Typosquatting and combosquatting badware risks

[NotaInutilis]

URL(s) where the issue occurs.

revanced-extended.com
extendedrevanced.com
ytrevanced.app
ytvancedpro.com
revancedextend.com
youtuberevancedextended.com
magiskmodule.com
magiskzip.com
vancedapp.com
vancedmanager.org

Description

Found several fake sites that did not trigger the badware filter.
I'm not quite sure if there are any other steps to do before sharing those, like providing sources/proofs other than those not being the official website, or reporting them to security vendors first.

https://en.wikipedia.org/wiki/Typosquatting

[ghost]

||revanced-*.$doc,domain=~revanced.app
||ytrevanced.*$doc,domain=~revanced.app
||vancedmanager.*$doc,domain=~revanced.app
||revancedextend.*$doc,domain=~revanced.app
||ytvanced*.*$doc,domain=~revanced.app

if I recall correctly vancedapp.com used to be a real YT Vanced site, but YT Vanced recieved a cease & desist notice

[krystian3w]

Most do not make sense, due official website do not connect with scam hosts and doc generate only strict block at scam page.

[ItsProfessional]

if I recall correctly vancedapp.com used to be a real YT Vanced site, but YT Vanced recieved a cease & desist notice

If I recall correctly, the official vanced domain was vanced.app, not vancedapp.com.

[mapx-]

It would be useful to do /know:

• any of those sites what security risks is presenting (malicious downloads, privacy issues etc)
• scan them using virustotal
• references from security / antimalware forums

If only not official pages this does not make them badware items

[ghost]

https://revanced-extended.com/ => "MicroG" => https://www.virustotal.com/gui/file/1d3bba1bb0679e722942b6d3910305ec74bd70c6aaabc48b7055032283d5a23b/behavior

microg prompted by official Revanced => https://github.com/TeamVanced/VancedMicroG/releases => https://www.virustotal.com/gui/file/e5ce4f9759d3e70ac479bf2d0707efe5a42fca8513cf387de583b8659dbfbbbf

[ItsProfessional]

If only not official pages this does not make them badware items

Really? These are not fan-made sites. These are shady phishing sites.

All of these websites provide custom built apks of revanced/magisk. God knows what kind of modifications could be in those apks or magisk modules. It doesn't matter if Virustotal shows a green tick mark.

Regardless, I think these unofficial sites actively harm the rep of said projects, even if they aren't currently hosting malware.

[mapx-]

I think these unofficial sites actively harm the rep of said projects

It's about badware not about whatever projects.

Really? These are not fan-made sites. These are shady phishing sites.

It's what I wrote: "what security risks is presenting"

For further doubts use the slack channel - pm me

[NotaInutilis]

Okay, I'll do more research on these sites when I have some time. It won't be quick, but I'll do my best to provide useful info.

magiskmodule.com: some download pages (https://www.magiskmodule.com/revanced-18-41-34-apk-magisk-module-2023/) redirect to a very weird, completely unrelated SEO spam filled blog which then redirects to a github file (https://github.com/magiskmodule/YouTube-Premium/raw/main/Youtube18.40.34_arm64-v8a.apk).
VT has only one suspicious flag https://www.virustotal.com/gui/url/1e77af74f02542c71a65f334b9040a8a3b162550e231889ab44e41a831984511?nocache=1

youtuberevancedextended.com: redirects to the github of revanced.net which is already blocked by the filter revanced.*. The file is https://github.com/revancedapps/revanced.net/releases/download/2023-46/revanced.net_revanced_youtube_ext_v18.43.45.apk
VT has only one suspicious flag https://www.virustotal.com/gui/url/bf8bb57fbc854fce045c213fb5e0e436cc693600c9e8ec15a43931e74919e8bd

revancedextend.com hosts its files on get.gbapkdownload.net which is flagged malicious by VT https://www.virustotal.com/gui/url/8556bc357884e289d453bc5ae173e302f8bd59f0998e8689bac63305398411c2?nocache=1

[krystian3w]

Redirects can be a scam that pays off handsomely if someone doesn't block ads (and most will give up before installing the Trojan).

[iam-py-test]

revanced-extended.com

• Website has no AV detections and no obvious security issues
• Neither file acts suspiciously in a sandbox (httpx://tria[.]ge/231203-sk4wracd43/behavioral1)
• One file has 1 AV detection, other has 0. TrendMicro House Call is a Windows antimalware tool, and that specific detection (TROJ_GEN.R002V01J423) seems likely to be a false positive.
• Both hosted on GitHub repos (both repos have some degree of popularity, neither has been updated recently)

Haven't reverse engineered it or anything, but superficially nothing looks wrong.
Thanks

[mapx-]

I'll convert the issue in a discussion.
We are not a specialized list / forum on malware stuff, so maybe it should be reported to the specialized lists or some of the antimalware forums.

[NotaInutilis]

Both of these lists actually aggregate their content from other sources, and most of them don't even have a contact form for reporting (and/or don't allow registration). I had a hard time submitting something to the anti phishing services before and gave up, just putting it in my own blocklist. I have no idea how the security community operates, it seems quite opaque and difficult to contribute as an outsider.

[iam-py-test]

URLHaus is easy to register (you can login with your GitHub account), and once you register, it is easy to submit URLs.
However, you can only submit the download URLs: https://urlhaus.abuse.ch/api/#policy

[JobcenterTycoon]

URLhaus accepting github now? Last time i tried they said i still need to connect a twitter account.

[iam-py-test]

I think they changed it after the Twitter SSO became unstable?
Now they have "abuse.ch" accounts, though you still use SSO though something

[krystian3w]

If the websites supports Polish language (or with the Google web plugin bar instaled to their CMS/template), then I can add it to 🇵🇱 KAD anti-scam for Poles.

Up to 2 weeks thereafter it will be added to the Steven Black HOSTS list (If someone like his breakage by block OneTrust without exclusions).

Other story is use that project only in uBo Lite.

[partingscientist]

This

uAssets/filters/badware.txt

Line 3382 in 282fbb7

||revancedapp.net^$all,domain=~revanced.app

should be redundant, no? Due to the following?

uAssets/filters/badware.txt

Line 3376 in 282fbb7

||revancedapp.*^$all,domain=~revanced.app

[Yuki2718]

Sure, removed 4936855

[ToIgnore]

what about fake 1337x clones? (1377x)

[ToIgnore]

also https://www.reddit.com/r/Piracy/comments/117fq8t/just_a_quick_heads_up_for_anyone_who_uses_1337xto/

[ToIgnore]

https://1337x.homes/

[Yuki2718]

tbh I don't know which are legit. Aren't they not mirror?

[stephenhawk8054]

If I'm not wrong the official domains are listed here: https://1337x-status.org/ or here: https://1337x.to/about

[Yuki2718]

We can block fake ones if they harm user.

[krystian3w]

What an ugly bot..., copying random texts from the thread.

This bot does not have permission to write to the Polish KAD repository.