This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Low reputation app

Hi,

Sophos did notify me while charging my freshly factory resetted Samsung Tablet about a "low reputation app".

All my Sasmung devices seem to update/install apps while charging. Atleast the Sophos notification idicates they do. Its the same Scan result as normally installed/updated apps. They do this while "automated Updates" are DISABLED in PlayStore. I updated all my Apps manually before charging my Phone. The Number of Apps before this Sophos notification and after it was the same. So no additional app was installed. I also have disabled installation of apps via unknown sources. The path in the 2nd picture indicates a PlayStore loaded app anyways.

I had this kind of a message from Sophos on another Samsung device too (1 year ago so i dont remember the code/id). On others i never got a warning from Sophos. Even on similar device (aka same Android version).

Another "security" app on my Tablet notifies my about app installations too. At 03:20 i didnt show any installation.

I could find anything online regarding this strange number/code shown by Sophos. My guess would be that it is same kind of internal code/id for PlayStore Apps ...

The storage/... path was empty when i checked it. Sophos says the file/app was removed from safety assessment seconds after the warning message. What does this mean?

Might this be a false positive?

Thx.

This thread was automatically locked due to age.

0 Shweta over 4 years ago

Hi Lukas Lohn

It seems to be some files from the internal storage. Would you please confirm below few things?

1. What is the version of Sophos Mobile Security?

2. What is the Android version of your device?

3. If you re-run the scan do you get the same result?

As from the scan logs, I can see it was added to the safety assessment and after the scan, it was removed from the security rating.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Lukas Lohn over 4 years ago in reply to Shweta

Tablet is at home atm. Trying to answer anyway since i just installed/updated it after a factory reset yesterday before i got the notification.

1. Sophos Intercept X for Mobile: Version 9.5.3225

2. Android 9 + Oni UI-Version 1.0

3. I did a full scan with reputation settings on and i didnt find anything. The folder above was empty anyway.
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 4 years ago in reply to Lukas Lohn

Hi Lukas Lohn

If it did not alert for a low reputation app again after the scan, it can probably be a false positive.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Lukas Lohn over 4 years ago in reply to Shweta

I did another test with a different model of a Samsung Tablet + factory reset + different WLAN and i got a similar notification by Sophos too. The ID/number was different. But it popped up during charging too.

I thought that the Samsung App "Daily Board" is the culprit. I usually disable it after a fresh install on a Samsung device. This App activates itself while charging. I did another factory reset with the Tablet from my 1st Post and got the same result again. Immidiatly after plugging the Tablet for charging Sophos found the App with low rep. After another factory reset + disabling "Daily Board" nothing showed up so far (even while charging).

On the 2nd device i didnt get a notification from sophos right away after beginning of charge.
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 4 years ago in reply to Lukas Lohn

Hi Lukas Lohn

If that is the case, I would suggest you submit the app to our Sophos Labs to analyze if possible. A low reputation does not necessarily mean that the app is a threat, it just means that Sophos is unaware of the app or is yet to be analyzed.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 filipi nic over 4 years ago

I believe this was a ".apk" file which was detected. So you/some program will need to run it to infect the device. This app was flagged as a low reputation application and app reputation is a part of Sophos Mobile Security's Live Protection feature which means it was detected in real time. The path of the app suggests that this was placed in the external SD card so there could be many ways how it was placed in that location. Did anything show up in a full scan? Walgreenslistens
Cancel
Vote Up 0 Vote Down

Cancel
0 Lukas Lohn over 4 years ago in reply to filipi nic

No, nothing showed up in a full scan.

"The storage/... path was empty when i checked it. Sophos says the file/app was removed from safety assessment seconds after the warning message. "

Sophos always had a strange behaviour on Samsumg devices (confirmed by other Samsung users). There are many entries in the scan protocoll even when nothing is installed or the routine scan is running. See "https://community.sophos.com/products/mobile/f/sophos-mobile-security-for-android/112018/what-is-this-scheduled-scan-finished-0-object-scanned" for example. So i doubt there really was an installation of something. Atleast its not a installation initiated by a user via PlayStore.

I dont have an SD-Card installed in the devices i tested it with. The search results for this paths are misleading. It should be the "download folder" for PlayStore.
Cancel
Vote Up 0 Vote Down

Cancel