2

After deploying new version to Google.Play with enabled crash reporting (by Crashlytics) I see reports about weird crashes:

  1. Activity is started without required parameter in Intent. But this activity is not exported (no intent-filter, no explicit exported="true" in manifest)
  2. Same for intent service

What's weird:

  1. Some parameters which are set on first start of app by user are not set (these parameters are always shown for normal crash report). Without setting them app can't work and user can't get to the point where this activity/service is started.
  2. No such errors during testing our app. No problems with our code found.
  3. Device on which errors occur:
    • No device id as usual (Nexus, Samsung, etc.) but shown as 'generic'
    • Android 2.3.4
    • Rooted

These characteristics are common for all three errors.

This leads me to a thought that may be someone is trying to start components of app, after reading them from manifest. May be searching for vulnerabilities.

My question is, have you seen such errors and do you have any ideas what can be their cause?

marwinXXII
  • 1,456
  • 14
  • 21
  • I have seen this same issue in my crash reports and mixpanel logs (that totally don't make sense) and I think there is some kind of spyware/malware detection application that runs these binaries. It's able t o do things that normal phones can't because it's rooted. – Matt Wolfe Apr 02 '15 at 20:35
  • I agree about spyware/malware detection, might be the case. Actually, it is not required for ROM to be rooted, activities can be started with adb (same applies to services, I suppose). Also these can be rooted emulators, because device name is 'generic'. – marwinXXII Apr 03 '15 at 14:49
  • Any more information on this? I'm seeing the same issue. – ono Dec 29 '15 at 07:48
  • Could this be related? http://stackoverflow.com/questions/26346336/unknown-device-in-the-crashlytics-log/31957108#31957108 – ono Dec 29 '15 at 07:53
  • Can be. We just ignored such errors. – marwinXXII Dec 29 '15 at 21:24

1 Answers1

0

My question is, have you seen such errors and do you have any ideas what can be their cause?

Not such errors exactly but cases where users used tools which interfered with an app on a low level causing similar problems.

My best guess, based on your observations, is that your assumption of a user deliberately starting components of your app is correct.

cygery
  • 2,309
  • 3
  • 18
  • 25