Finding the nameOTAServicepromising, we pulled downtheAPKandbegantoreverse-engineer itusingJADX.After some digging, wediscovered how the appwasbuilding the downloadURL stringfor OTA updates,which would then be passed tobeginDownload(),as seen inFigure5. We also noticed quite a fewAn...