{"id":10411,"date":"2025-07-30T12:29:11","date_gmt":"2025-07-30T05:29:11","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=10411"},"modified":"2026-02-05T12:29:36","modified_gmt":"2026-02-05T05:29:36","slug":"goc-nhin-chuyen-gia-vach-tran-redhook-va-am-muu-tinh-vi-cua-nhom-tin-tac-dung-sau","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/2025\/07\/30\/goc-nhin-chuyen-gia-vach-tran-redhook-va-am-muu-tinh-vi-cua-nhom-tin-tac-dung-sau\/","title":{"rendered":"G\u00f3c nh\u00ecn chuy\u00ean gia: V\u1ea1ch tr\u1ea7n RedHook v\u00e0 \u00e2m m\u01b0u tinh vi c\u1ee7a nh\u00f3m tin t\u1eb7c \u0111\u1ee9ng sau"},"content":{"rendered":"

To\u00e0n \u0110\u00f4ng Nam \u00c1, trong \u0111\u00f3 c\u00f3 c\u1ea3 Vi\u1ec7t Nam \u0111\u01b0\u1ee3c m\u1ed9t phen n\u00e1o lo\u1ea1n sau s\u1ef1 xu\u1ea5t hi\u1ec7n c\u1ee7a m\u1ed9t m\u00e3 \u0111\u1ed9c nguy hi\u1ec3m c\u00f3 t\u00ean RedHook v\u1edbi m\u1ee5c ti\u00eau: gi\u1ea3 m\u1ea1o c\u00e1c \u1ee9ng d\u1ee5ng c\u1ee7a c\u01a1 quan nh\u00e0 n\u01b0\u1edbc v\u00e0 ng\u00e2n h\u00e0ng t\u1ea1i Vi\u1ec7t Nam \u0111\u1ec3 l\u1eeba ng\u01b0\u1eddi d\u00f9ng Android c\u00e0i \u0111\u1eb7t ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i, t\u1eeb \u0111\u00f3 \u0111\u00e1nh c\u1eafp th\u00f4ng tin c\u00e1 nh\u00e2n, t\u00e0i kho\u1ea3n ng\u00e2n h\u00e0ng v\u00e0 th\u1eadm ch\u00ed c\u00f3 nguy c\u01a1 theo d\u00f5i thi\u1ebft b\u1ecb t\u1eeb xa.<\/b><\/p>\n

\n
\"1753867489676.png\"<\/div>\n

\u200b<\/p><\/div>\n

T\u1ea1i th\u1eddi \u0111i\u1ec3m ph\u00e2n t\u00edch m\u1eabu m\u00e3 \u0111\u1ed9c RedHook, h\u1ec7 th\u1ed1ng m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n (C2 server) m\u00e0 m\u00e3 \u0111\u1ed9c li\u00ean l\u1ea1c \u0111\u00e3 tr\u1ea3 v\u1ec1 t\u1ed5ng c\u1ed9ng 570 m\u00e3 \u0111\u1ecbnh danh ng\u01b0\u1eddi d\u00f9ng (user ID). M\u1ed7i user ID t\u01b0\u01a1ng \u1ee9ng v\u1edbi m\u1ed9t thi\u1ebft b\u1ecb \u0111\u00e3 b\u1ecb m\u00e3 \u0111\u1ed9c x\u00e2m nh\u1eadp v\u00e0 g\u1eedi d\u1eef li\u1ec7u v\u1ec1 m\u00e1y ch\u1ee7.<\/p>\n

Con s\u1ed1 n\u00e0y cho th\u1ea5y r\u1eb1ng \u00edt nh\u1ea5t 570 thi\u1ebft b\u1ecb Android \u0111\u00e3 b\u1ecb nhi\u1ec5m m\u00e3 \u0111\u1ed9c, ch\u01b0a k\u1ec3 c\u00e1c tr\u01b0\u1eddng h\u1ee3p ch\u01b0a b\u1ecb ghi nh\u1eadn ho\u1eb7c ch\u01b0a k\u1ecbp k\u1ebft n\u1ed1i v\u1edbi m\u00e1y ch\u1ee7. Do v\u1eady, con s\u1ed1 th\u1ef1c t\u1ebf c\u00f3 th\u1ec3 cao h\u01a1n v\u00e0 570 user ID ch\u1ec9 l\u00e0 s\u1ed1 li\u1ec7u thu \u0111\u01b0\u1ee3c trong th\u1eddi \u0111i\u1ec3m ng\u1eafn, \u1edf m\u1ed9t m\u1eabu h\u1ea1 t\u1ea7ng ph\u00e2n ph\u1ed1i m\u00e3 \u0111\u1ed9c nh\u1ea5t \u0111\u1ecbnh, ph\u1ea3n \u00e1nh t\u1ed1c \u0111\u1ed9 l\u00e2y nhi\u1ec5m \u0111ang t\u0103ng l\u00ean.<\/p>\n

\u0110\u00e2y l\u00e0 d\u1ea5u hi\u1ec7u r\u00f5 r\u00e0ng cho th\u1ea5y chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng c\u1ee7a RedHook \u0111\u00e3 v\u01b0\u1ee3t qua quy m\u00f4 th\u1eed nghi\u1ec7m v\u00e0 \u0111ang di\u1ec5n ra tr\u00ean th\u1ef1c t\u1ebf v\u1edbi s\u1ed1 l\u01b0\u1ee3ng n\u1ea1n nh\u00e2n \u0111\u00e1ng b\u00e1o \u0111\u1ed9ng.<\/p>\n

\n
\"1753865602129.png\"<\/div>\n

App s\u1eed d\u1ee5ng WebSocket \u0111\u1ec3 k\u1ebft n\u1ed1i v\u1edbi r\u1ea5t nhi\u1ec1u m\u00e1y ch\u1ee7 C2 b\u00ean ngo\u00e0i<\/i>\u200b<\/div>\n

V\u00ec sao ng\u01b0\u1eddi d\u00f9ng c\u1ea7n \u0111\u1eb7c bi\u1ec7t c\u1ea3nh gi\u00e1c?\u200b<\/h2>\n
    \n
  • Ng\u01b0\u1eddi d\u00e2n Vi\u1ec7t Nam c\u00f3 th\u00f3i quen tin t\u01b0\u1edfng app c\u00f3 logo ch\u00ednh ph\u1ee7 ho\u1eb7c ng\u00e2n h\u00e0ng, \u0111i\u1ec1u n\u00e0y \u0111ang b\u1ecb k\u1ebb x\u1ea5u l\u1ee3i d\u1ee5ng.<\/li>\n
  • \u1ee8ng d\u1ee5ng gi\u1ea3 c\u00f3 th\u1ec3 \u0111\u00e1nh c\u1eafp m\u00e3 OTP, \u0111\u0103ng nh\u1eadp t\u00e0i kho\u1ea3n ng\u00e2n h\u00e0ng, \u0111\u1ecdc tin nh\u1eafn, ghi l\u1ea1i thao t\u00e1c tr\u00ean m\u00e0n h\u00ecnh.<\/li>\n
  • \u0110\u1ed1i t\u01b0\u1ee3ng t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 l\u00e0 ng\u01b0\u1eddi d\u00f9ng th\u01b0\u1eddng ho\u1eb7c nguy hi\u1ec3m n\u1ebfu \u0111\u00f3 l\u00e0 c\u00e1n b\u1ed9, nh\u00e2n vi\u00ean nh\u00e0 n\u01b0\u1edbc, g\u00e2y nguy c\u01a1 r\u00f2 r\u1ec9 th\u00f4ng tin nh\u1ea1y c\u1ea3m ho\u1eb7c b\u1ecb theo d\u00f5i gi\u00e1n \u0111i\u1ec7p.<\/li>\n<\/ul>\n
    \n
    \"1753865109123.png\"<\/div>\n

    N\u00fat t\u1ea3i xu\u1ed1ng app \u0111\u1ed9c h\u1ea1i<\/i>\u200b<\/div>\n

    V\u1ea1ch tr\u1ea7n c\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a RedHook\u200b<\/h2>\n

    RedHook ho\u1ea1t \u0111\u1ed9ng nh\u01b0 m\u1ed9t \u1ee9ng d\u1ee5ng gi\u1ea3 m\u1ea1o tinh vi, \u0111\u1ed9i l\u1ed1t c\u00e1c app c\u1ee7a c\u01a1 quan nh\u00e0 n\u01b0\u1edbc, ng\u00e2n h\u00e0ng ho\u1eb7c d\u1ecbch v\u1ee5 c\u00f4ng tr\u1ef1c tuy\u1ebfn \u0111\u1ec3 l\u1eeba ng\u01b0\u1eddi d\u00f9ng Android t\u1ea3i v\u1ec1 t\u1eeb c\u00e1c website gi\u1ea3 m\u1ea1o, tin nh\u1eafn SMS ho\u1eb7c m\u1ea1ng x\u00e3 h\u1ed9i. Sau khi c\u00e0i \u0111\u1eb7t, \u1ee9ng d\u1ee5ng y\u00eau c\u1ea7u ng\u01b0\u1eddi d\u00f9ng c\u1ea5p quy\u1ec1n \u201cTr\u1ee3 n\u0103ng\u201d (Accessibility) cho ph\u00e9p theo d\u00f5i v\u00e0 thao t\u00e1c tr\u00ean m\u00e0n h\u00ecnh c\u00f9ng v\u1edbi quy\u1ec1n \u201cHi\u1ec3n th\u1ecb tr\u00ean \u1ee9ng d\u1ee5ng kh\u00e1c\u201d \u0111\u1ec3 t\u1ea1o giao di\u1ec7n gi\u1ea3 m\u1ea1o nh\u01b0 m\u00e0n h\u00ecnh \u0111\u0103ng nh\u1eadp ng\u00e2n h\u00e0ng. Khi ng\u01b0\u1eddi d\u00f9ng v\u00f4 t\u00ecnh nh\u1eadp th\u00f4ng tin, m\u00e3 \u0111\u1ed9c s\u1ebd \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u v\u00e0 g\u1eedi v\u1ec1 m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n t\u1eeb xa \u1edf n\u01b0\u1edbc ngo\u00e0i th\u00f4ng qua giao th\u1ee9c WebSocket – m\u1ed9t k\u1ef9 thu\u1eadt truy\u1ec1n d\u1eef li\u1ec7u kh\u00f3 b\u1ecb ph\u00e1t hi\u1ec7n b\u1edfi c\u00e1c gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt truy\u1ec1n th\u1ed1ng.<\/p>\n

    \n
    \"1753865694498.png\"<\/div>\n


    \nSau khi t\u1ea3i app gi\u1ea3 m\u1ea1o xu\u1ed1ng s\u1ebd c\u00f3 d\u00f2ng th\u00f4ng b\u00e1o y\u00eau c\u1ea7u cho ph\u00e9p truy c\u1eadp,
    \nn\u1ebfu nh\u1ea5n “allow” s\u1ebd cho ph\u00e9p t\u01b0\u01a1ng t\u00e1c v\u1edbi c\u00e1c app tr\u00ean \u0111i\u1ec7n tho\u1ea1i.
    \nApp n\u00e0y y\u00eau c\u1ea7u c\u1ea5p quy\u1ec1n truy c\u1eadp \u1ea3nh nh\u01b0ng th\u1ef1c ch\u1ea5t “l\u01b0\u01a1n l\u1eb9o” y\u00eau c\u1ea7u quy\u1ec1n d\u1ecbch v\u1ee5 h\u1ed7 tr\u1ee3 (Accessibility).<\/i><\/p>\n

    \"1753865731431.png\"<\/div>\n

    App gi\u1ea3 m\u1ea1o s\u1ebd t\u01b0\u01a1ng t\u00e1c nh\u01b0ng th\u1ef1c ch\u1ea5t l\u00e0 “thao t\u00fang” v\u1edbi c\u00e1c app kh\u00e1c tr\u00ean \u0111i\u1ec7n tho\u1ea1i c\u1ee7a c\u1ee7a n\u1ea1n nh\u00e2n.<\/i>\u200b<\/div>\n

    Li\u1ec7u \u0111\u00e2y c\u00f3 ph\u1ea3i \u00e2m m\u01b0u tinh vi c\u1ee7a nh\u00f3m tin t\u1eb7c th\u00f4ng minh, c\u00f3 t\u1ed5 ch\u1ee9c?<\/b>\u200b<\/h2>\n

    Theo g\u00f3c nh\u00ecn c\u1ee7a chuy\u00ean gia WhiteHat d\u1ef1a tr\u00ean c\u00e1c b\u00e1o c\u00e1o v\u00e0 “profile” tinh vi v\u1ec1 RedHook, d\u01b0\u1eddng nh\u01b0 \u0111\u00e2y kh\u00f4ng \u0111\u01a1n thu\u1ea7n l\u00e0 m\u1ed9t chi\u00eau l\u1eeba \u0111\u1ea3o c\u00e1 nh\u00e2n th\u00f4ng th\u01b0\u1eddng, m\u00e0 cho th\u1ea5y d\u1ea5u hi\u1ec7u c\u1ee7a m\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng m\u1ea1ng c\u00f3 t\u1ed5 ch\u1ee9c \u0111\u01b0\u1ee3c l\u00ean k\u1ebf ho\u1ea1ch b\u00e0i b\u1ea3n.<\/p>\n

    B\u1edfi m\u1ee5c ti\u00eau c\u00f3 l\u1ebd kh\u00f4ng ch\u1ec9 l\u00e0 \u0111\u00e1nh c\u1eafp th\u00f4ng tin c\u00e1 nh\u00e2n hay chi\u1ebfm \u0111o\u1ea1t t\u00e0i s\u1ea3n m\u00e0 c\u00f2n c\u00f3 th\u1ec3 li\u00ean quan \u0111\u1ebfn gi\u00e1n \u0111i\u1ec7p m\u1ea1ng n\u1ebfu kh\u00f4ng may ng\u01b0\u1eddi d\u00f9ng \u0111\u00f3 l\u00e0 c\u00e1n b\u1ed9, nh\u00e2n vi\u00ean nh\u00e0 n\u01b0\u1edbc ho\u1eb7c nh\u1eefng ng\u01b0\u1eddi s\u1eed d\u1ee5ng d\u1ecbch v\u1ee5 c\u00f4ng.<\/p>\n

    M\u00e3 ngu\u1ed3n \u1ee9ng d\u1ee5ng ch\u1ee9a nhi\u1ec1u ghi ch\u00fa b\u1eb1ng ti\u1ebfng Trung, cho th\u1ea5y kh\u1ea3 n\u0103ng m\u00e3 \u0111\u1ed9c c\u00f3 ngu\u1ed3n g\u1ed1c t\u1eeb nh\u00f3m ph\u00e1t tri\u1ec3n n\u01b0\u1edbc ngo\u00e0i, c\u00f3 th\u1ec3 thu\u1ed9c khu v\u1ef1c Trung Qu\u1ed1c. D\u00f9 k\u1ef9 thu\u1eadt nh\u01b0 gi\u1ea3 m\u1ea1o website hay \u1ee9ng d\u1ee5ng c\u1ee7a c\u01a1 quan ch\u00ednh ph\u1ee7 kh\u00f4ng c\u00f2n m\u1edbi, nh\u01b0ng l\u1ea1i v\u00f4 c\u00f9ng hi\u1ec7u qu\u1ea3 v\u1edbi ng\u01b0\u1eddi d\u00f9ng thi\u1ebfu c\u1ea3nh gi\u00e1c, \u0111\u1eb7c bi\u1ec7t l\u00e0 ng\u01b0\u1eddi cao tu\u1ed5i, ng\u01b0\u1eddi \u00edt hi\u1ec3u bi\u1ebft c\u00f4ng ngh\u1ec7 ho\u1eb7c \u0111ang c\u00f3 nhu c\u1ea7u s\u1eed d\u1ee5ng d\u1ecbch v\u1ee5 c\u00f4ng tr\u1ef1c tuy\u1ebfn. \u0110\u00e2y l\u00e0 m\u1ed1i \u0111e d\u1ecda nghi\u00eam tr\u1ecdng, c\u1ea7n \u0111\u01b0\u1ee3c c\u1ea3nh b\u00e1o r\u1ed9ng r\u00e3i trong c\u1ed9ng \u0111\u1ed3ng.<\/p>\n

    \n
    \"1753865511946.png\"<\/div>\n

    App s\u1eed d\u1ee5ng ti\u1ebfng Trung Qu\u1ed1c \u0111\u1ec3 ghi l\u1ea1i log<\/i>\u200b<\/div>\n

    Ng\u01b0\u1eddi d\u00e2n c\u1ea7n l\u00e0m g\u00ec \u0111\u1ec3 b\u1ea3o v\u1ec7 m\u00ecnh?<\/b>\u200b<\/h2>\n

    Kh\u00f4ng t\u1ea3i app t\u1eeb link l\u1ea1\u200b<\/h4>\n