Hi
I may be wrong, but can someone help me interpret the results of this analysis correctly?
See the Network Related section: Why does Simplex.apk have a hardcoded communication with
An app that is advertised as the most privacy-friendly?
All other indicators can (probably) be considered false positives (for example, the Camera permission, which is needed for video calls)
You must log in or register to comment.
Removed by mod
From official Github https://github.com/simplex-chat/simplex-chat/releases
It is probably not degoogled (maybe)
I tried it with the official github .apk and same result. I have no idea what it means though maybe someone could chime in?
Found potential URL in binary/memory:
- Pattern match: “https://issuetracker.google.com/issues/new?component=618491&template=1257717”
- Pattern match: “https://android.googlesource.com/toolchain/llvm-project”
- Pattern match: “https://developers.google.com/protocol-buffers///”
Except that they need something to make an android application (android SDK) and somehow to get issuetracker feedbacks, there’s nothing to worry about ? I guess? I don’t know.
Removed by mod
When installing from Github you only trust the developer and their signed certificate key.
When installing from F-Droid you additionally also have to trust the F-Droid developer’s signature.
Besides that F-droid has its own problems:
https://privsec.dev/posts/android/f-droid-security-issues/
I don’t use F-Droid. I use Obtainium and additionally check signatures in AppVerifier.
Removed by mod
For using Obtainium, how do you avoid or block all apps from Github that depend on GCM, Firebase, or Google services?
You do have a point though, but how does that even comes into the mix? Obtainium fetches directly from the source (api.github.com).
But to answer your question, it’s blocked at the DNS level with RethinkDNS. Blocking all requests, except those explicitly allowed by myself.
This seems more like hardcoded into the .APK or that we can’t correctly interpret the results or something is wrong in the analysis. And I’m also curious to get more Info’s from someone.
Removed by mod
Hello !
Version 6.1.1 (250) arm64-v8a https://f-droid.org/en/packages/chat.simplex.app/ https://f-droid.org/repo/chat.simplex.app_250.apk
Here’s the analysis: https://www.hybrid-analysis.com/sample/9b14b4f80b479a7eb2a5e9fb22ad3f5d547690f4e30da6b5c6f0e9ed8d4039da/672727b3fd3db6063b002513
Same exact result:
- Pattern match: “https://android.googlesource.com/toolchain/llvm-project”
- Pattern match: “https://developers.google.com/protocol-buffers///”
- Pattern match: “https://issuetracker.google.com/issues/new?component=618491&template=1257717”
Dunno if this is something we should worry about or not ? Maybe OP and myself are not educated enough to interpret the results, however I’m also not very comfortable seeing those
Found potential URL in binary/memoryfrom SimpleX’s APK. Do you have any further thoughts?Thanks.
Contact the dev and ask. Once you have an answer report back.
There is a button in the app to contact the dev.
