From bb68e41c0710b98453d1a62bb2e491f4d04af85a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Donncha=20=C3=93=20Cearbhaill?= Date: Thu, 24 Oct 2024 16:48:03 +0200 Subject: [PATCH] Add detection for disabled system packages --- src/mvt/android/modules/androidqf/packages.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/mvt/android/modules/androidqf/packages.py b/src/mvt/android/modules/androidqf/packages.py index 095edb0..7495dee 100644 --- a/src/mvt/android/modules/androidqf/packages.py +++ b/src/mvt/android/modules/androidqf/packages.py @@ -12,6 +12,8 @@ from mvt.android.utils import ( PLAY_STORE_INSTALLERS, ROOT_PACKAGES, THIRD_PARTY_STORE_INSTALLERS, + SECURITY_PACKAGES, + SYSTEM_UPDATE_PACKAGES, ) from .base import AndroidQFModule @@ -70,6 +72,19 @@ class Packages(AndroidQFModule): elif result["installer"] in PLAY_STORE_INSTALLERS: pass + # Check for disabled security or software update packages + package_disabled = result.get("disabled", None) + if result["name"] in SECURITY_PACKAGES and package_disabled: + self.log.warning( + 'Security package "%s" disabled on the phone', result["name"] + ) + + if result["name"] in SYSTEM_UPDATE_PACKAGES and package_disabled: + self.log.warning( + 'System OTA update package "%s" disabled on the phone', + result["name"], + ) + if not self.indicators: continue