Janus Team

Privacy Policy Embedding for Chinese Words and Phrases

Features:

  1. 200-dimension vector representation.
  2. over one million english sentences in total.

A script for JEB

Features:

  1. Find cross reference to a package (eg., third-party library), you can use it to study how a package is used, to find the misuse of a library for instance.
  2. Works on the latest JEB, tested on jeb-demo-3.14.0.202002252048-JEBDecompilerDemo-121820464987384330.
  3. Developed by zoudeneng@PanguTeam.

enjoy!

基于自然语言处理的隐私政策自动表述研究

对来自华为应用市场的1,500份中文隐私政策进行检测,检测结果表明38.5%的隐私政策为虚假隐私政策,剩余合法的隐私政策中,92.5%的隐私政策在完整性方面不符合“自评估指南”的要求。在隐私政策自动表述的基础上,设计了一种隐私政策打分方法,实验结果表明大部分隐私政策的得分位于低分数区间内。

Review Embedding Corpus for English Words and Phrases Released (2019.2.19)

A. Features

  1. 200-dimension vector representation.
  2. 213,118 english sentences in total.
  3. Access via this Link and will be continuously updated.

B. Case: To find similar word

 

Janus Embedding Corpus for Chinese Words and Phrases Released (2019.2.15)

A. Features

  1. Phrases come from Janus.
  2. Coarse-grained segmentation.
  3. 200-dimension vector representation.
  4. 7957 apks and 232274 sentences in total till now.
  5. Access via this Link and will be continuously updated.

B. Case: To find similar word

 

enjoy!

GooglePlay Security (Monthly Recap, Jan. 2019)

1. Summary


This month, we evaluated apps on GooglePlay. 10,029 apps are collected from China, America, Russia and Turkey regions. Among these apps, we found 22 apps in total are malwares or graywares (termed as PHA by Google), they are:

(GooglePlay has removed some of these apps, but all of them can be accessed via Janus)

2. Interesting Findings


1. Most of the PHAs are Adwares.

2. Tricky SMS fraud apps take a variety of techniques to bypass the vetting process of GooglePlay, e.g.,e9a2786a318968184fabdc21244dae7ef1058de9 sends SMS under the control of C&C server, dfb182f6d277acc54a63a629794e4e2cba42dabc sends SMS  if it is lunched via AD network.

3. “Your are the winner, but you should pay for the delivery in advance”. The fraudulent story in web is now migrating to app, and 2ea95471a4f490b12afa138ab1ffe228a528d112, which targets the Russia user, is an instance.

4. End-users are enticed to pay, after that, they found they are fooled. 5e7322607a7d0575d4bee48115aaec4c700a9274 is the case.

 

3. About US


In 2014, Pangu Team (@panguteam) founded PWNZEN InfoTech Co., LTD, a startup company at Shanghai, China, and expanded its research team to the Pangu Lab, with more general research interests from iOS jailbreaking, to IoT security, App security auditing, Android security, etc.

Tricky toll fraud apps with 210k downloads are spreading through GooglePlay.

A few days ago, we found a toll fraud app on GooglePlay. This is a brief description for the toll fraud app.

How the toll fraud app works. The initial spotted app can be accessed via Janus. The app is tricky, that is, if the app is started by luncher, it works normally. But if the app is started via deeplink, the app changes the view and starts the subscription process.

I

Tips for analyzing include:

  • If the app is started from luncher, there is no subscription (Upgrade to premium button in the menu).
  • However, if the app is started via clicking an ad (by assumption), the app works different. We think this is the reason why the app bypassed GooglePlay’s vetting process and is still alive even if users complain about this app.
  • The app integrate the MobiBox third-party library for subscription (http://mymobibox.mobi/).
  • The toll fraud app only works in limited country/region (Lebanon/South Africa by observation).
  • Disclaimer for subscription is controlled by developer.

Find more fraud apps in GooglePlay. We explore Janus by taking the signature of the subscription library, then we find 2 additional toll fraud apps on GooglePlay and 3 apps in Baidu App Market. Summary of these apps:

  • There are 210k downloads in total of these apps in GooglePlay.
  • These apps have hosted on GooglePlay for over 1 month.
  • Views of these apps are almost the same even though published by different developers and adhere different description.

 

Hash of the toll apps:

  • 128e96e48c707c90eb7a46a735505a26a8c04c91
  • 177fa46fa285522d50817f0937d892482a513bb0
  • c4f45ff297690069fa6f8075a72045f891f88252
  • d0b54ea39666fa861419af19504d61268ddb1fb3
  • de50aa590dc5725dd5a7f05c10bd7da60e43fafc
  • dfb182f6d277acc54a63a629794e4e2cba42dabc

Advices for GooglePlay:

  • Respect more end-user than vendor/developer.
  • Remove these apps immediately.
  • Invest these apps and the library, API_KEY in string.xml maybe helpful.