Fake Rocket Alert App Drains Personal Data From Israeli Devices
On October 13, 2023, Cloudflare’s Cloudforce One Threat Operations Team identified a website hosting a malicious Android application (APK) impersonating the legitimate RedAlert - Rocket Alerts app used by Israelis to receive airstrike warnings. With more than 5,000 rockets launched into Israel since the Hamas attacks began on October 7, reliable alerting services have become critical for public safety.
The malicious site, hxxps://redalerts[.]me, differs from the legitimate app website hxxps://redalert[.]me by only one letter, continuing a pattern of domain impersonation. The fake page offered links to both iOS and Android versions, but while the Apple App Store link pointed to the genuine RedAlert app, the Android download link served a malicious APK file directly from the fake site.
This campaign follows a recent attack on a similar rocket alert application, "Red Alert: Israel" by Kobi Snir, in which the Pro-Palestinian hacktivist group AnonGhost exploited vulnerabilities to intercept requests, expose servers and APIs, and send fake alerts—including a message that a "nuclear bomb is coming"—to app users. AnonGhost also claimed to have targeted RedAlert by Elad Nava, though that app was reportedly functioning normally as of October 11, 2023.
The malicious website was created on October 12, 2023 and has since been taken offline. Only users who installed the Android version from that specific site are affected.
Malicious APK Analysis
Users clicking the Google Play button on the fake site downloaded the app from hxxps://redalerts[.]me/app.apk. The malicious APK has the SHA-256 hash 5087a896360f5d99fbf4eb859c824d19eb6fa358387bf6c2c5e836f7927921c5.
Analysis of the AndroidManifest.xml file reveals significant differences from the legitimate open-source RedAlert application, primarily in the additional permissions requested. These permissions provide access to sensitive device data:
android.permission.GET_ACCOUNTSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_PRIVILEGED_PHONE_STATEandroid.permission.READ_SMS
The app visually imitates RedAlert, but launching it triggers a malicious background service. The only change to the onCreate() method is a startService() call that initiates the malicious activity, housed in a package called com.company.allinclusive.AI.
Data Collection and Exfiltration
The service runs to gather data from victims' phones and uploads it to the attacker's secure server. The collected data is extensive, covering most sensitive information on the device:
- SIM information, including IMEI and IMSI numbers, network type, country, voicemail number, PIN status
- Full contact list
- All SMS messages, including content and metadata for all statuses (received, outgoing, sent, etc.)
- Accounts associated with the device
- All call logs with details for incoming, outgoing, missed, rejected, and blocked calls
- Logged-in email and app accounts
- List of installed applications
Stolen data is encrypted and uploaded to an HTTP server at a hardcoded IP address defined in the actor's Tools class.
While HTTP and port 80 are specified, the actor appears able to use HTTPS on port 443 if a certificate is found bundled within the application package.
A Connector class handles encryption and upload. Files are encrypted with AES in CBC mode using PKCS5 Padding. The AES keys are randomly generated and appended to the packaged data, but encrypted with RSA using a public key bundled in the malicious app. Consequently, anyone intercepting the stolen data cannot decrypt it without the actor's private key.
The encrypted files are named with _.final extensions and contain:
- _.enc (encrypted data)
- _.param (AES encryption parameters, e.g., key and IV)
- _.eparam (RSA parameters, e.g., public key)
Anti-Analysis Capabilities
The malware includes rudimentary anti-analysis techniques that run when the app starts, targeting three areas: debugging, emulation, and test operations.
For anti-debugging, the application uses the built-in android.os.Debug package.
Anti-emulation checks attempt to locate specific files and identifiers typical of emulated environments.
The app also includes utilities to identify whether a test user ("monkey") is running the application.
These checks are basic runtime analysis protections and do not defend against static code analysis.
Detection and Prevention
Users with RedAlert installed can check for compromise by looking for these extraneous permissions on the app (whether granted or not):
- Call Logs
- Contacts
- Phone
- SMS
If present, the app is the malicious version and should be deleted immediately. Users can then reinstall the legitimate version directly from the Google Play Store.
To avoid similar threats, users should follow basic security practices:
- Keep mobile devices updated with the latest software versions
- Use mobile device management solutions where available
- Avoid third-party mobile application stores
- Never install applications from Internet URLs or sideload payloads
- Use DNS filtering services to block malicious domains on networks
This attack demonstrates the continued risk of sideloading apps directly from the Internet instead of installing from approved app stores, leveraging both domain impersonation and modified open source code to trick unsuspecting users.
