{"id":885987,"date":"2023-08-19T08:52:46","date_gmt":"2023-08-19T10:52:46","guid":{"rendered":"https:\/\/teknomers.com\/fr\/des-milliers-dapplications-android-malveillantes-utilisant-la-compression-apk-furtive-pour-echapper-a-la-detection\/"},"modified":"2023-08-19T08:52:49","modified_gmt":"2023-08-19T10:52:49","slug":"des-milliers-dapplications-android-malveillantes-utilisant-la-compression-apk-furtive-pour-echapper-a-la-detection","status":"publish","type":"post","link":"https:\/\/teknomers.com\/fr\/des-milliers-dapplications-android-malveillantes-utilisant-la-compression-apk-furtive-pour-echapper-a-la-detection\/","title":{"rendered":"Des milliers d&#8217;applications Android malveillantes utilisant la compression APK furtive pour \u00e9chapper \u00e0 la d\u00e9tection"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">19 ao\u00fbt 2023<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">THN<\/span><\/span><span class=\"p-tags\">S\u00e9curit\u00e9 mobile \/ Logiciels malveillants<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><\/div>\n<p>Les auteurs de menaces utilisent des fichiers Android Package (APK) avec des m\u00e9thodes de compression inconnues ou non prises en charge pour \u00e9chapper \u00e0 l&#8217;analyse des logiciels malveillants.<\/p>\n<p>C&#8217;est selon les d\u00e9couvertes de Zimperium, qui a trouv\u00e9 3 300 artefacts tirant parti de ces algorithmes de compression dans la nature.  71 des \u00e9chantillons identifi\u00e9s peuvent \u00eatre charg\u00e9s sur le syst\u00e8me d&#8217;exploitation sans aucun probl\u00e8me.<\/p>\n<p>Il n&#8217;y a aucune preuve que les applications \u00e9taient disponibles sur le Google Play Store \u00e0 un moment donn\u00e9, ce qui indique que les applications ont \u00e9t\u00e9 distribu\u00e9es par d&#8217;autres moyens, g\u00e9n\u00e9ralement via des magasins d&#8217;applications non fiables ou de l&#8217;ing\u00e9nierie sociale pour inciter les victimes \u00e0 les charger.<\/p>\n<section class=\"check_two clear badbox\"><center class=\"cf\"><a rel=\"nofollow noopener\" href=\"https:\/\/thn.news\/edWGl41h\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"La cyber-s\u00e9curit\u00e9\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2023\/08\/Cybercriminals-Renting-WikiLoader-to-Target-Italian-Organizations-with-Banking-Trojan.png\" width=\"728\" height=\"90\"\/><\/a><\/center><\/section>\n<p>Les fichiers APK utilisent &#8220;une technique qui limite la possibilit\u00e9 de d\u00e9compiler l&#8217;application pour un grand nombre d&#8217;outils, r\u00e9duisant les possibilit\u00e9s d&#8217;analyse&#8221;, a d\u00e9clar\u00e9 le chercheur en s\u00e9curit\u00e9 Fernando Ortega. <a rel=\"nofollow noopener\" href=\"https:\/\/www.zimperium.com\/blog\/over-3000-android-malware-samples-using-multiple-techniques-to-bypass-detection\/\" target=\"_blank\">dit<\/a>.  &#8220;Pour ce faire, l&#8217;APK (qui est essentiellement un fichier ZIP) utilise une m\u00e9thode de d\u00e9compression non prise en charge.&#8221;<\/p>\n<p>L&#8217;avantage d&#8217;une telle approche est sa capacit\u00e9 \u00e0 r\u00e9sister aux outils de d\u00e9compilation, tout en pouvant \u00eatre install\u00e9 sur des appareils Android dont la version du syst\u00e8me d&#8217;exploitation est sup\u00e9rieure \u00e0 Android 9 Pie.<\/p>\n<p>La soci\u00e9t\u00e9 de cybers\u00e9curit\u00e9 bas\u00e9e au Texas a d\u00e9clar\u00e9 avoir commenc\u00e9 sa propre analyse apr\u00e8s une <a rel=\"nofollow noopener\" href=\"https:\/\/twitter.com\/joe4security\/status\/1674042511969468418\" target=\"_blank\">poste<\/a> de Joe Security sur X (anciennement Twitter) en juin 2023 \u00e0 propos d&#8217;un <a rel=\"nofollow noopener\" href=\"https:\/\/www.joesandbox.com\/analysis\/895672\/0\/html\" target=\"_blank\">Fichier APK<\/a> qui ont manifest\u00e9 ce comportement.<\/p>\n<section class=\"check_two clear badbox\"><center class=\"cf\"><a rel=\"nofollow noopener\" href=\"https:\/\/thn.news\/Cr7gkMdK\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"La cyber-s\u00e9curit\u00e9\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2023\/08\/China039s-APT31-Suspected-in-Attacks-on-Air-Gapped-Systems-in-Eastern.gif\" width=\"728\" height=\"90\"\/><\/a><\/center><\/section>\n<p>Les packages Android utilisent le format ZIP en deux modes, l&#8217;un sans compression et l&#8217;autre utilisant l&#8217;algorithme DEFLATE.  La conclusion cruciale ici est que les APK emball\u00e9s \u00e0 l&#8217;aide de m\u00e9thodes de compression non prises en charge ne peuvent pas \u00eatre install\u00e9s sur les combin\u00e9s ex\u00e9cutant des versions d&#8217;Android inf\u00e9rieures \u00e0 9, mais ils fonctionnent correctement sur les versions ult\u00e9rieures.<\/p>\n<p>De plus, Zimperium a d\u00e9couvert que les auteurs de logiciels malveillants corrompaient \u00e9galement d\u00e9lib\u00e9r\u00e9ment les fichiers APK en ayant des noms de fichiers de plus de 256 octets et des fichiers AndroidManifest.xml malform\u00e9s pour d\u00e9clencher des plantages sur les outils d&#8217;analyse.<\/p>\n<p>La divulgation intervient des semaines apr\u00e8s que Google a r\u00e9v\u00e9l\u00e9 que les acteurs de la menace utilisaient une technique appel\u00e9e versioning pour \u00e9chapper aux d\u00e9tections de logiciels malveillants de son Play Store et cibler les utilisateurs d&#8217;Android.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Vous avez trouv\u00e9 cet article int\u00e9ressant ?  Suivez-nous sur <a rel=\"nofollow noopener\" href=\"https:\/\/twitter.com\/thehackersnews\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a>  et <a rel=\"nofollow noopener\" href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" target=\"_blank\">LinkedIn<\/a> pour lire plus de contenu exclusif que nous publions.<\/div>\n<\/div>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2023\/08\/thousands-of-android-malware-apps-using.html\" rel=\"nofollow noopener\" target=\"_blank\">ttn-fr-57<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue80219 ao\u00fbt 2023\ue804THNS\u00e9curit\u00e9 mobile \/ Logiciels malveillants Les auteurs de menaces utilisent des fichiers Android Package (APK) avec des m\u00e9thodes de compression inconnues ou non prises en charge pour \u00e9chapper \u00e0 l&#8217;analyse des logiciels malveillants. C&#8217;est selon les d\u00e9couvertes de Zimperium, qui a trouv\u00e9 3 300 artefacts tirant parti de ces algorithmes de compression dans [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":885988,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[8738,199685,4168,21144,4158,4165,4161,28159,133,41161,21314,90729,4157,4159,4171,4170,4167,7306,1558,4160,4163,4162,185,4172,4169,20349,4166,4164],"class_list":["post-885987","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologie","tag-android","tag-apk","tag-comment-pirater","tag-compression","tag-cyber-actualites","tag-cyber-attaques","tag-cyber-mises-a-jour","tag-dapplications","tag-des","tag-detection","tag-echapper","tag-furtive","tag-lactualite-de-la-cybersecurite","tag-lactualite-de-la-cybersecurite-aujourdhui","tag-lactualite-des-hackers","tag-la-securite-des-informations","tag-logiciel-malveillant-de-ransomware","tag-malveillantes","tag-milliers","tag-mises-a-jour-de-la-cybersecurite","tag-nouvelles-de-piratage","tag-nouvelles-de-pirates","tag-pour","tag-securite-informatique","tag-securite-internet","tag-utilisant","tag-violation-de-donnees","tag-vulnerabilite-logicielle"],"_links":{"self":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/885987","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/comments?post=885987"}],"version-history":[{"count":0,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/885987\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media\/885988"}],"wp:attachment":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media?parent=885987"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/categories?post=885987"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/tags?post=885987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}