From 5fe8238ef015036dad54f88d0b076436cc3461a7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Donncha=20=C3=93=20Cearbhaill?= Date: Thu, 24 Oct 2024 17:35:34 +0200 Subject: [PATCH] Update tests to work with the new side-loading detections --- tests/android_androidqf/test_packages.py | 49 +++++++++++++++++++----- 1 file changed, 39 insertions(+), 10 deletions(-) diff --git a/tests/android_androidqf/test_packages.py b/tests/android_androidqf/test_packages.py index 7af18329..a7fce958 100644 --- a/tests/android_androidqf/test_packages.py +++ b/tests/android_androidqf/test_packages.py @@ -43,33 +43,56 @@ def test_packages_list(self, module): # There should just be 7 packages listed, no detections assert len(module.results) == 7 assert len(module.timeline) == 0 - assert len(module.detected) == 0 def test_non_appstore_warnings(self, caplog, module): run_module(module) + assert len(module.detected) == 4 + # Not a super test to be searching logs for this but heuristic detections not yet formalised assert ( 'Found a non-system package installed via adb or another method: "com.whatsapp"' in caplog.text ) + whatsapp_detected = [ + pkg for pkg in module.detected if pkg["name"] == "com.whatsapp" + ] + assert len(whatsapp_detected) == 1 + assert ( 'Found a package installed via a browser (installer="com.google.android.packageinstaller"): ' '"app.revanced.manager.flutter"' in caplog.text ) + revanced_detected = [ + pkg + for pkg in module.detected + if pkg["name"] == "app.revanced.manager.flutter" + ] + assert len(revanced_detected) == 1 + assert ( 'Found a package installed via a third party store (installer="org.fdroid.fdroid"): "org.nuclearfog.apollo"' in caplog.text ) + # We do not currently flag a third party store as a detection, we only flag the app in the logs. + appollo_detected = [ + pkg for pkg in module.detected if pkg["name"] == "org.nuclearfog.apollo" + ] + assert len(appollo_detected) == 0 def test_packages_ioc_package_names(self, module, indicators_factory): module.indicators = indicators_factory(app_ids=["com.malware.blah"]) run_module(module) - assert len(module.detected) == 1 - assert module.detected[0]["name"] == "com.malware.blah" - assert module.detected[0]["matched_indicator"]["value"] == "com.malware.blah" + possible_detected_app = [ + pkg for pkg in module.detected if pkg["name"] == "com.malware.blah" + ] + assert len(possible_detected_app) == 1 + assert possible_detected_app[0]["name"] == "com.malware.blah" + assert ( + possible_detected_app[0]["matched_indicator"]["value"] == "com.malware.blah" + ) def test_packages_ioc_sha256(self, module, indicators_factory): module.indicators = indicators_factory( @@ -80,10 +103,13 @@ def test_packages_ioc_sha256(self, module, indicators_factory): run_module(module) - assert len(module.detected) == 1 - assert module.detected[0]["name"] == "com.malware.muahaha" + possible_detected_app = [ + pkg for pkg in module.detected if pkg["name"] == "com.malware.muahaha" + ] + assert len(possible_detected_app) == 1 + assert possible_detected_app[0]["name"] == "com.malware.muahaha" assert ( - module.detected[0]["matched_indicator"]["value"] + possible_detected_app[0]["matched_indicator"]["value"] == "31037a27af59d4914906c01ad14a318eee2f3e31d48da8954dca62a99174e3fa" ) @@ -96,9 +122,12 @@ def test_packages_certificate_hash_ioc(self, module, indicators_factory): run_module(module) - assert len(module.detected) == 1 - assert module.detected[0]["name"] == "com.malware.muahaha" + possible_detected_app = [ + pkg for pkg in module.detected if pkg["name"] == "com.malware.muahaha" + ] + assert len(possible_detected_app) == 1 + assert possible_detected_app[0]["name"] == "com.malware.muahaha" assert ( - module.detected[0]["matched_indicator"]["value"] + possible_detected_app[0]["matched_indicator"]["value"] == "c7e56178748be1441370416d4c10e34817ea0c961eb636c8e9d98e0fd79bf730" )