?????? ???? ?????? ??????? ????? ?? ?????????? ???????? (????) ?? ??? ????? ?? ??? ???? ?????????? ?????? ????????? ????? ?? ?????? ???? ??????? ?? ?????? ?????? ?? ???? ????? ??????? ? ???? ????? ????? subscribe ?????.
?? ?????? ?? ???? Check Point ?? ????? ? ????? ???? ????? ??? ???? ??? ???????? ?? ??? ???? (?? Bread)? ????? ????? ???? ??? ??? ????? ?????? ??????? ???? ?? ???? ???? ???: DEX ???? ?? ?? ?? ???? ???????? ???????? ???????? ??? Base64 ??????? ??????????? obfuscate ?????? ? ??? ?????? ?? ???? ??? ??????? ??????.
?? ?? ????? ?????????? ??? ??????? ???? ??????Check Point ? ????? ???????? (???? ??? ?? ?????[?]) ??????? ???? ???? ?? ??????? ???? ??? ???? ?? ?? ????? ???? ??? ????.
Aviran Hazum ?? Check Point ?? ??????? Joker ?? ??? ???? ??? ?????????? ???[?]: “??????? ???? ???? ??? ???? ??????? ?????????? ??? ?????? ? ?????? ???????????? ???? ?? ?????? ????? ?????? ?? ??????? ???? ???????? ??? ??????? ?? ????? ???. ????? ???? ?????????? ???? ?? ?? ??????? ???? ??? ???? ???? ??? ?? ?????? ????????? ?????? ????? ????? ?? ???? ?????? ?? ????? ???? ?????? ???.”
????: ?? ????????? ??????????? ?? ????? ????
???? ?? ????? ??? ?? ??? ???? ??? ??? ??? ?? ????????? ????? ?????????? ???????? ??? ?? ?? ???? ?????? ??????????? ?? ???????? ? ?????????? ?????? ?? ????? ??? ???? ?????? ???? ???????? SMS? ???????? ???? ? ??????? ??????.
????????? ????? ?? ???? ??? ????? ?????? ?????? ???? ????? ?? ?????? ?? ?????????? ???????? ????? ?? ??? ??????? ???? ????CSIS Security ?Trend Micro ? Dr.Web ? ???????? ??? ????[?-?] ?? ????? ? ????? ??????? ???????????? ???? ??????????? ?? ???? ?? ????????? ?????? ??????? ???? ???? ?????[?].
???? ??????? ????? ????? ???? ????????? ??? ??????? ?? ??? ??? ?????? ?? ????? ???? ?? ??????? ?????? ????? ???????? ???????? ???? ????? ???? ??????? ?? ???????? ??????? ????????? ???? ???? ???? ??????? ???? ??????? ????????? ? ???? ?? ??? ???? ???? ?? ?? ?????? ??? ?????? ?? ??????? ???? ???? ????? ?????? ?? ??? ??????? ????? ?????? ? ??? ????? ???? ?? ????? ???? ?? ???? ??????????????? ?????? ?? ?? ????? ??????.
??? ?????? ? ??? ???? ????? ??????? ?? ????? ??? ???? ????? ???[?]: “???????? ??????? ???? ???? ??? ??????? ????? ?? ????? ???? ??? ? Google Play Protect ????? ????????? ????? ???? ?????????? Bread ????? ???? ???? ?????? ???????? ?????? ?? ????? ????? ????. ????? ??????? ?? ?? ????? ????????? ? obfuscation ??????? ????? ? ???? ????? ?? ??????? ?????.”
?? ???????? ??? ????? ???? ??? ?? ???? ?????? ????????? ?? ??????? ???? ??? ?? ?? ?? ??? ????? ?? ?? ??? ??????? ????? ??? ?????? ??? ???? ???.
??????? ?? ??????? ??????? ???? ???? ???? ?????? DEX ????
??? ????? ?? ???? Check Point ?????? ??? ???? ???? ??? ?? ???? ??? ?? ??????? ?? ???? ???????[?] ?????? ?? ?? ?? ???? ??????? ?? ???? DEX ???????? ??? Base64 ??????? ??????? ??????????? ???? ???????.
???? ??? in-between ?? ???? Check Point ??????? ??? ???? ?? ?????? ????? ???? ???? ???? ?????? .dex ???????? ???????? Base64 ??????? ??????? ??? ????? ?? ???????? ?? ???? ????? ?? ???????? ???? ????? ?????? ? ?? ?? ?? ???? API ??? reflection ??? ??????[??].
Hazum ?? ?????? ??? ?????????? ???????: “???? ??????? ?? ?????? ?????? ??????? ?? ????? ?? ???? ???? ????? ? ????? ?????? ???? ?? ?? ????? ???? ??????? ???? ?? Notification Listener ???????? ???? ?? ???????? ???? ? ?? ?????? dex ???? ???????? ??? ?? ???? C&C ???? ????? ???????.”
????? ?? ???? ??? ??? ???? ?? ?? ????? ???? ??? ?? ?? ????? ????? ?????? ?? ?? ??? ??? ?? ?? ????? “????” ?? ?? ?? ???? C&C ??? ????? ??? ???? ??? ?? ?????????? ???? ?? ?? ???? ????? ??????.
????????? ???????? ??? ???? ?????????? ?????? ??? ???? ?? ??????? ?????? ?????????? ???????? ???? ?? ????? ????? ??? ? ???? ?????? ????? ?? ?????? ?????? ????.
???? ???????? ?? ?? ?? ?? ?????????? ????? ?? ????????????? ???? ???? ?? ????? ? ??????? ?????????? ???? ??? ?? ????? ???? ?? ?????? ??? ?????? ?????? ???? ???? ?? ??? ?????????? ?? ???. ??????? ??????? ???? ???? ?? ?????? ?? ???? ?? ?????? ??????? ?? ?????? ??????? ??? ?? ??? ????? ????.
?????
[?] https://research.checkpoint.com/2020/new-joker-variant-hits-google-play-with-an-old-trick
[?] https://medium.com/csis-techblog/analysis-of-joker-a-spy-premium-subscription-bot-on-googleplay-9ad24f044451
[?] https://blog.trendmicro.com/trendlabs-security-intelligence/fake-photo-beautification-apps-on-google-play-can-read-sms-verification-code-to-trigger-wireless-application-protocol-wap-carrier-billing
[?] https://twitter.com/m0br3v/status/1186277932529942528
[?] https://twitter.com/sh1shk0va/status/1188754354779672576
[?] https://thehackernews.com/2020/02/android-adware-apps-banned.html
[?] https://security.googleblog.com/2020/01/pha-family-highlights-bread-and-friends.html
[?] https://developer.android.com/guide/topics/manifest/manifest-intro
[??] https://www.oracle.com/technical-resources/articles/java/javareflection.html
[??] https://thehackernews.com/2020/07/joker-android-mobile-virus.html
