Malware in F-Droid build of Nextcloud News App
-
- View options
Starting with Version of 0.9.9.75 of the Nextcloud News Android App the F-Droid Version of the app contains additional code that makes suspicious request to an external host. Builds uploaded on Google Play and the GitHub Release Page do not make any suspicious requests.
The app from F-Droid is trying to make a request to caezcs32vtc000025v70gf8xscw(--shortened--).interact.sh.
One of the Nextcloud News users was able to decompile the apk from F-Droid in order to figure out where the request originated from in the source code - the string/request in question is part of the apk downloaded from f-droid, not in the APK you can download from github nor is it part of the sources tarball on f-droid that is claimed to have been used to build that apk.
After decompiling the apk it looks like that the class com/nostra13/universalimageloader/core/ImageLoaderConfiguration.class contains that string (Full decompiled class can be found in the following comment: github.com/nextcloud/news-android). The dependency to the universalimageloader hasn't been updated in the last 4 years and also the build on maven central is 4 years old (maven - universal-image-loader 1.9.5).
We are not sure if this is something that was added on purpose by F-Droid or if it is actually Malware. It looks like interact.sh is an Open-Source Project (https://github.com/projectdiscovery/interactsh) - on their website you can find the following short description of the project:
Interactsh is an Open-Source solution for Out of band Data Extraction, A tool designed to detect bugs that cause external interactions, For example - Blind SQLi, Blind CMDi, SSRF, etc.
If you find communications or exchanges with the Interactsh.com server in your logs, it is possible that someone has been testing your applications using our hosted service, app.interactsh.com You should review the time when these interactions were initiated to identify the person responsible for this testing.
Related ticket in the Nextcloud News App: https://github.com/nextcloud/news-android/issues/1109
Attributes
Status
Assignees
Labels
Parent
Weight
Milestone
Iteration
Dates
Start: None
Due: None
Health status
Time tracking
Activity
Jitpack responded: https://github.com/nextcloud/news-android/issues/1109#issuecomment-1222033175
It's always DNS :(
So, as I understand it:
- https://github.com/nostra13/Android-Universal-Image-Loader used package name com.nostra13.universalimageloader
- A self-proclaimed security researcher, instead of reporting a flaw to Jitpack in a responsible fashion, registered nostra13.com so they could publish libraries to Jitpack under com.nostra13 (I really dislike this type of "researcher" who thinks it's acceptable to infect random people as part of their experiments)
- Gradle for some reason decided to prefer the jitpack.io version of com.nostra13.universalimageloader over the MavenCentral version
- After being told, Jitpack took the offending library down within 24 hours.
Now this is solved, could we maybe rebuild 0.9.9.75 but with an increased versionCode? So, version 0.9.9.75-1 with versionCode 179? That way all existing users would be offered an update to a clean rebuild of 0.9.9.75, only downside being that upstream should skip versionCode 179 their next release.
Gradle for some reason decided to prefer the jitpack.io version of com.nostra13.universalimageloader over the MavenCentral version
This line doesn't just say to use jitpack? https://github.com/nextcloud/news-android/blob/master/build.gradle#L16
Builds fine and it's clean
@David-Development does
could we maybe rebuild 0.9.9.75 but with an increased versionCode? So, version 0.9.9.75-1 with versionCode 179? That way all existing users would be offered an update to a clean rebuild of 0.9.9.75, only downside being that upstream should skip versionCode 179 their next release.
...sound good to you?
Okay
😅 Just published Version 0.9.9.76 - any chance to speed up the release cycle in F-Droid?Ref: https://github.com/nextcloud/news-android/releases/tag/v.0.9.9.76
@David-Development looking at https://monitor.f-droid.org/builds/running we're in the middle of a cycle, will add the new version manually, but we don't have an ETA for the new version to be live.
Done cff45340