Hi

I may be wrong, but can someone help me interpret the results of this analysis correctly?

https://www.hybrid-analysis.com/sample/0a0238f85b8a559e8ab54f67920004db3a67a39bdbdbfa00075fd7d27e41dec4/672423b56b46e4feb006681d

See the Network Related section: Why does Simplex.apk have a hardcoded communication with

issuetracker.google.com

android.googlesource.com

developers.google.com

An app that is advertised as the most privacy-friendly?

All other indicators can (probably) be considered false positives (for example, the Camera permission, which is needed for video calls)

  • @[email protected]
    link
    fedilink
    English
    4
    edit-2
    21 days ago

    I tried it with the official github .apk and same result. I have no idea what it means though maybe someone could chime in?

    Found potential URL in binary/memory:

    Except that they need something to make an android application (android SDK) and somehow to get issuetracker feedbacks, there’s nothing to worry about ? I guess? I don’t know.

    • @[email protected]
      link
      fedilink
      English
      321 days ago

      I can’t speak to that with a familiar level with the code, I can only presume or guess. All I will say is that is why I never install any app from Github or Gitlabs, because there is no third party verification of the code for releases on those sites.

      I only use F-Droid after disabling all anti-features in Settings and then install apps that I know are 100% clean from all dependancies.

      Download the SimpleX apk from F-Droid website and then run that to see what it says for any difference in the results.

        • @[email protected]
          link
          fedilink
          English
          120 days ago

          The link for F-Droid security issues is goijg on 3 years old, have you looked at the code xhanges for F-Droid since then?

          For using Obtainium, how do you avoid or block all apps from Github that depend on GCM, Firebase, or Google services? That’s wh I uae F-Droid and disable all anti-features so those apps are never listed, even if I search for an app that has Google dependancies, F-Droid will say that app does not exist or is not listed, as long as all anti-features is disabled.

          • @[email protected]
            link
            fedilink
            English
            120 days ago

            For using Obtainium, how do you avoid or block all apps from Github that depend on GCM, Firebase, or Google services?

            You do have a point though, but how does that even comes into the mix? Obtainium fetches directly from the source (api.github.com).

            But to answer your question, it’s blocked at the DNS level with RethinkDNS. Blocking all requests, except those explicitly allowed by myself.

            This seems more like hardcoded into the .APK or that we can’t correctly interpret the results or something is wrong in the analysis. And I’m also curious to get more Info’s from someone.