SHA1:
- d7f2718eed85e94ae8fb9c240bd67afd04eb31d0 - com.bousfiha.ok
- ae3dcb75a4add1ac0069467a81b7f0d4acfcde87 - com.bousfiha.vk
- 7065c0f612ea29b2e85a0424f1ec6f757b51dd9f - com.ukraina.ok
- f537b90ef638625158478d0a025ba9c27d4c52d2 - com.ukraina.vk
- 094bb0f42964842c55ce5bd1573cc92904a2d699 - com.ukraine.vk
- 1ed76bdd06ba9b2c63b13255d50482432d813650 - com.vk.ukrain
- 5cf39b54750a03b4de2b59345e10462e506347b6 - com.vkukraina.vk2
- 3c2ee846a3f944b6a2a6ee1b8677d60ca48be1af - com.vkukraina.vpn
Detection of potentially dangerous Android programs created for operation with social networks “VK” and “Odnoklassniki” that have been blocked in Ukraine. To bypass access restriction to these websites, anonymizer cameleo.xyz is used.
To log into their account, user must provide their login credentials to the programs. After the input, they are transmitted via anonymizer’s server in an unencrypted state, that fact can lead to a leak of personal information. In addition, mobile device owner doesn’t know they are authorized in the social network via the third-party domain.
An example of authorization in “VK”:
POST http://0s.nrxwo2lo.ozvs4y3pnu.cmle.ru/?act=login&_origin=https://m.vk.com&ip_h=**********0498a292&lg_h=*****5c42
HTTP/1.1 d1f02471f&role=pda&utf8=1
Host: 0s.nrxwo2lo.ozvs4y3pnu.cmle.ru
Connection: keep-alive
Content-Length: 36
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://0s.nu.ozvs4y3pnu.cmle.ru
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 5.1; Philips S337 Build/LMY47D; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
Chrome/46.0.2490.76 Mobile Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://0s.nu.ozvs4y3pnu.cmle.ru/
Accept-Encoding: gzip, deflate
Accept-Language: ru-RU,en-US;q=0.8
Cookie: remixlang=0; remixlhk=********c478eec1ba
X-Requested-With: com.ukraina.vk
email=%2B79650******&pass=**********
An example of authorization in “Odnoklassniki”:
POST HTTP/1.1 http://0s.nu.n5vs44tv.cmle.ru/dk?bk=GuestMain&st.cmd=main&_prevCmd=main&tkn=75**&__dp=y
Host: 0s.nu.n5vs44tv.cmle.ru
Connection: keep-alive
Content-Length: 120
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://0s.nu.n5vs44tv.cmle.ru
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 5.1; Philips S337 Build/LMY47D; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
Chrome/46.0.2490.76 Mobile Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://0s.nu.n5vs44tv.cmle.ru/
Accept-Encoding: gzip, deflate
Accept-Language: ru-RU,en-US;q=0.8
Cookie: bci=********33294360930; TimezoneOffset=-180; ClientTimeDiff=12748; ClientTimeStr=21_5_2017_13_26_36;
__dc=on; JSESSIONID=************f916dd7fafdd2cce4ebc8402992236c70108.265c8f6;
DCAPS=dpr%5E1.5%7Cvw%5E180%7Csw%5E320%7C; SERVERID=774fef8cadd91925575d870e903b3581|WUpRl
X-Requested-With: com.ukraina.ok
fr.posted=set&fr.needCaptcha=&fr.proto=1&fr.login=*****&fr.password=********&button_login=%D0%92%D0%BE%D0%B9%D1%82%D0%B8
In addition, in the course of further work with social networks, these applications don’t encrypt the transmitted data, so personal user information—messages, photos, etc.—can also be compromised.
