Hacker News Reader

One interesting thing is 2abeb8565c30a3d2af0fc8ea48af78a702a1c3b432845e3f04873610fac09e1b was mentioned in the original description 1 but removed in 2/3.

That package is signed with an Android key instead of a vendor one...

https://www.virustotal.com/gui/file/2abeb8565c30a3d2af0fc8ea...

View on HN

I doubt that is a real Google-issued certificate authority based on the issuing CA certificate having an e-mail address identified as "nbbsw@nbbsw.com". It's likely the reason this sample was removed from the post?

Same thought here. The domain appears to be associated with Ningbo Sunning Software, a Chinese vendor and likely a Mediatek partner than anything Android.

Good catch after looking into it more this may be related to subcontractors providing vendors with malicious update tools that they then sign.

https://maldroid.github.io/docs/vb_2022.pdf

Good catch!

So Google's private key was stolen?

I'm not sure of the validity of the key, it's possible it was simply an untrusted key that had "Android" in the common name and got removed from the post as it was unrelated, but I'm curious if any more details surface on that one.

Reply on news.ycombinator.com