So now we have a service as a malicious use case let's say every hour we want to steal the user's contacts 1
and send to the server. 2
There are better ways of doing this like using alarm service but here we just want an excuse to use 3
a service. 4
Now let's start off by providing the permission to read contacts so go to the manifest and and read 5
contacts 6
now. 7
Besides adding to the manifest we need to prompt the user to allow read contacts, let's just update 8
the method we wrote before. 9
To add the new permission so go to main activity. 10
Go to request permissions and change it. 11
Like so. OK. 12
So here just copy and paste the code. 13
So now instead of checking one permission we're checking two permissions. Now similarly we prepared HTTP 14
post code for this. 15
This is quite dirty. 16
In reality you would have a separate HTTP class and so on but here we're just copying and pasting doing 17
the bare minimum OK. 18
Now to obtain the contexts. 19
Similarly if you go to Google Search Android read contacts programmatically you'll find a stack overflow 20
article with the solution containing the code. Here 21
we've repaired it earlier and just copy and pasted the info so we have a method that gets all the contacts 22
and returns a string with all the contacts so if you look at the code they're just getting all the contacts. 23
It actually does this using a cursor just like in our content provider and we return a string with all 24
the contacts. In the HTTP post 25
we change the parameter name to contacts OK. 26
Next we're going to use a handler to define the action to perform periodically so handler M handler 27
equals new handler 28
let's define an interval integer of 1000 that is milliseconds time 60 seconds time 60 that is minutes 29
so since the system counts time in milliseconds we're saying we want the interval to be that many milliseconds 30
which means 1 hour. 31
Now we define a runable and create the run method surround with try and catch for error handling. 32
And here we will invoke the network asynchronous task like we did earlier but as a parameter we will 33
add the contacts instead. 34
OK. 35
And after it runs we will tell the handler to delay the next action by an hour. 36
Meaning this will run again in one hour similarly to do this. 37
A developer would usually search on google how to run a task every hour. 38
And you just take the code from the forums OK. 39
Now to execute we need to tell it when to start this event for the first time let's put this code in 40
the start. 41
So just copy the on start method we to override the original OnStart command and put our code inside 42
the OnStart. 43
So we are saying that the first time we run the service we're going to call the handler so let's define 44
a method for our handler let's call this one. 45
Start recurring tasks. 46
And the other one stop recurring task. 47
Then inside we say m handler task dot run. 48
And here M handler dot remove callbacks parentheses M handler task so here we are just stopping it. 49
Now if all of this is overwhelming really don't give up. 50
This is not needed for reverse engineering we're just showing you the process that a malware author 51
would go through when writing code you'll get used to these terms and classes more and more as you go 52
along. 53
In programming there's always a lot of repetition. OK now in the OnStart command we will call start recurring 54
task, so here we just said that once we start this service every hour it will send the contacts to the 55
server. 56
Now we still have a final step, we need to start the service from within our activity so go back to our 57
activity and in the on create just start a new intend to start my service then run start service and 58
pass the intent OK. 59
Now we run our app you'll not see anything different other than being asked to allow a new permission 60
being contacts. 61
Actually we need to add a contact. 62
If you don't have any contacts so just go to contacts like you would on a normal Android device and 63
add a contact now. 64
Finally let's see an interesting feature in Android Studio, so for debugging we can add breakpoints. 65
This means that you tell your app to stop at that point when it reaches that code and you can analyze 66
everything in code at that specific point OK. 67
So to do this we just click here to add the breakpoint let's add it in the HTTP post then we run 68
using debug and when it reaches that point we can see that Android Studio shows us. 69
The point has been reached and we can also monitor the values so the contacts are there now here we're 70
able to debug easily because we are actually developing from source. Unfortunately debugging and APK 71
is not a straightforward but this is something we will have a look at in a more advanced course that 72
will be developing in the future in this course. 73
We will however see something similar to debugging when we do the dynamic analysis part OK. 74
That is pretty much it. 75
To summarize we just went through the process of a malware author developing a simple shopping list 76
app and hiding some malicious code in the background that steals SMS's when they are received 77
and steals contacts periodically. In the next part of the course will assume that we have no knowledge 78
of what just happened here and we'll try to gain this knowledge through reverse engineering.