Judy, Judy, Judy; Malware affects as many as 36.5 million Android devices
Last week, researchers at Check Point discovered malware called "Judy" that could have infected as many as 36.5 million Android devices. The auto-clicking adware generates large numbers of fraudulent clicks on ads, resulting in large sums being paid to the hackers behind the operation. The malware was found on 41 apps offered by a Korean firm, and quickly spread between 4.5 million and 18.5 million downloads.
The interesting thing is that many of these apps had been listed in the Google Play Store for years, but all of them had recently been updated. Check Point also discovered a few apps written by other developers that contained the same malware. It isn't known what the connection is between the different developers, and if the malware was knowingly or accidentally spread.
The apps containing the malware are developed by a company from Korea named Kiniwini, using the name of ENISTUDIO corp. on the Google Play Store. For its part, Google has already removed the malicious apps from the Play Store. The apps listed by Kiniwini all included the name Judy in the title, which explains how the malware received its name. It should be pointed out that Kiniwini also develops apps for the Apple App Store.
If you have any of these apps on your phone or tablet, make sure that you delete them immediately.
source: CheckPoint via BGR
The apps containing the malware are developed by a company from Korea named Kiniwini, using the name of ENISTUDIO corp. on the Google Play Store. For its part, Google has already removed the malicious apps from the Play Store. The apps listed by Kiniwini all included the name Judy in the title, which explains how the malware received its name. It should be pointed out that Kiniwini also develops apps for the Apple App Store.
"To bypass Bouncer, Google Play’s protection, the hackers create a seemingly benign bridgehead app, meant to establish connection to the victim’s device, and insert it into the app store. Once a user downloads a malicious app, it silently registers receivers which establish a connection with the C&C server. The server replies with the actual malicious payload, which includes JavaScript code, a user-agent string and URLs controlled by the malware author. The malware opens the URLs using the user agent that imitates a PC browser in a hidden webpage and receives a redirection to another website. Once the targeted website is launched, the malware uses the JavaScript code to locate and click on banners from the Google ads infrastructure...Upon clicking the ads, the malware author receives payment from the website developer, which pays for the illegitimate clicks and traffic."-Check Point
If you have any of these apps on your phone or tablet, make sure that you delete them immediately.
source: CheckPoint via BGR
Popular stories
Latest News
FCC OKs Cingular\'s purchase of AT&T Wireless
Things that are NOT allowed: