View Single Post
Posts: 915 | Thanked: 3,209 times | Joined on Jan 2011 @ Germany
#73
Originally Posted by reinob View Post
Do you seriously think that any half-assed rootkit would show up as being installed by apt-get? do you think that it would even be installed at all using apt-get or dpkg?

I mean, this is like going to the "add/remove programs" in Windows 95 to remove a virus!
According to this code snippet, which is in the link Headless provided for the Android detector, showing up as a package is exactly what CarrierIQ does:
Code:
    private void findPackages() {

        String[] potentialPackages = {
                "com.carrieriq.iqagent",
                "com.htc.android.iqagent",
                "com.carrieriq.attrom",
                "com.carrieriq.tmobile"
        };
        ArrayList<String> lines = new ArrayList<String>();

        for (String p : potentialPackages) {
            try {
                mContext.getPackageManager().getApplicationInfo(p, 0);
                lines.add(p);
            } catch (NameNotFoundException e) {
                // if an exception is thrown that means the package was not
                // found or registered with Android
            }

        }
        found.put(DetectTest.PACKAGES, lines);
    }
 

The Following User Says Thank You to sulu For This Useful Post: