Profile picture
Elliot Alderson @fs0c131y
, 25 tweets, 12 min read Read on Twitter
<Thread> CM Browser is a very popular application (50M - 100M downloads) published by @CheetahMobile.
In the description it said "#1 antivirus engine (rated by AV-TEST)" which is a lie. The AV-TEST best android security 2016 award had been given to @Bitdefender and @Sophos.
Security Master is in their best antivirus for #Android list but it's not the same app and not #1:…
Virus Total score of the last CM Browser APK is 1/60. Detected as A.L.Rog.RedTubeSex by Alibaba 🤔
Description said "Ad Blocker: Block annoying pop-ups and ads, enjoy clear and clean browsing" but in the service list you can find
In the "Interesting Strings" section we can find a lot of http address, that's interesting. We will check that later
First thing you saw when you open the AndroidManifest, the app is asking 3 permissions which are granted only for system app. Why a web browser need to mount/unmount my file system?
Package name of the app is com.ksmobile.cb but the code is located in com.ijinshan.browser. Ijinshan,, is another company which seems working/related for/to @CheetahMobile.
When you click the product tab in it redirect to the product list of @CheetahMobile, In the list you can see the "Jinshan battery doctor" app. ijinshan seems 2 differents legal company but same people 🤔
They also listen to android.hardware.action.NEW_PICTURE...
Another receiver to PACKAGE_ADDED and PACKAGE_REMOVED 🤦‍♂️
The third receiver to PACKAGE_ADDED
And fourth...
I'll pause my investigation for today. Here the summary for now:
* They lie in the description
* VT detected it as a Rog.RedtubeSex
* This Adblock browser load their own ad
* They used multiple SDKs
* They listen to the apps movement (install,...)
In there is a list a porn websites which is added to a HashMap in the constructor 🤔
Even if you delete your browser history, you can find the last visit url in clear in a shared preferences file
If you visit #YouTube, #Pornhub, #xvideos or #xnxx, CM browser will inject their cmbFloatVideo js script in the webpage
BIG PRIVACY ISSUE: CM Browser is storing your browser history in clear in browser.db EVEN IN INCOGNITO MODE 😡
The AppExistTrackingReceiver is listening to a multiple intent: USER_PRESENT, CONNECTIVITY_CHANGE,...
On the onReceive method it will start the KBrowserService if the device is connected to the network and the last upload is older than 6 hours
On the OnCreate method of KBrowserService, it register a BroadcastReceiver which listen to SCREEN_ON and SCREEN_OFF intents...I saw that in a lot of malware...
When SCREEN_OFF is received the AppLockBroadCastReceiver check if the phone is locked and will update their content provider with is_screen_off to true
I'm done with this app. There is more to find for sure. Feel free to check the decompiled source… and share your findings!
To sumarize: Stay away of this app! It clearly an invasive application which listen for too much things on the user device. They do the opposite of the app description and don't protect your data
I'm ready for my next challenge. If you an app name in mind, feel free to send here or by DMs and I will look into it
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Elliot Alderson
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($3.00/month or $30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!