TODO List

[wargio]

Android

• Check APK Signature
  • rizin can open META-INF/CERT.RSA and print the pkcs7 data from pFp
• Check Certificates and validity, bad hashes, etc..
• Detect trackers
• App is debuggable example
• Exported example issue - Partial
• Test all android security best practies link

iOS

• Weak rand function
• Sandbox Behavior (like successfully use fork() because calls to fork() are disallowed on a stock iOS device).
• TrustKit pinning.

[nartes]

Any way to detect this kind of malware?

An example of APK trojan that seem to be available at Google Play for a while.
Idk what way does Google check published apps.

[wargio]

i guess it is possible to add r2yara and add rules regarding malwares on the bins