At least one step of the analysis has failed, we have been notified. Don't worry, the devil is in the details.
Something seems to be broken? Contact us!
0/58
Threat
com.google.android.apps.carrier.carrierwifi
Google Wi-Fi Provisioner
Analyzed on 2022-06-04T14:36:12.970772
7
permissions
4
activities
4
services
2
receivers
4
domains
File sums
| MD5 | c1d105ae613471b7d78dc1a89936a509 | |
| SHA1 | f5af720dd549120a5b3166313ff40d6a4fda92f5 | |
| SHA256 | ecba156d14d88eeda4afe9b48cf452cae47bdc1da565423c31cfdfe14e107052 | |
| Size | 2.03MB |
APKiD
Information computed with APKiD.
| /tmp/tmpzxpkx2s2 | |
| anti_disassembly |
|
| /tmp/tmpzxpkx2s2!classes.dex | |
| anti_disassembly |
|
| anti_vm |
|
| compiler |
|
| /tmp/tmpzxpkx2s2!classes2.dex | |
| compiler |
|
SSdeep
Information computed with ssdeep.
| APK file | 24576:J1TeJs1d1tRvxnH9EJy2wIJ3i7daBpvcbaM/V5bgBF7pIfG60oB0uErb:5bNvx4HJ3tF1Kgnpf6q | |
| Manifest | 192:qb8YZhv1Xjl1qoOeY3Ey43FDgAbTcCTTTdTD3TCT+3T+gT0ATkaT1THTOlTySZSJ:… | |
| classes.dex | 24576:h1TeJs1d1tRvxnH9EJy2wIJ3i7daBpvcT:hbNvx4HJ3tFe | |
| classes2.dex | 3072:SlAGOkctLG2NSe9l9su03TO7uDzojwM4v35Rllvo8bpwvALO88Lc:SYnLwOvb03T… |
Dexofuzzy
Information computed with Dexofuzzy.
APK details
Information computed with AndroGuard and Pithus.
Certificate details
Information computed with AndroGuard.
File Analysis
Information computed with MobSF.
| Findings | Files |
|---|---|
| Certificate/Key files hardcoded inside the app. |
META-INF/services/com.google.protobuf.GeneratedExtensionRegistryLoader |
Manifest analysis
Information computed with MobSF.
| Low | App is direct-boot aware [android:directBootAware=true] This app can run before the user unlocks the device. If you're using a custom subclass of Application, and if any component inside your application is direct - boot aware, then your entire custom application is considered to be direct - boot aware.During Direct Boot, your application can only access the data that is stored in device protected storage. |
| High | Broadcast Receiver (com.google.android.apps.carrier.carrierwifi.CarrierWifiReceiver) is not Protected. [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (com.google.android.wsu.openroaming.SignUpActivity) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.NETWORK_SETTINGS [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Activity (com.google.android.wsu.openroaming.ChooseAccountActivity) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.NETWORK_SETTINGS [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Broadcast Receiver (com.google.android.wsu.openroaming.OpenRoamingReceiver) is not Protected. [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Service (com.google.android.wsu.service.WsuServiceImpl) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.NETWORK_SETTINGS [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
Activities
Information computed with AndroGuard.
|
Receivers
Information computed with AndroGuard.
|
Services
Information computed with AndroGuard.
|
Sample timeline
| Oldest file found in APK | Jan. 1, 2009, midnight |
| Latest file found in APK | Jan. 1, 2009, midnight |
| Certificate valid not before | May 8, 2019, 5:38 p.m. |
| First submission on VT | Jan. 3, 2021, 8:08 p.m. |
| Last submission on VT | Aug. 21, 2021, 3:33 p.m. |
| Upload on Pithus | June 4, 2022, 2:36 p.m. |
| Certificate valid not after | May 8, 2049, 5:38 p.m. |
VirusTotal
| Score | 0/58 |
| Report | https://www.virustotal.com/gui/file/ecba156d14d88eeda4afe9b48cf452cae47bdc1da565423c31cfdfe14e107052/detection |
NIAP analysis
Information computed with MobSF.
| FCS_RBG_EXT.1.1 | The application invoke platform-provided DRBG functionality for its cryptographic operations. Random Bit Generation Services |
| FCS_STO_EXT.1.1 | The application does not store any credentials to non-volatile memory. Storage of Credentials |
| FCS_CKM_EXT.1.1 | The application generate no asymmetric cryptographic keys. Cryptographic Key Generation Services |
| FDP_DEC_EXT.1.1 | The application has access to ['network connectivity']. Access to Platform Resources |
| FDP_DEC_EXT.1.2 | The application has access to no sensitive information repositories. Access to Platform Resources |
| FDP_NET_EXT.1.1 | The application has user/application initiated network communications. Network Communications |
| FDP_DAR_EXT.1.1 | The application does not encrypt files in non-volatile memory. Encryption Of Sensitive Application Data |
| FMT_MEC_EXT.1.1 | The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options. Supported Configuration Mechanism |
| FTP_DIT_EXT.1.1 | The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product. Protection of Data in Transit |
| FCS_RBG_EXT.2.1 FCS_RBG_EXT.2.2 |
The application perform all deterministic random bit generation (DRBG) services in accordance with NIST Special Publication 800-90A using Hash_DRBG. The deterministic RBG is seeded by an entropy source that accumulates entropy from a platform-based DRBG and a software-based noise source, with a minimum of 256 bits of entropy at least equal to the greatest security strength (according to NIST SP 800-57) of the keys and hashes that it will generate. Random Bit Generation from Application |
| FCS_HTTPS_EXT.1.2 | The application implement HTTPS using TLS. HTTPS Protocol |
| FCS_HTTPS_EXT.1.3 | The application notify the user and not establish the connection or request application authorization to establish the connection if the peer certificate is deemed invalid. HTTPS Protocol |
| FIA_X509_EXT.2.1 | The application use X.509v3 certificates as defined by RFC 5280 to support authentication for HTTPS , TLS. X.509 Certificate Authentication |
Code analysis
Information computed with MobSF.
Map computed by Pithus.
Domains analysis
Information computed with MobSF.
| US | xmlpull.org | 74.50.61.58 | ||
| US | github.com | 140.82.121.3 | ||
| schemas.android.com | ||||
| US | plus.google.com | 142.250.186.46 |
URL analysis
Information computed with MobSF.
|
https://plus.google.com/ Defined in defpackage/zw.java |
|
|
http://xmlpull.org/v1/doc/features.html#process-namespaces Defined in defpackage/up.java |
|
|
https://github.com/grpc/grpc-java/issues/5015 Defined in defpackage/bde.java |
|
|
http://xmlpull.org/v1/doc/features.html#process-namespaces Defined in defpackage/tn.java |
|
|
http://schemas.android.com/apk/res/android Defined in defpackage/dn.java |
Permissions analysis
Information computed with MobSF.
Threat analysis
Information computed with Quark-Engine.
| Confidence:
|
Load external class |
| Confidence:
|
Find a method from given class name, usually for reflection |
| Confidence:
|
Method reflection |
| Confidence:
|
Retrieve data from broadcast |
| Confidence:
|
Read sensitive data(SMS, CALLLOG, etc) |
| Confidence:
|
Implicit intent(view a web page, make a phone call, etc.) via setData |
| Confidence:
|
Send notification |
| Confidence:
|
Monitor the broadcast action events (BOOT_COMPLETED) |
| Confidence:
|
Get last known location of the device |
| Confidence:
|
Get location of the device |
| Confidence:
|
Method reflection |
| Confidence:
|
Get the time of current location |
| Confidence:
|
Initialize class object dynamically |
| Confidence:
|
Get declared method from given method name |
| Confidence:
|
Get resource file from res/raw directory |
| Confidence:
|
Get specific method from other Dex files |
Behavior analysis
Information computed with MobSF.
Control flow graphs analysis
Information computed by Pithus.
