Now let's say we want to use an HTTP post to send the SMS received to a malicious server. 1
Now let's comment out the toast message. 2
Would you not want to show the user that we are accessing the S M S but we want to copy the contents 3
of the S M S so just copy this and create a string with the content now. 4
There are many ways of doing an HTTP post. Here 5
we just prepared some code so just copy and paste from the resources. 6
We have a method called HTTP post that receives a string. 7
It prepares an HTTP post to send to this particular site called postman dash Echo Dot Com and as a 8
parameter string it adds SMS text and appends the string we passed to HTTP post that's pretty much 9
it. 10
Now to run this we need to run an asynchronous task. 11
This means that when it's invoked a separate thread is launched and the rest of the process can keep 12
going. 13
This is not too important. 14
Again this is something specific to programming but with the way we implemented the HTTP post we need 15
to run an asynchronous task what is important to us is that we have an SMS being received and this 16
sms is being sent over HTTP post OK. 17
Now to launch the asynchronous task we need to surround it with a try and catch. 18
This here is a common convention that tries to run code and if there is an error rather than crashing 19
it runs the code in the catch part. 20
This is referred to as error handling OK. 21
So now I will execute the asynchronous task like so, all of this code will be provided for you. 22
Don't worry too much about it. 23
But just by looking at a number of strings here we can get an idea of what's going on. 24
We have an S M S we have an HTTP post straight after that on its own can't be very good for the user. 25
Now this will not work as is. 26
The reason is that here we're using the Internet and the use of Internet requires the Internet permission. 27
So here we need to go to the manifest. 28
And here we need to add the Internet permission. 29
This permission does not need to be explicitly requested to the user. 30
Google decided that it's not dangerous enough to need to ask the user for consent or it is so common 31
that users kind of expect the apps to use Internet permission so let's run the app send a test SMS. 32
we'll not see anything in the app but what happened is that the shopping list app just stole the SMS 33
and sent it to their server. 34
This is actually something we will analyze during the dynamic analysis part of the course.