" />
-        <option name="COMPILE_JAVA_TEST_TASK_NAME" value="compileDebugAndroidTestSources" />
         <afterSyncTasks>
-          <task>generateDebugAndroidTestSources</task>
           <task>generateDebugSources</task>
         </afterSyncTasks>
         <option name="ALLOW_USER_CONFIGURATION" value="false" />
@@ -28,7 +25,7 @@
   </component>
   <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_7" inherit-compiler-output="false">
     <output url="file://$MODULE_DIR$/build/intermediates/classes/debug" />
-    <output-test url="file://$MODULE_DIR$/build/intermediates/classes/androidTest/debug" />
+    <output-test url="file://$MODULE_DIR$/build/intermediates/classes/test/debug" />
     <exclude-output />
     <content url="file://$MODULE_DIR$">
       <sourceFolder url="file://$MODULE_DIR$/build/generated/source/r/debug" isTestSource="false" generated="true" />
@@ -50,41 +47,63 @@
       <sourceFolder url="file://$MODULE_DIR$/src/debug/java" isTestSource="false" />
       <sourceFolder url="file://$MODULE_DIR$/src/debug/jni" isTestSource="false" />
       <sourceFolder url="file://$MODULE_DIR$/src/debug/rs" isTestSource="false" />
+      <sourceFolder url="file://$MODULE_DIR$/src/debug/shaders" isTestSource="false" />
+      <sourceFolder url="file://$MODULE_DIR$/src/testDebug/res" type="java-test-resource" />
+      <sourceFolder url="file://$MODULE_DIR$/src/testDebug/resources" type="java-test-resource" />
+      <sourceFolder url="file://$MODULE_DIR$/src/testDebug/assets" type="java-test-resource" />
+      <sourceFolder url="file://$MODULE_DIR$/src/testDebug/aidl" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/testDebug/java" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/testDebug/jni" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/testDebug/rs" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/testDebug/shaders" isTestSource="true" />
       <sourceFolder url="file://$MODULE_DIR$/src/main/res" type="java-resource" />
       <sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" />
       <sourceFolder url="file://$MODULE_DIR$/src/main/assets" type="java-resource" />
       <sourceFolder url="file://$MODULE_DIR$/src/main/aidl" isTestSource="false" />
       <sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
       <sourceFolder url="file://$MODULE_DIR$/src/main/jni" isTestSource="false" />
       <sourceFolder url="file://$MODULE_DIR$/src/main/rs" isTestSource="false" />
+      <sourceFolder url="file://$MODULE_DIR$/src/main/shaders" isTestSource="false" />
       <sourceFolder url="file://$MODULE_DIR$/src/androidTest/res" type="java-test-resource" />
       <sourceFolder url="file://$MODULE_DIR$/src/androidTest/resources" type="java-test-resource" />
       <sourceFolder url="file://$MODULE_DIR$/src/androidTest/assets" type="java-test-resource" />
       <sourceFolder url="file://$MODULE_DIR$/src/androidTest/aidl" isTestSource="true" />
       <sourceFolder url="file://$MODULE_DIR$/src/androidTest/java" isTestSource="true" />
       <sourceFolder url="file://$MODULE_DIR$/src/androidTest/jni" isTestSource="true" />
       <sourceFolder url="file://$MODULE_DIR$/src/androidTest/rs" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/androidTest/shaders" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/test/res" type="java-test-resource" />
+      <sourceFolder url="file://$MODULE_DIR$/src/test/resources" type="java-test-resource" />
+      <sourceFolder url="file://$MODULE_DIR$/src/test/assets" type="java-test-resource" />
+      <sourceFolder url="file://$MODULE_DIR$/src/test/aidl" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/test/jni" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/test/rs" isTestSource="true" />
+      <sourceFolder url="file://$MODULE_DIR$/src/test/shaders" isTestSource="true" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/assets" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/blame" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/builds" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/bundles" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/classes" />
-      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/coverage-instrumented-classes" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/dependency-cache" />
-      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/dex" />
-      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/dex-cache" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.android.support/appcompat-v7/22.2.0/jars" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.android.support/support-v4/22.2.0/jars" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental" />
-      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/jacoco" />
-      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/javaResources" />
-      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/libs" />
-      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/lint" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental-classes" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental-runtime-classes" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental-safeguard" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental-verifier" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/instant-run-support" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/jniLibs" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/manifests" />
-      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/ndk" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/pre-dexed" />
-      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/proguard" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/reload-dex" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/res" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/restart-dex" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/rs" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/shaders" />
       <excludeFolder url="file://$MODULE_DIR$/build/intermediates/symbols" />
+      <excludeFolder url="file://$MODULE_DIR$/build/intermediates/transforms" />
       <excludeFolder url="file://$MODULE_DIR$/build/outputs" />
       <excludeFolder url="file://$MODULE_DIR$/build/tmp" />
     </content>

diff --git a/app/build.gradle b/app/build.gradle
@@ -8,8 +8,8 @@ android {
         applicationId "com.geeksonsecurity.malwaredemo"
         minSdkVersion 14
         targetSdkVersion 22
-        versionCode 1
-        versionName "1.0"
+        versionCode 2
+        versionName "1.1"
     }
 
     buildTypes {

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
@@ -6,7 +6,6 @@
     <uses-permission android:name="android.permission.GET_TASKS" />
     <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
-    <uses-permission android:name="android.permission.PACKAGE_USAGE_STATS"/>
 
     <uses-sdk
         android:minSdkVersion="11"
@@ -15,17 +14,28 @@
         android:allowBackup="true"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
-        android:theme="@style/AppBaseTheme">
+        android:theme="@android:style/Theme.Black">
         <service android:name="com.geeksonsecurity.malwaredemo.MainService" />
+
         <activity
             android:name="com.geeksonsecurity.malwaredemo.MainActivity"
             android:configChanges="orientation|screenSize"
-            android:label="@string/app_name">
+            android:label="@string/app_name"
+            android:launchMode="singleTop"
+            android:screenOrientation="portrait"
+            android:theme="@style/Theme.AppCompat">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
         </activity>
+        <activity
+            android:name=".OverlayActivity"
+            android:configChanges="keyboard|keyboardHidden|orientation|screenLayout|screenSize|smallestScreenSize|uiMode"
+            android:excludeFromRecents="true"
+            android:launchMode="singleTask"
+            android:theme="@style/OverlayTheme"
+            android:windowSoftInputMode="stateUnchanged" />
 
         <receiver
             android:name="com.geeksonsecurity.malwaredemo.BootReceiver"

diff --git a/app/src/main/java/com/geeksonsecurity/malwaredemo/MainActivity.java b/app/src/main/java/com/geeksonsecurity/malwaredemo/MainActivity.java
@@ -1,19 +1,24 @@
 package com.geeksonsecurity.malwaredemo;
 
+import android.app.Activity;
 import android.content.Intent;
 import android.os.Bundle;
 import android.support.v7.app.ActionBar;
 import android.support.v7.app.ActionBarActivity;
+import android.support.v7.app.AppCompatActivity;
 import android.text.Html;
 import android.view.View;
+import android.widget.ArrayAdapter;
 import android.widget.Button;
 import android.widget.CheckBox;
+import android.widget.Spinner;
 import android.widget.TextView;
 import android.widget.Toast;
 
+import com.geeksonsecurity.malwaredemo.domain.OverlayType;
 import com.geeksonsecurity.malwaredemo.domain.Settings;
 
-public class MainActivity extends ActionBarActivity {
+public class MainActivity extends AppCompatActivity {
 
     @Override
     protected void onCreate(Bundle savedInstanceState) {    
@@ -45,19 +50,28 @@ protected void onStart() {
         ubsBanking.setChecked(s.isUbsEnabled());
 
         Button save = (Button) findViewById(R.id.saveButton);
+        final Spinner overlayTypeSpinner = (Spinner)findViewById(R.id.overlayTypeSpinner);
         save.setOnClickListener(new View.OnClickListener() {
             @Override
             public void onClick(View view) {
+                OverlayType overlayType = (OverlayType) overlayTypeSpinner.getSelectedItem();
                 s.setSkypeEnabled(skype.isChecked());
                 s.setUbsEnabled(ubsBanking.isChecked());
                 s.setLinkedinEnabled(linkedin.isChecked());
+                s.setOverlayType(overlayType);
                 Settings.Save(getApplicationContext(), s);
                 Toast.makeText(MainActivity.this, "Saved!", Toast.LENGTH_SHORT).show();
-                stopService();
-                startService();
+                Intent intent = new Intent(getApplicationContext(), MainService.class);
+                intent.setAction(ServiceCommunication.UPDATE_SETTINGS);
+                startService(intent);
             }
         });
 
+        ArrayAdapter<OverlayType> detectionEngineArrayAdapter = new ArrayAdapter<>(this,
+                android.R.layout.simple_list_item_1, OverlayType.values());
+        overlayTypeSpinner.setAdapter(detectionEngineArrayAdapter);
+        overlayTypeSpinner.setSelection(detectionEngineArrayAdapter.getPosition(s.getOverlayType()));
+
         TextView footer = (TextView) findViewById(R.id.footer);
         footer.setText(Html.fromHtml(getString(R.string.footer)));
     }
@@ -66,9 +80,4 @@ private void startService() {
         Intent intent = new Intent(this, MainService.class);
         startService(intent);
     }
-
-    private void stopService() {
-        Intent intent = new Intent(this, MainService.class);
-        stopService(intent);
-    }
 }