This document discusses using Tacyt and Sinfonier tools to detect suspicious mobile apps. Tacyt is an innovative tool for monitoring and analyzing mobile threats, while Sinfonier is a visual programming tool for building security intelligence workflows. The document demonstrates how these tools can be used together to detect human errors in apps, monitor new and dead apps daily, and visualize relationships between apps, developers, and embedded files.

1. Unifying the
Global Response
to Cybercrime
Join the phishing dots to detect
suspicious mobile apps
Leonardo Amor & Carlos Díaz
Telefónica
LeoAmor@telefonica.com & Carlos.DiazHidalgo@telefonica.com

2. Telefonica
Group
21
Countries
120.000
Employees
50.377m
Income
>340m
Customers

3. Our
employees
Mostly:
• Telco
engineers
• Computer
Science
• Engineers
• …..
• Science
or
ScienCst
people

4. But
there
also
space
to:
• Lawyers
• Business
administraCon
• Economist
• Psychologist
• Philologist

5. Diversity

6. Diversity

7. Ideas
explosion

8. Code!
ü Unfortunately
yet
not
everyone
knows
to
code
ü Fortunately
everyday
schools
are
geRng
it
should
be
one
more
basic
class.

9. The
need
of
visual
coding
ü
&
Visual
Data

10. Sinfonier
Our
Open
project
to
visual
coding
++ =
Drag
&
Drop
Interface
AutomaCc
Deploy
API
Storm
Cluster

11. Sinfonier

12. Tacyt
One
of
our
sources
May
18
19
20
21
22
23
24
New
10.105
5.702
9.998
15.483
15.294
9.394
10.647
Dead
1.140
2.200
2.014
1.917
2.856
1.446
646
Up
3
Million
Apps
today
21.649
of
them
contains
.apks
50.993
has
links
to
.cn
domains

13. One
of
these
ideas

14. Laziness

15. or
Intense
work
ü
To
check
human
errors
inside
APPs
(Shared
CerCficates,
e-­‐mails,
URL’s,
APK’s…)

16. 16
DISCOVER, DISRUPT, DELIVER
It’s demo time
Tacyt + Sinfonier

17. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

18. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

19. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

20. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

21. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

22. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

23. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

24. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

25. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

26. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

27. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

28. Tacyt
ü An
innovaCve
tool
for
the
monitoring
and
analysis
of
mobile
threats
ü hfps://path5.elevenpaths.com/

29. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

30. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

31. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

32. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

33. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

34. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

35. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

36. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

37. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

38. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/

39. Sinfonier
ü Storm
Builder
for
Security
Intelligence
ü hfp://sinfonier-­‐project.net/
Reinject
into
the
topology
the
new
list
of
applicaCons
found

40. Ducksboard:
hfps://goo.gl/uKnHT3
ü A
real-­‐Cme
dashboard
ü hfps://ducksboard.com/

41. Ducksboard:
hfps://goo.gl/uKnHT3
ü A
real-­‐Cme
dashboard
ü hfps://ducksboard.com/

42. Ducksboard:
hfps://goo.gl/uKnHT3
ü A
real-­‐Cme
dashboard
ü hfps://ducksboard.com/

43. Ducksboard:
hfps://goo.gl/uKnHT3
ü A
real-­‐Cme
dashboard
ü hfps://ducksboard.com/

44. Data
VisualizaCon
ü hfp://d3js.org/
ü D3.js
is
a
JavaScript
library
for
manipulaCn
documents
based
on
data

45. Data
VisualizaCon:
Data
EnCCes
ü hfp://ecrime2015.us.to:2015/zoom.html
“key”
[packageName][version][market]
hfps://play.google.com/store/apps/details?id=com.zaccur.b07.main
GP
“developerEmail”
embedded
link
that
points
an
“apk”
file
hfp://d.guomob.com/1142/2.apk

46. Data
VisualizaCon:
Example1
ü hfp://ecrime2015.us.to:2015/example1.html
ü GP
link:
hfps://play.google.com/store/apps/details?id=com.qfang.qfangmobile
• One
developer
– 3117479220@qq.com
• One
mobile
applicaCon
in
GP
– com.qfang.qfangmobile
• Five
embedded
“apk”
files
– hfp://down.gao7.com/Files/down/wxjx_2.2.3_C227.apk
– hfp://s.51aiya.com/content/down/aiya14100234.apk
– hfp://www.159cai.com/download/vip/43332/159cai_shouji.apk
– hfp://shoufu.3gu.com/Run/Upload/Apk/QFangWang.apk
– hfp://www.wanggouchao.com/data/apk/wgc/v2.5.6/wgc_10021.apk

47. Data
VisualizaCon:
Example1
ü hfp://ecrime2015.us.to:2015/example1.html
ü GP
link:
hfps://play.google.com/store/apps/details?id=com.qfang.qfangmobile
• One
developer
– 3117479220@qq.com
• One
mobile
applicaCon
in
GP
– com.qfang.qfangmobile
• Five
embedded
“apk”
files
– hfp://down.gao7.com/Files/down/wxjx_2.2.3_C227.apk
– hfp://s.51aiya.com/content/down/aiya14100234.apk
– hfp://www.159cai.com/download/vip/43332/159cai_shouji.apk
– hfp://shoufu.3gu.com/Run/Upload/Apk/QFangWang.apk
– hfp://www.wanggouchao.com/data/apk/wgc/v2.5.6/wgc_10021.apk

48. Data
VisualizaCon:
Example2
ü hfp://ecrime2015.us.to:2015/example2.html
• Three
differents
developers
– joowill9588@gmail.com
– hong@jingeng.cn
– info@bluby.com
• Four
mobile
applicaCons
in
GP
• Three
applicaCons
point
to
the
same
embedded
“apk”
files
– hfp://update.iuoooo.com/Android/
componentvoice/xfyy1.apk
– hfp://update.iuoooo.com/Android/
componentvoice/xfyy2.apk

49. Data
VisualizaCon:
Example3
ü hfp://ecrime2015.us.to:2015/example3.html
• Three
different
developers
• 7
mobile
applicaCons
in
GP
• 13
embedded
“apk”
files

50. Data
VisualizaCon:
Example4
ü hfp://ecrime2015.us.to:2015/farm.html

51. Analysis
of
a
Case
ü hfp://ecrime2015.us.to:2015/managementapp.html
One
developer:
• gameungdunghay@gmail.com

52. com.giaitriviet.book.androidgp.bookaudio
:
50-­‐100
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

53. com.giaitriviet.book.androidgp.bookaudio
:
50-­‐100
com.giaitriviet.android.haivai
:
10-­‐50
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

54. com.giaitriviet.book.androidgp.bookaudio
:
50-­‐100
com.giaitriviet.android.haivai
:
10-­‐50
com.giaitriviet.androidgp.womanday
:
500-­‐1000
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

55. com.giaitriviet.book.androidgp.bookaudio
:
50-­‐100
com.giaitriviet.android.haivai
:
10-­‐50
com.giaitriviet.androidgp.womanday
:
500-­‐1000
com.giaitriviet.androidgp.saigon
:
50-­‐100
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

56. com.giaitriviet.androidgp.wallpaperquotes
:
5-­‐10
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

57. com.giaitriviet.androidgp.wallpaperquotes
:
5-­‐10
com.giaitriviet.androidgp.wallpapernaturals
:
100-­‐500
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

58. com.giaitriviet.androidgp.wallpaperquotes
:
5-­‐10
com.giaitriviet.androidgp.wallpapernaturals
:
100-­‐500
com.giaitriviet.androidgp.vietnam
:
10-­‐50
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

59. com.giaitriviet.androidgp.wallpaperquotes
:
5-­‐10
com.giaitriviet.androidgp.wallpapernaturals
:
100-­‐500
com.giaitriviet.androidgp.vietnam
:
10-­‐50
com.giaitriviet.androidgp.saigon1950
:
10-­‐50
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

60. com.giaitriviet.androidgp.masterchef
:
50-­‐100
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

61. com.giaitriviet.androidgp.masterchef
:
50-­‐100
com.giaitriviet.androidgp.managerapplicaCon
:
1-­‐5
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

62. com.giaitriviet.androidgp.masterchef
:
50-­‐100
com.giaitriviet.androidgp.managerapplicaCon
:
1-­‐5
com.giaitriviet.androidgp.fallsaigon1975
:
10-­‐50
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

63. com.giaitriviet.androidgp.masterchef
:
50-­‐100
com.giaitriviet.androidgp.managerapplicaCon
:
1-­‐5
com.giaitriviet.androidgp.fallsaigon1975
:
10-­‐50
com.giaitriviet.android.caravat
:
50-­‐100
Analysis
of
a
Case:
12
GP
applicaCons
ü hfp://ecrime2015.us.to:2015/managementapp.html

64. Domain:
mediafire.com
Analysis
of
a
Case:
Detail
of
embedded
“apk”
ü hfp://ecrime2015.us.to:2015/managementapp.html
All
links
are
up

65. Analysis
of
a
Case:
Detail
of
embedded
“apk”
ü hfp://ecrime2015.us.to:2015/managementapp.html

66. Analysis
of
a
Case:
Detail
of
embedded
“apk”
ü hfp://ecrime2015.us.to:2015/managementapp.html

67. Analysis
of
a
Case:
HotGirl
&
ChanDai
ü hfp://ecrime2015.us.to:2015/managementapp.html
Be
a
variant
of
a
known
malware
family
The
app
creates
or
modifies
SMS
Monitors
phone
state
(incoming
calls)
Uploads
the
list
of
apps
currently
running
to
a
remote
server
The
app
modifies
shortcuts
on
the
home
screen

68. Data
VisualizaCon:
Satellite
Photo
ü hfp://ecrime2015.us.to:2015/
ü If
you
click
this
URL,
most
likely
you
are
running
out
of
memory
in
your
computer
h9p://ecrime2015.us.to:2015/

69. Data
VisualizaCon:
Satellite
Photo
ü hfp://ecrime2015.us.to:2015/
ü If
you
click
this
URL,
most
likely
you
are
running
out
of
memory
in
your
computer

70. Conclusions
• This
presentaCon
is
only
the
beginning
…
• We
have
generated
a
RSS
feed
of
embedded
“apk”
files
…
• We
have
a
graphical
representaCon
of
the
relaConship
between
three
types
of
enCCes
…
• …
now
is
the
Cme
for
analysts

71. Community
Join
us:
sinfonier-­‐project.net
@e_Sinfonier
@flexpired
@LeoAmorV