The fall of Domino - a preinstalled hostile downloader

### Overview This talk details the investigation and inner workings of Domino, a pre-installed hostile downloader and ad-fraud mechanism identified in system images of certain Android devices running Android 7 and below. The investigation originated from security industry reports by Malwarebytes and Kaspersky concerning xHelper—an adware strain renowned for being persistent and unremovable—and its ties to Triada routing trojans. By analyzing affected device system images, researchers discovered that Domino operated alongside xHelper, leveraging deep OS-level modifications across native binaries, core pre-installed applications, and the Android framework to silently install applications and execute ad fraud.

### Key Topics - **Discovery and Integration Package:** Analysis of a complete leaked source code zip archive containing Java code, binaries, SELinux policy adjustments, and a Chinese-language README guiding OEMs or supply-chain integrators on embedding Domino into Android builds. - **Binary Components:** The functionality of two privileged native daemons, internally dubbed `daemon` and `service`, responsible for C2 communication, database configuration, fake SMS injection, and silent APK installation. - **App Modifications:** Enhancements to the AOSP Browser and Settings apps to download arbitrary APKs, hijack default search engine queries, and secretly view ads in the background. - **Framework Modifications:** Interception of intent broadcasts to overwrite Google Play install referrers and link dispatching logic to force navigation into the modified browser.

### Technical Details Domino's integration was documented via a `file_list.txt` roadmap and source comments demarcated with `add_s` and `add_e` around the keyword `domino`. It required OEMs to pre-grant permissions such as `READ_PHONE_STATE` to the AOSP Browser and relied on the custom system property `feature_browser_ext` (or `browser_feature_ext`) as a master kill switch.

The threat consists of two key native binaries: 1. **Daemon (`daemon`):** Runs under the elevated `radio` SELinux context. It communicates over HTTP with endpoints structured around `/fastwebapi/.../service/`, builds SQLite databases holding click URLs and package configurations, and accesses the SMS database to insert fake incoming SMS messages into existing or new threads. 2. **Service (`service`):** Runs under the `shell` context. It executes `pm install` against APK files saved to the SD card, making installations appear as though initiated by a user over ADB. It also directly activates installed applications by launching designated activities without user interaction.

At the application level, the AOSP Browser downloads APKs instructed by C2, verifying preconditions such as active Wi-Fi connectivity and confirming that both `silent_period` and `check_black` flags are inactive. It also injects affiliate parameters (`m`, `c`, `k`) into searches and triggers ad URLs when the device screen is verified to be off.

Within the Android framework, Domino modifies `broadcastIntentLocked` to intercept the `INSTALL_REFERRER` broadcast issued during Google Play app installations. It overwrites the true referrer with the cached referrer collected during screen-off ad browsing, effectively stealing attribution for app installs. Additionally, modifications to `chooseBestActivity` bypass the standard app chooser dialog to ensure web links open exclusively in the modified browser.

### Takeaways Domino demonstrates supply-chain risk where malware is directly integrated into AOSP builds prior to device shipment. It likely functioned as an installation vector for xHelper alongside Triada trojans, using ad fraud and referrer hijacking for monetization. Domino exclusively targeted Android 7 and earlier versions, with no appearances observed on Android 8 or later.