An investigation of Chrysaor Malware on Android

Posted by Rich Cannings, Jason Woloz, Neel Mehta, Ken Bodzak, Wentao Chang, Megan Ruthven



Google is constantly working to improve our systems that protect users from Potentially
Harmful Applications (PHAs). Usually, PHA authors attempt to install their
harmful apps on as many devices as possible. However, a few PHA authors spend
substantial effort, time, and money to create and install their harmful app on
one or a very small number of devices. This is known as a targeted attack.




In this blog post, we describe Chrysaor, a newly discovered family of spyware
that was used in a targeted attack on a small number of Android devices, and how
investigations like this help Google protect Android users from a variety of
threats.

What is Chrysaor?

Chrysaor is spyware believed to be created by NSO Group Technologies,
specializing in the creation and sale of software and infrastructure for
targeted attacks. Chrysaor is believed to be related to the Pegasus spyware that
was first
identified on iOS and analyzed by Citizen
Lab and Lookout.




Late last year, after receiving a list of suspicious package names from Lookout,
we discovered that a few dozen Android devices may have installed an application
related to Pegasus, which we named Chrysaor. Although the applications were
never available in Google Play, we immediately identified the scope of the
problem by using Verify Apps.
We gathered information from affected devices, and concurrently, attempted to
acquire Chrysaor apps to better understand its impact on users. We've contacted
the potentially affected users, disabled the applications on affected devices,
and implemented changes in Verify Apps to protect all users.

What is the scope of Chrysaor?

Chrysaor was never available in Google Play and had a very low volume of
installs outside of Google Play. Among the over 1.4 billion devices protected by
Verify Apps, we observed fewer than 3 dozen installs of Chrysaor on victim
devices. These devices were located in the following countries:

How we protect you

To protect Android devices and users, Google Play provides a complete set of
security services that update outside of platform releases. Users don't have to
install any additional security services to keep their devices safe. In 2016,
these services protected over 1.4 billion devices, making Google one of the
largest providers of on-device security services in the world:

• Identify
  PHAs using people, systems in the cloud, and data sent to us from devices
  


• Warn users
  about or blocking users from installing PHAs
  


• Continually
  scan devices for PHAs and other harmful threats

Additionally, we are providing detailed technical information to help the
security industry in our collective work against PHAs.

What do I need to do?

It is extremely unlikely you or someone you know was affected by Chrysaor
malware. Through our investigation, we identified less than 3 dozen devices
affected by Chrysaor, we have disabled Chrysaor on those devices, and we have
notified users of all known affected devices. Additionally, the improvements we
made to our protections have been enabled for all users of our security
services.


To ensure you are fully protected against PHAs and other threats, we recommend
these 5 basic steps:

• Install apps only from reputable sources: Install apps from
  a reputable source, such as Google Play. No
  Chrysaor apps were on Google Play.
  


• Enable a
  secure lock screen: Pick a PIN, pattern, or password that is easy
  for you to remember and hard for others to guess.
  


• Update
  your device: Keep your device up-to-date with the latest security
  patches.
  


• Verify
  Apps: Ensure Verify Apps is enabled.
  


• Locate your device: Practice finding your device with Android Device Manager
  because you are far more likely to lose your device than install a
  PHA.

How does Chrysaor work?

To install Chrysaor, we believe an attacker coaxed specifically targeted
individuals to download the malicious software onto their device. Once Chrysaor
is installed, a remote operator is able to surveil the victim's activities on
the device and within the vicinity, leveraging microphone, camera, data
collection, and logging and tracking application activities on communication
apps such as phone and SMS.




One representative sample Chrysaor app that we analyzed was tailored to devices
running Jellybean (4.3) or earlier. The following is a review of scope and
impact of the Chrysaor app named com.network.android tailored for a
Samsung device target, with SHA256 digest:

ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

Upon installation, the app uses known framaroot exploits to escalate privileges
and break Android's application sandbox. If the targeted device is not
vulnerable to these exploits, then the app attempts to use a superuser binary
pre-positioned at /system/csk to elevate privileges.




After escalating privileges, the app immediately protects itself and starts to
collect data, by:

• Installing itself on the /system partition to persist across
  factory resets
  


• Removing Samsung's system update app
  (com.sec.android.fotaclient) and disabling auto-updates to maintain
  persistence (sets Settings.System.SOFTWARE_UPDATE_AUTO_UPDATE to 0)
  


• Deleting WAP push messages and changing WAP message settings, possibly for
  anti-forensic purpose.
  


• Starting content observers and the main task loop to receive remote commands
  and exfiltrate data

The app uses six techniques to collect user data:

• Repeated commands: use alarms to periodically repeat
  actions on the device to expose data, including gathering location data.
  


• Data collectors: dump all existing content on the device
  into a queue. Data collectors are used in conjunction with repeated commands to
  collect user data including, SMS settings, SMS messages, Call logs, Browser
  History, Calendar, Contacts, Emails, and messages from selected messaging apps,
  including WhatsApp, Twitter, Facebook, Kakoa, Viber, and Skype by making
  /data/data directories of the apps world readable.
  


• Content observers: use Android's ContentObserver
  framework to gather changes in SMS, Calendar, Contacts, Cell info, Email,
  WhatsApp, Facebook, Twitter, Kakao, Viber, and Skype.
  


• Screenshots: captures an image of the current screen via
  the raw frame buffer.
  


• Keylogging: record input events by hooking
  IPCThreadState::Transact from
  /system/lib/libbinder.so, and intercepting android::parcel with the
  interface com.android.internal.view.IInputContext.
  


• RoomTap: silently answers a telephone call and stays
  connected in the background, allowing the caller to hear conversations within
  the range of the phone's microphone. If the user unlocks their device, they will
  see a black screen while the app drops the call, resets call settings and
  prepares for the user to interact with the device normally.

Finally, the app can remove itself through three ways:

• Via a command from the server
  


• Autoremove if the device has not been able to check in to the server after
  60 days
  


• Via an antidote file. If /sdcard/MemosForNotes was present on
  the device, the Chrysaor app removes itself from the device.

Samples uploaded to VirusTotal

To encourage further research in the security community, we�ve uploaded these sample Chrysaor apps to Virus Total.

Package Name	SHA256 digest	SHA1 certificate
com.network.android	ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5	44f6d1caa257799e57f0ecaf4e2e216178f4cb3d
com.network.android	3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86	516f8f516cc0fd8db53785a48c0a86554f75c3ba

Additional digests with links to Chrysaor

As a result of our investigation we have identified these additional Chrysaor-related apps.

Package Name	SHA256 digest	SHA1 certificate
com.network.android	98ca5f94638768e7b58889bb5df4584bf5b6af56b188da48c10a02648791b30c	516f8f516cc0fd8db53785a48c0a86554f75c3ba
com.network.android	5353212b70aa096d918e4eb6b49eb5ad8f59d9bec02d089e88802c01e707c3a1	44f6d1caa257799e57f0ecaf4e2e216178f4cb3d
com.binary.sms.receiver	9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae	7771af1ad3a3d9c0b4d9b55260bb47c2692722cf
com.android.copy	e384694d3d17cd88ec3a66c740c6398e07b8ee401320ca61e26bdf96c20485b4	7771af1ad3a3d9c0b4d9b55260bb47c2692722cf
com.android.copy	12e085ab85db887438655feebd249127d813e31df766f8c7b009f9519916e389	7771af1ad3a3d9c0b4d9b55260bb47c2692722cf
com.android.copy	6348104f8ef22eba5ac8ee737b192887629de987badbb1642e347d0dd01420f8	31a8633c2cd67ae965524d0b2192e9f14d04d016

Lookout has completed their own independent analysis of the samples we acquired, their report can be viewed here.

5 tips for indie game success, from indie game developers

Posted by Sarah Thomson, BD Partnerships Lead, Indies, Google Play
Games




Mobile gaming is a fun place to be right now. It's a landscape seeing tremendous
success year after year with great potential for additional growth and
innovation. It's also a space where developers can express themselves with
creative game styles, mechanics, design and more. This is what the indie
community does best.




Here are 5 tips for indies by indies, shared by our gaming partners at 505
Games, About
Fun, Disruptor
Beam, Klei
Entertainment, and Schell
Games.

1. Embrace being indie

Indies are inherently smaller operations and should embrace their agility and
ability to take risks. Petr Vodak, CEO at About
Fun, recommends getting your product out there so you can
start taking feedback and apply your learnings to future projects. Don't be
afraid to fail! Remaining flexible and building in modularity so you can evolve
with the business needs is a strategy embraced by Pete Arden, CMO at Disruptor
Beam. For instance, with their game Star Trek Timelines, the initial user
experience was tailored to avid Star Trek fans. Over time, as user acquisition
costs increased, they've changed the new player experience to appeal to their
evolving user base of gamers looking for a fun entertainment experience and less
the specific Star Trek IP.

2. Find a way to stand out

To help stand out in the ultra competitive mobile space, Jesse Schell, CEO of Schell
Games, recommends doing something clever or very different. This strategy
has led them to explore the growth areas of new platforms such as AR & VR. While
new platforms present a field for opportunity and creativity, they're best to be
approached with the long term in mind allowing you to sustain the business until
critical mass is reached.

3. Build a community

There are many ways to build communities. If you have an existing fan base on
other platforms, cross-promote to drive awareness of your mobile offerings. You
can also look at porting titles over, but be aware of the differences in mobile
gaming habits and ensure you adapt your game accordingly.

4. Engage after install

Both 505
Games and Klei
Entertainment recommend running your premium titles as a service. Through
monitoring user reviews you can gain invaluable feedback and trends helping you
better understand user pain points and desires. In addition, by releasing
regular content updates and in-game events you create reason for users to get
back in the game. This not only drives reengagement, but 505 Games also sees
strong spikes in new installs aligned with major game updates.

5. Monetize in different ways

Similar strategy to above, dropping regular content refreshes and game updates
while offering a variety of monetization options gives users more ways to engage
with your game. Keeping your games fresh gives users reason to come back and
builds loyalty so you can cross-promote to your users with future game launches.




If you're looking for a fun new game to play, check out the great selection on
Indie
Corner on Google Play. And if you're working on a new indie game of your
own, nominate your title for
inclusion.




Watch
more sessions from Google Developer Day at GDC17 on the Android Developers
YouTube channel to learn tips for success. Visit the Android Developers website
to stay up-to-date with features and best practices that will help you grow a
successful business on Google Play.

How useful did you find this blogpost?

? ? ? ? ?

Update your app to take advantage of the larger aspect ratio on new Android flagship devices

Posted by Neto Marin, Developer Advocate, Google Play



To deliver more engaging viewing experiences to their users, many Android OEMs
are experimenting with new, super widescreen smartphones. Samsung has just
announced a new flagship device, the Samsung Galaxy S8, featuring a new
display format with an aspect ratio of 18.5:9. At the Mobile World Congress
earlier this year, LG also launched their new flagship device, the LG G6, with an expanded screen aspect ratio of
18:9.

(Left) An app with a maximum aspect ratio set at 16:9 on an 18.5:9 device 

(Right) An app with a maximum aspect ratio set at or over 18.5:9 on an 18.5:9
device

In order to take full advantage of the larger display formats on these devices,
you should consider increasing your app's maximum supported aspect ratio. To do
so, simply declare an android.max_aspect <meta-data> element in the app's <application> element:

<meta-data android:name="android.max_aspect"
    android:value="ratio_float"/>

Where ratio_float is the maximum aspect ratio your app can support, expressed as (longer dimension /
shorter dimension) in decimal form.




We recommend that you design your app to support aspect ratios of 2.1 or higher.
For this, you would add the following to the <application> element:

<meta-data android:name="android.max_aspect" android:value="2.1" />

Note: if you don't set a value, and android:resizeableActivity
is not true, then the maximum aspect ratio defaults to 1.86 (roughly 16:9) and
your app will not take advantage of the extra screen space.



As more super
widescreen Android devices, like the Samsung Galaxy S8 and the LG G6, become
available, you'll have more opportunities to display more content and create
more engaging experiences with your app.








For more details about how to support multiple screens on Android, please visit the page Supporting Multiple Screens.

Calling all early adopters for Android Studio previews

Posted by Scott Main, Technical Writer

If you love trying out all of the newest features in Android Studio and helping us make it a better IDE, we're making it even easier to download early preview builds with a new website. Here, you can download and stay up to date on all the latest Android Studio previews and other tools announcements.

Android Studio previews give you early access to new features in all aspects of the IDE, plus early versions of other tools such as the Android Emulator and platform SDK previews. You can install multiple versions of Android Studio side-by-side, so if a bug in the preview build blocks your app development, you can keep working on the same project from the stable version.



The latest preview for Android Studio 2.4 just came out last week, and it includes new features to support development with the Android O Developer Preview. You can download and set up the O preview SDK from inside Android Studio, and then use Android O�s XML font resources and autosizing TextView in the Layout Editor.



By building your apps with the Android Studio preview, you're also helping us create a better version of Android Studio. We want to hear from you if you encounter any bugs.

5 tips for building communities on mobile

Posted by Dave Geffon, Partnerships Manager, Google Play Games




The most successful games usually have the strongest communities. They are a
powerful force in driving additional engagement and increasing awareness for
your titles. At GDC 2017, we spoke with a few game developers about best
practices for successfully building their own communities. Watch the panel
session below to hear advice from Seriously,
Social
Point, and Super
Evil MegaCorp.

1. Be authentic

Community is a mindset; be honest, transparent & patient with
your communications. Loyal users are extremely valuable, thus the folks at Super
Evil Megacorp say that you should act like you have to earn every player.



2. Start small

Build a plan and start today. Launch your social media
channels, look into influencers, and create a strategy. Whether it's sharing one
piece of fan art a week across your network, or running a closed beta to gather
feedback from your most valued users, take action and learn what works best for
you and your users.

3. Play match-maker

When finding influencers to support your game, ensure
they're a genuine match. Make sure the influencer's audience is a good fit with
your game and existing community.

4. Seek feedback 

Communities are passionate. Use feedback to understand what
kind of game and features your users want. Be flexible and iterative so you can
react and evolve your game with the needs and desires of your community.
However, don't be afraid to stay true to what you stand for as sometimes you'll
need to agree to disagree with some players.

5. Build for the long-term

The lifespan of games is continuing to grow. Plan
your business strategy, update cycles and community efforts to roll out over
time and expand with your growing experiences and user-base.

Watch
more sessions from Google Developer Day at GDC17 on the Android Developers
YT channel to learn tips for success. Also, visit the Android Developers website
to stay up-to-date with features and best practices that will help you grow a
successful business on Google Play.

How useful did you find this blogpost?

? ? ? ? ?

        

5 tips for launching successful apps and games on Google Play

Posted by Adam Gutterman, Go-To-Market Strategic Lead, Google Play
Games




Last month at the Game Developers Conference (GDC), we held a developer panel
focused on sharing best practices for building successful app and game
businesses. Check out 5 tips for developers, both large and small, as shared by
our gaming partners at Electronic
Arts (EA), Hutch
Games, Nix
Hydra, Space Ape
Games and Omnidrone.

1. Test, test, test

The best time to test, is before you launch; so test boldly and test a lot! Nix
Hydra recommends testing creative, including art style and messaging, as well as
gameplay mechanics, onboarding flows and anything else you're not sure about.
Gathering feedback from real users in advance of launching can highlight what's
working and what can be improved to ensure your game's in the best shape
possible at launch.

2. Store listing experiments

Run experiments on all of your store listing page assets. Taking bold risks
instead of making assumptions allows you to see the impact of different
variables with your actual user base on Google Play. Test in different regions
to ensure your store listing page is optimized for each major market, as they
often perform differently.



3. Early Access program



Space Ape Games recently used Early Access to test different onboarding
experiences and gameplay control methods in their game. Finding the right
combination led them to double-digit growth in D1 retention. Gathering these
results in advance of launch helped the team fine tune and polish the game,
minimizing risk before releasing to the masses.

"Early Access is cool because you can ask the big questions and get real
answers from real players," Joe Raeburn, Founding Product Guy at Space Ape
Games.

Watch the Android Developer Story below to hear how Omnidrone benefits from
Early Access using strong user feedback to improve retention, engagement and
monetization in their game.

Mobile game developer Omnidrone benefits from Early Access.

4. Pre-registration



Electronic Arts has run more than 5 pre-registration campaigns on Google Play.
Pre-registration allows them to start marketing and build awareness for titles
with a clear call-to-action before launch. This gives them a running start on
launch day having built a group of users to activate upon the game's release
resulting in a jump in D1 installs.



5. Seek feedback



All partners strongly recommended seeking feedback early and often. Feedback
tells both sides of the story, by pointing out what's broken as well as what
you're doing right. Find the right time and channels to request feedback,
whether they be in-game, social, email, or even through reading and responding
to reviews
within the Google Play store.




If you're a startup who has an upcoming launch on Google Play or has launched an
app or game recently and you're interested in opportunities like Early Access
and pre-registration, get
in touch with us so we can work with you.




Watch
sessions from Google Developer Day at GDC17 on the Android Developers YT
channel to learn tips for success. Also, visit the Android Developers website to
stay up-to-date with features and best practices that will help you grow a
successful business on Google Play.

How useful did you find this blogpost?

? ? ? ? ?

        

Diverse protections for a diverse ecosystem: Android Security 2016 Year in Review

Posted by Adrian Ludwig & Mel Miller, Android Security Team

Today, we're sharing the third annual Android Security Year In Review, a
comprehensive look at our work to protect more than 1.4 billion Android users
and their data.




Our goal is simple: keep our users safe. In 2016, we improved our abilities to
stop dangerous apps, built new security features into Android 7.0 Nougat, and
collaborated with device manufacturers, researchers, and other members of the
Android ecosystem. For more details, you can read the full
Year in Review report or watch our
webinar.

Protecting you from PHAs

It's critical to keep people safe from Potentially
Harmful Apps (PHAs) that may put their data or devices at risk. Our ongoing
work in this area requires us to find ways to track and stop existing PHAs, and
anticipate new ones that haven't even emerged yet.

Over the years, we've built a variety of systems to address these threats, such
as application analyzers that constantly review apps for unsafe behavior, and
Verify Apps which regularly checks users' devices for PHAs. When these systems
detect PHAs, we warn users, suggest they think twice about downloading a
particular app, or even remove the app from their devices entirely.



We constantly monitor threats and improve our systems over time. Last year's
data reflected those improvements: Verify Apps conducted 750 million daily
checks in 2016, up from 450 million the previous year, enabling us to reduce the
PHA installation rate in the top 50 countries for Android usage.




Google Play continues to be the safest place for Android users to download their
apps. Installs of PHAs from Google Play decreased in nearly every category:

• Now 0.016 percent of installs, trojans dropped by 51.5 percent compared to
  2015
  


• Now 0.003 percent of installs, hostile downloaders dropped by 54.6 percent
  compared to 2015
  


• Now 0.003 percent of installs, backdoors dropped by 30.5 percent compared to
  2015
  


• Now 0.0018 percent of installs, phishing apps dropped by 73.4 percent
  compared to 2015

By the end of 2016, only 0.05 percent of devices that downloaded apps
exclusively from Play contained a PHA; down from 0.15 percent in 2015.




Still, there's more work to do for devices overall, especially those that
install apps from multiple sources. While only 0.71 percent of all Android
devices had PHAs installed at the end of 2016, that was a slight increase from
about 0.5 percent in the beginning of 2015. Using improved tools and the
knowledge we gained in 2016, we think we can reduce the number of devices
affected by PHAs in 2017, no matter where people get their apps.

New security protections in Nougat

Last year, we introduced a
variety of new protections in Nougat, and continued our ongoing work to strengthen
the security of the Linux Kernel.

• Encryption improvements: In Nougat, we introduced
  file-based encryption which enables each user profile on a single device to be
  encrypted with a unique key. If you have personal and work accounts on the same
  device, for example, the key from one account can't unlock data from the other.
  More broadly, encryption of user data has been required for capable Android
  devices since in late 2014, and we now see that feature enabled on over 80
  percent of Android Nougat devices.
  


• New audio and video protections: We did significant work to
  improve
  security and re-architect how Android handles video and audio media. One
  example: We now store different media components into individual sandboxes,
  where previously they lived together. Now if one component is compromised, it
  doesn't automatically have permissions to other components, which helps contain
  any additional issues.
  


• Even more security for enterprise users: We introduced a variety
  of new enterprise security features including "Always On" VPN, which
  protects your data from the moment your device boots up and ensures it isn't
  traveling from a work phone to your personal device via an insecure connection.
  We also added security policy transparency, process logging, improved wifi
  certification handling, and client certification improvements to our growing set of enterprise
  tools.

Working together to secure the Android ecosystem

Sharing information about security threats between Google, device manufacturers,
the research community, and others helps keep all Android users safer. In 2016,
our biggest collaborations were our monthly security updates program and ongoing
partnership with the security research community.




Security updates are regularly highlighted as a pillar of mobile security�and
rightly so. We launched
our monthly security updates program in 2015, following the public
disclosure of a bug in Stagefright, to help accelerate patching security
vulnerabilities across devices from many different device makers. This program
expanded significantly in 2016:

• More than 735 million devices from 200+ manufacturers received a platform
  security update in 2016.
  


• We released monthly Android security updates throughout the year for devices
  running Android 4.4.4 and up�that accounts for 86.3 percent of all active
  Android devices worldwide.
  


• Our carrier and hardware partners helped expand deployment of these updates,
  releasing updates for over half of the top 50 devices worldwide in the last
  quarter of 2016.

We provided monthly security updates for all supported Pixel and Nexus devices
throughout 2016, and we're thrilled to see our partners invest significantly in
regular updates as well. There's still a lot of room for improvement however.
About half of devices in use at the end of 2016 had not received a platform
security update in the previous year. We're working to increase device security
updates by streamlining our security update program to make it easier for
manufacturers to deploy security patches and releasing A/B
updates to make it easier for users to apply those patches.




On the research side, our Android Security Rewards program grew rapidly: we paid
researchers nearly $1 million dollars for their reports in 2016. In
parallel, we worked closely with various security firms to identify and quickly
fix issues that may have posed risks to our users.




We appreciate all of the hard work by Android partners, external researchers,
and teams at Google that led to the progress the ecosystem has made with
security in 2016. But it doesn't stop there. Keeping you safe requires constant
vigilance and effort. We're looking forward to new insights and progress in 2017
and beyond.