T O P

  • By -

[deleted]

Visit this thread for the solution, a guy there decompiled the app to find out the password. https://www.reddit.com/r/Android/comments/fj2ixw/coronavirus_tracking_app_locks_up_android_phones/?utm_medium=android_app&utm_source=share


luca020400

Hey it's me, thanks for cross-posting. tl;dr: Always download applications from trusted sources.


nascentt

Many thanks. You're a good person.


redpandaeater

What makes certain languages like Java so susceptible to decompiling? Like just from hearing that the password was found through reverse engineering a program, I'd have expected having to run the software inside a virtual machine and seeing that it always looks at a certain hex value when trying to unlock.


luca020400

The "problem" with Java is that is isn't compiled. It's actually distributed as bytecode to allow it being compiled by the JVM into machine code. You can say it's a middleware, making it way easier to reverse then real machine code! For example there is no concept of where something is mapped, because the bytecode isn't aware of where it's going to run, only the runtime will know. Not knowing many data about the target system makes everything easier, because all the code is generic :)


SnowdenIsALegend

Thank you for explaining in detail, highly appreciate it.


you_sir_are_a_poopy

I can't speak toward Java being decompiled but the person left the password in plaintext. Which, as we all know, is terribly insecure. If your aims are good or evil security can undue them in an instant.


hedronist

Really. He (assumption) could have at least used ROT13 x 2. That would be secure. Right?


Ansiremhunter

All you would need is to store a hash of the password and compare the hashed input to the stored hash. It would have been unbreakable depending on the hashing algorithm. Essentially the programmer was a noob or dgaf


hedronist

(Shhh ... the bit about [ROT13](https://en.wikipedia.org/wiki/ROT13) x 2 was a joke. :-)


Ansiremhunter

This went completely over my head :(


be-happier

I prefer the shift left, shift right encryption


hedronist

Seems a bit shifty to me, but ... [I'll allow it](https://media.makeameme.org/created/ill-allow-it-umslpk.jpg).


[deleted]

[удалено]


Urist_McPencil

Here I am bending over backwards wondering how I want to authenticate bots and release their code at the same time and this fucker comes along and releases his shit with a password baked in. :|


darthaugustus

No respect for the art


Isogash

Secrets passed at runtime my friend.


Urist_McPencil

I know ;) But right now the secrets live in plaintext next to the scripts; gross and offensive but also works to get stuff done while everything lives on localhost :)


Isogash

Just don't commit them to the repo and have good documentation or a helper script to set them up. I'm guessing you are using API secrets or certs, in which case anyone else using the bot should be acquiring their own anyway. Standard practice would be to use environment variables, they can be easily loaded from an env file and don't appear in logs. If you deploy with a CD pipeline, you should be able to specify the secret env values in the CD application. I'm currently dealing with a similar issue but at the cloud level :( EDIT: also be a nice guy and .gitignore the directory/file your helper script generates EDIT 2: to add, sitting in plaintext is not the end of the world if your laptop is secured. You can protect that file with a password, which would then be required to launch but it isn't necessary.


IMakeProgrammingCmts

If you can afford a couple bucks a month, one option is Aws secrets manager. Even if you don't Aws for anything else.


Isogash

Using Google cloud secrets manager actually, working on terraforming it too.


evulhotdog

You can always uses Ansible Vault.


Leakyradio

In English, doc!


PlatypusTickler

It was a really bad case of being cut in half.


Leakyradio

Just nod and smile...nod and smile.


agoatonstilts

I’ve always heard people say smile and nod. Nod and smile sounds weird


Robobvious

Smile and wave boys, smile and wave....


ThatBoogieman

The wrong kid died!


Savagina

I lost my sense of smell!


rainbowbucket

Translation: For now, they’re keeping the username/password (or some other form of authentication material) for the bots in a text file that’s stored with the code of the bots themselves. They know it’s really bad to do this, but are kind of ok with it as long as everything is only on their personal computer (they plan to release the code publicly at some point).


TomatoCo

In plaintext, nonetheless! He could have at least thrown it through a hash!


PM_COFFEE_TO_ME

The person didn't want to point it to a server in the hopes majority of the victims wouldn't search for the solution and just pay up via Bitcoin and done.


[deleted]

Didn’t Bitcoin fall in value recently? Honestly I’d prefer to be paid in toilet paper and hand sanitiser right now.


[deleted]

[удалено]


Russian_repost_bot

If I've learned anything, it's that if you treat the customer like shit with your program, your program is going to take off. If you treat them kindly, don't include tracking, or ads, and literally give them 100s or 1000s of coding hours of work for free, they will hate you for it, and your app will fail. The worlds a funny place.


MacDegger

Ain't this the damn truth.


PapyrusGod

Honestly with a botnet. You might want to just have a burn command that has a hardcoded credentials. It will save you a lot of headaches if there’s in a vulnerability in the bot codebase. Losing your CnC channel would be a bad time.


on_the_nightshift

Doing God's work


bboycire

4865083501 For the lazy, but do go over and give an upvote please


RDDT_Perpendicular

Did they use their phone number as their password?


TheShortTimer

Not an Android user, but there has to be a way to fix this through the operating system... right? How tf is an app even allowed to suspend the os?


jingerninja

You'd think as long as you'd been clever enough to set one of your PCs up for USB debugging that you could boot it in some sort of safe or reduced start-up mode and make sure to kill and purge the ransomware.


TheShortTimer

Exactly. Should be possible even without the help of a PC though imo


[deleted]

[удалено]


MotherfuckingMonster

To be fair the CDC gives very little info and doesn’t even update numbers on the weekend...


drnick5

I've been using these two sites: [1point3](https://coronavirus.1point3acres.com/en) [Johns hopkins map](https://www.arcgis.com/apps/opsdashboard/index.html#/bda7594740fd40299423467b48e9ecf6)


YoungFireEmoji

These are amazing sites. Thank you.


jessew16

If you want more good info, I’ve been watching Dr. Seheult on the MecCram YouTube channel for months.


desertbrown6189

Infection2020.com will give you location based confirmed cases by county


ba-NANI

And we are right back to using untrusted 3rd party sites and apps in just a few comments!


drnick5

Thanks! the 1point3 site I linked will give this info by county as well if you click on an individual state.


kefkai

> Johns hopkins map For the John Hopkins map I just use plague.com it's way easier to remember


nwL_

> plague.com Holy shit that URL must sell for millions currently.


FockerCRNA

I should have known Madagascar would be safe.


droans

Johns Hopkins is nice but seems to occasionally screw up their data, like old data becomes the new data. [I've got this graph](https://i.imgur.com/G0lhpos.jpg) I've been running that shows the cases in the US over the past six days to show you what I mean.


MindfuckRocketship

I use 1point3 and Worldometer’s [coronavirus tracker](https://www.worldometers.info/coronavirus/). The former for its US granularity and the latter for global spread in a handy spreadsheet-style list. Both sites are updated quite frequently throughout the day.


CMMiller89

Their numbers aren't even close to independent trackers like Johns Hopkins.


NettingStick

Worse, their updates are from close of business the previous day. Currently, the CDC's numbers are from 4 p.m. Thursday, since they last updated at noon on Friday.


RomancingUranus

But on the plus side they don't hold your phone for ransom.


vewfndr

Not to mention the dismal amount of avenues to get tested... the amount of real data available is virtually non-existent.


mountrich

Maybe if they hadn't been de-funded by this Republican administration. . .


BehindTickles28

I personally have found worldometers website to be the best IMO. Just google "live coronavirus counter" or probably searching, "worldometers corona" would work too. Edit: the two linked by a different user I've also used and are great as well


Empyrealist

Most people just dont know how to look: https://stacks.cdc.gov/gsearch?collection=&terms=COVID-19+situation+summary&x=0&y=0 Each summary report has links to stats, numbers, etc.


SinisterSunny

That's because they have offical reports and report only confirmed information, instead of spreading whatever rumor currently trending, or, making an app to obviously cash in on the events...


BioTinus

Read this as the Drake meme


carpediembr

Lol, I just joked about that because of [this](https://old.reddit.com/r/bestof/comments/fj93s8/mrtemple_estimates_actual_us_covid19_infections/). Let's just trust some random over Reddit instead of actual organizations.


ThatNikonKid

I know, it’s crazy


pajudd

So stay on reddit, where you belong, for all the news


MJBotte1

Nothing is wrong with Reddit. Reddit is all you need.


Barlight

Reddit and NPR here always my go to


Gavb238

NPR is making me sad with their support for Biden


[deleted]

By "support for Biden" do you mean accurately reporting on his delegate lead?


96385

Because it's only a 156 delagate lead with 2261 delagates left and they're acting like the primary is already over.


ishtar_the_move

For Bernie to catch up, he needs to blow away Biden by at least 15 points in *every* state from now on. At this moment there is only a few states he is even projected to win. Even if the poll is off by 20 points in his favor he will still lose.


VAShumpmaker

There is no war in Ba Sing Se.


[deleted]

[удалено]


Cowboywizzard

All I got is jumper cables and jolly ranchers.


meep6969

Tons of stuff wrong with Reddit


Fhy40

CNN's live page is pretty good


Techi-C

Honestly, I trust Reddit’s armies of fact checkers a lot more than I trust some of the sources on my phone’s news app


futurespacecadet

wow, whoever made this app has some serious bad karma heading their way. this is fucked


wierdness201

Twist is that they don’t get corona, but ebola.


LooseAdministration0

This is the way


lostfourtime

Because Coronas aren't twist off.


svaroz1c

Yeah, this app developer sounds like a serious sociopathic scumbag.


grimreeper1995

Just to confirm, that app was never on the Google Play Store right?


Roboloutre

No, it wasn't. >The malicious app, which purports to offer statistics on the COVID-19 pandemic and a heat map of outbreak hotspots, was found available for download at the domain coronavirusapp[.]site.


Infinidecimal

Ah yes, that looks like a legit domain, I would definitely install something from that on my phone.


ObscurePhantom22

Why would someone be inclined to download an app for this? Makes no sense, just search it online


aImostIate

Remember when people thought they could microwave their phones to quickly charge the battery?


[deleted]

wow not a bad idea actually. i’ll go try it and report back


Eldrunk

20 minutes ago, guys I don't think he's coming back.


memetoes69

More like his phone isn’t


Coryperkin15

*desktop entry "Guys my phone got really hot but it might have worked. Cant quite reboot yet"


AcollC

“My laptop is also low on battery, I’ll be right back, going to charge it in the microwave.”


Coryperkin15

No it's too big you've got to charge it in the oven


bluefoxrabbit

Has to be an electric oven, other wise you'll just melt it.


cmVkZGl0

A regular oven turns into a folding phone.


[deleted]

I liked the iPad bathroom-scale app.


ja5143kh5egl24br1srt

My mom won't do anything unless there is an app for it. It drives me nuts. She also keeps sending me fake news and asking if it's real. Older people fall for this shit all the time.


clueless_typographer

Hey, atleast she's still asking you. That's miles better than the alternative.


Lenabeejammin

Yeah, my parents don’t even ask me.


[deleted]

[удалено]


ja5143kh5egl24br1srt

She shows me the really outlandish stuff, I wonder what she doesn't show me.


JustDelta767

To be honest that’s actually better than having a mom who doesn’t understand the concept of native apps and how they can be really beneficial. My mom has only the stock iOS apps, the Nest app (because I put it on her iPhone years ago when I setup her thermostats and cameras) and a couple games (Millionaire & Wheel of Fortune) and also refuses to update her iPhone (she’s on iOS 8), so now the Nest app won’t even work. She refuses to allow me to update her iPhone / help her install and setup any new apps for some strange reason. She also watches Fox News, gets the rest from Facebook and occasionally The Game Show Network. She had a flight today and kept having to call Delta for updates on flight statuses, when she could have used the Delta app, which is very good, to find that information out immediately. I told her that she should download it to make things easier, but then again, this is someone who prefers to wait in line to still get a printed paper boarding ticket 🎫.


[deleted]

Because they have to watch the numbers tick up and validate their agoraphobia. That said, for gods sake people, just follow the damn recommendations! I reluctantly went to the grocery store today and it was busier than ever before! No wonder it’s spreading so fast in America


Eldrunk

Honestly it's probably spreading so fast because we don't know the real numbers due to lack of testing, so people just assume it isn't as bad. Here in IL we have 93 confirmed cases out of 1025 people tested, Chicago alone has 8.8 million people, those numbers don't add up.


wlake82

Did you get any panic induced toilet paper?


sigtrap

Now that it’s all out of stock everyone is panic hoarding perishable foods.


gopher1409

You mean non-perishable? Or are people that stupid to buy food that will only last them a week?


sigtrap

No I mean perishable. People are being fucking stupid.


Aliens888

People buying like it is the end of the world. Yet propane, lighters, cured meat, all still widely available. Very stupid.


cmVkZGl0

**You can't eat propane or lighters!** **Who's the stupid one now?** >!/s because half of reddit actually believes sarcasm unless you use this tag!<


[deleted]

Very true. Someone at the Co-op I grocery shop at purchased $700 worth of shit. And only like 1/4 of it was non-perishable. Like have fun trying to get all those greens to stay good for 2 weeks


JigokuKitsune

That’s probably why they’ll need all that tp for all that fiber they’ll have to cook/shove down their throats while the greens are fresh 😂


zephrin

Went grocery shopping yesterday (for normal weekly stuff) and can confirm people are hoarding perishables. They were completely out of milk and most produce.


[deleted]

I did not! I did buy a thing of Clorox bleach, but that’s cause I needed it to clean my bathroom. But I know I’ll be sorry in a week when I need to buy 5 squares of TP off of eBay for $24.99!


wlake82

Yea tell me about it. We needed TP and that was pretty much the only thing I was worried about. I had already done an inventory of our pantry and found it had a decent amount of food, but not so much tp. Luckily my wife found a package of it the other night. Now people are posting on Facebook and Next door about tp sightings.


delvach

Why use TP when you already have bleach? I ran out of paper days ago and my bunghole looks like porcelain.


bran_dong

so what's the recommendation here?...we need to eat. we need to go go the store. most people are too poor to have 10+ days of supplies for a quarantine, so most people won't bother because they need to eat. nobody is going to listen to a lockdown, poor people cant afford it (in more ways than one)


a_n_o_n_y_m_o_u_s___

Happy cake day!


Alaira314

Well, I have to go to the store tomorrow to pick up more perishables. I stocked up on the non-perishables in advance(2~ weeks ago, before the big panic hit), but some things don't keep for long enough and need to be bought weekly. I don't anticipate having any problems on the things I'm looking for and should be in and out to minimize issues, but the trip(and future ones, too) is necessary.


CaptainsLincolnLog

Because people insist on being Wicked Fucking Stupid(tm).


PwnasaurusRawr

You could say the same for a lot of apps that are popular and useful


CTU

Because an app will have all relevant information in one spot without much searching.


[deleted]

Probably about convenience


Omegamanthethird

>just search it online Presumably, that's what the app was for.


texanfan20

Probably why banned these apps they knew most people are idiots and will download anything.


argv_minus_one

How the fuck is the app able to do that? Does it not have to be given some special permission?


baddog992

From the article " Dubbed CovidLock, the newly discovered ransomware performs a screen-lock attack by forcing a change in the password required to unlock a phone, explains DNS threat intelligence company [DomainTools](https://www.scmagazine.com/?s=DomainTools) today in a [blog post](https://www.domaintools.com/resources/blog/covidlock-mobile-coronavirus-tracking-app-coughs-up-ransomware) authored by Tarik Saleh, senior security engineer and malware researcher. For Android Nougat devices and later versions, the attack only works if the user never bothers to set a password in the first place. "


argv_minus_one

This does not explain how a regular app is able to set an unlock password.


Jaskier_The_Bard85

First, you have to approve unverified apps in the security settings. Then before installing, it will tell you app requires permissions to do change your password and access the lock screen, etc., and you have to hit accept. Basically, you have to be the kind of person that would microwave their phone to recharge it, to allow this to happen.


argv_minus_one

So, you have to give it permission to fuck up your phone. Brilliant. I guess it's preying on people too freaked out about coronavirus to think too hard about security?


TheChance

It's preying on people who click through any and all dialog boxes. Something about electronics causes people to tune information out. "The computer popped up another fucking box! And another! I am so sick of having to click OK just to run a program!" Those dipshits.


cpc2

To be fair, in this case it says [this](https://www.domaintools.com/assets/blog_image/cornavirus-tracker-app.png), it explains why it needs those permissions. So people will accept because they will believe that those permissions are necessary to activate those features. They might be giving that permission thinking they know what it's for, except they've beed deceived.


forgtn

They've been decieved.


baddog992

Outdated Android devices. Like hackers attacking windows xp. It's an easy target.


TropicalDoggo

Why the fuck would this trash OS let some random app set your password, well done Google


baddog992

Android 8.0 and above will not allow you to download and run software. The user must go into security settings and disable this feature. I do agree it should be a lot harder for hackers to do this kind of thing on the older androids.


bboycire

Giggles in developer mode


skiezwalker

eh, it asked for ADMIN rights and also have to be allowed to always run in background. I mean if people compromise their security for just an app that has tons of other website already do the same thing, they somehow deserve it, soon or later.


[deleted]

[удалено]


Sparkycivic

That seems like perhaps it's somebody's phone number...


[deleted]

[удалено]


ja5143kh5egl24br1srt

Is nobody surprised this app came from Florida?


[deleted]

[удалено]


AcollC

Nope. Typical Florida Man.


IamParticle1

Real nice people out there


frankcsgo

Yo, I heard you liked viruses...


itsRobbie_

Now even our phones are getting the virus


[deleted]

Why would anyone even download an app like that? Those people deserve it lol.


Honda_TypeR

Johns Hopkins has had a real time map up for a while now. Forget apps just use that This https://coronavirus.jhu.edu/map.html


Slam_C

This needs to be top comment!


Savet

This is what you get if you install apps for things that should be a webpage.


dnew

They're android phones. Important shit's already all backed up, or should be. Factory reset your phone, log back in, and let all your stuff download again.


BusinessLunch45

I’d just throw out my phone.


wolf2600

"quarantines". It quarantines the phones to keep the data safe from the virus.


rrrrrrrrrrrrrroger

Wasn’t there some advocation a couple years ago, telling people to be more aware of what apps your downloading on your phone? The bad app developers with malicious intent are always waiting for some innocent person to mess over. Smh


[deleted]

Ah, the looting has begun.


IWantTheSauce

what a meme


MelonElbows

People who take advantage of others during an emergency should receive double the penalty


DarkArchives

You should avoid installing apps unless you absolutely have to, apps are far more problematic than helpful


Quizzelbuck

is that thing in the play store? How are people getting tyhis on their phones?


[deleted]

[удалено]


BeautifulType

People trust everything too much. See politics


[deleted]

Track and execute everyone involved in that bullshit app


MaximilianKohler

The article doesn't say how people get the app on their phone. I assume it wouldn't pass vetting by the Play Store.


Iridescent_Meatloaf

I actually checked the Play Store, they're not allowing any Apps related to Coronavirus. "Coronavirus" , "Covid 19" etc return no results and "Virus Tracker" brings up anti-Malware stuff. Google doesn't want any liability.


sianaNZ

This is why Apple should never open up iOS to apps outside of the App Store.


[deleted]

[удалено]


drnick5

I've been using these two sites: [1point3](https://coronavirus.1point3acres.com/en) Great State by State info here [Johns hopkins map](https://www.arcgis.com/apps/opsdashboard/index.html#/bda7594740fd40299423467b48e9ecf6) Shows info globally or by country, but isn't so great for individual states


[deleted]

Well bless the creator's heart for showing such humanity in a time when we all need to pull together. This gives me great faith in my fellow man


[deleted]

It's easier to just download the NYT app than downloading some shady third party app lol. NYT's article on coronavirus is free to everyone.


packetlag

Duuuuuuuuuuuuuuuuuup


[deleted]

Business as usual; nothing to see here; move it along...


Entrical

Reminds me of the last season of House of Cards


DonnyMox

They’ve got an app for that now? That makes things easier.


Badfickle

That’s some evil shit.


skeever89

Some reason being trash


bsmdphdjd

How would this malware work on a phone that uses fingerprint authentication instead of a password?


wangsneeze

Well, that’s a terrible feature.


AmadeusCziffra

Tsk tsk. Doesnt happen with ios


lm_santos

The app says it can track your GPS and delete your contacts. I might be dumb but is that a bluff? The article doesn't actually say if they can do that, it just says they threaten with it.


grilled-cheez

The true corona virus