0

I've noticed in several occasions that on mobile browsers (I suppose it happens also on desktop ones) downloads can be forced without user consent. I've studied the matter and I've learnt that this is made possible by using server-side languages as, for example, php. The downloaded files, in these cases were malware.

I wonder if it is possible to bypass this unwanted behaviour of mobile browsers, in particular of Chrome, for which I have found the downloads are named as hidden and incomplete files, '.com.chrome.google.xyz'.

Moreover, do these standard names used by Chrome make the malware ineffective and not activable nor executable?

EDIT @Robert, I don't understand why the question was closed as OT; it seems instead very connected to Android: all I've mentioned happens on Android 7, and I think it is a very problematic and interesting matter.

I have AVs that warn me of threats all the times, and every file is trashed soon after the warning. What you've said seems imply that AVs are completely useless, because the file is processed and executed by exploiting vulnerabilities in the mentioned Android component. I knew that it was problematic on previous Android versions due to a bug of intense battery discharge caused by scanning of corrupted media files that made it go into an infinite loop. However, that component isn't listed among system apps on my device.

I've checked the offending link; I've seen only a bit of html code lines indicating 308 Permanent redirect; no resources as JS, CSS and so on. Why? Moreover the preview was completely different from the original malicious page of autodownload.

It seems as Chrome for Android acts as a trojan downloader, and what's worse, Android automatically executes the code independently of user interaction with the file (though I don't think it happened on my device)

Improve this question
8
  • 1
    You are wrong. That your browser can download a file automatically has absolutely nothing to do with the language used on server side. The more important part is the JavaScript code on client side. In any way you can't execute anything from the standard downloads folder. You may trigger an installation if the webbrowser app is authorized to do so but still the user has to agree to the installation.
    – Robert
    Jun 2, 2020 at 7:23
  • 1
    I think sharing us your findings with details would be much better. Give us links to the sites where you browsed and it automatically triggered a download.
    – Firelord ♦
    Jun 2, 2020 at 9:17
  • @Robert some time ago I asked about this in a very specialized forum in my country, and a skilled guy warned me that just touching/selecting the suspect file in Android /Download folder might execute the dangerous code (cause I had sent it to VirusTotal for checking). Effectively this seems very strange. Was that expert a bit feverish? that is, can you assure me the absolute impossibility of such an operation? However, also the fact that they aren't required languages as PHP or ASP for forcing downloads sounds enough strange; I remember
    – Bento
    Jun 3, 2020 at 7:10
  • JavaScript is very limited on writing permissions, just useful for some trivial redirect
    – Bento
    Jun 3, 2020 at 7:10
  • 1
    @Bento The php file does nothing but redirecting to the malicious server. The real attack is as far as I can see performed by a 50k JavaScript fie which tests the browser it is executed in. If by opening this URL you can really trigger an automatic download to your Android phone then this might be enough to infect it because all vulnerabilities in the Android Media Server can be triggered (and depending on Android versions there are a lot vulnerabilities in this component) as downloaded files are AFAIK automatically processed by media server.
    – Robert
    Jun 4, 2020 at 9:38

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .