Thread by @fs0c131y

Yesterday night, @campuscodi published an article about the COVID-19 detection app which has been removed from the PlayStore.

I saw the article this morning, so I decided to give it a look. Follow me for a walk 1/

zdnet.com/article/spying…

The Iranian gov made a website ac19.ir. On this website people can download an Android app "to test" if they are infected by the COVID-19 (coronavirus). 2/

*Reminder*: If you are sick, go to the doctor, download a f*cking app will not help you... 3/

The user can directly download the app on the website: dl.ac19.ir/ac19.apk 4/

When we extract the urls contained in the APK, we found 2 interesting domains:
- ac19.ir
- covid19.tfone.ir

5/

According to the WHOIS, covid19.tfone.ir has been registered by Mostafa Anoosheh. I wonder who is the Mostafa employer? 😏 6/

By doing a reverse WHOIS lookup, we can find that Mostafa registered 48 domains with his email address. 7/

In the list of the domains, we can find it14.ir his personal website. 8/

In his website, you can the document ManagementConfrenceNotes.txt with his work email. So his employer is a company called "Smart Land Solutions" 9/

Well, "Smart Land Solutions" was their name in 2016: web.archive.org/web/2016101119…. Now they are "Sarzamin Housmand" 10/

This company already made the news in the past. They created Hotgram and Talagram, two Telegram clones removed from the PlayStore accused of secretly collecting user data. 11/ tehrantimes.com/news/435641/Ho…

Some people claimed that these were developped on behalf of the Iranian intelligence agencies 12/

"Rahkar Sarzamin Houshmand has started its activity from 1384". This is a very old company 😅 13/

I feel sad Mostafa. I don't have access to his personal website anymore. He denied me access few minutes ago 14/

Looking the websites registered by Mostafa give us a good idea of the SLS business. iwin.ir is "the first cloud based call center accountability service" 15/

Another example, advest.ir is a advertisement related website 16/

If your governement is asking you to install an app on your phone, you shoudn't do it. There is a big probability that a shady company is behind it. 17/17

PS: Nice info regarding the tweet 13th of this thread

https://twitter.com/ChicagoCyber/status/1237350735152656388?s=20

PS1: cc #OSINT friends @OsintSupport @nixintel @OsintCurious @BenDoBrown @dutch_osintguy @jakecreps

PS2: You can probably take over any user account in the app. There is no rate limiting in the otp code validation during the register process. So you can test all the possible code and boom. I didn’t test fully but it should work. But hey it’s a secret don’t tell anyone 🤫