Malware-infected apps sneak into Google Play, leave Android devices wide open for attacks
posted by Luis D. / May 18, 2016, 7:57 AM
The legend of vikings who siege settlements to loot their goods and set them ablaze is alive and well in the latest Android malware scenario. Apparently, not only do they still exist, but they also strike dangerously close to home. In April, researchers from 'Checkpoint' investigated a malware campaign in which a horde of malicious apps somehow breached the Google Play store's gates and attacked unsuspecting Android phones. Some of them even climbed to the top ranks with their large volume of downloads, before users started sensing there's something wrong with them and lowered their rankings.
The apps 'Viking Jump', 'WiFi Plus', 'Parrot Copter', 'Memory Booster', and 'Simple 2048' contain malicious components that begin their activity post their initial launch. Two binaries named like Android system files are installed on the storage, with one used for exchanging information between the malware's parts, and the other keeping a list of all its components. The virus checks for root permissions, and if your device is rooted, two additional components are installed for the attackers' purposes. Regardless of whether you have root access or not, the malware will connect to its command and control server, sending the device's battery charge, type of data connection, and phone number.
Download top-ranked app, get infected. No extra in-app purchases required!Finally, the server opens a proxy connection capable of sending and receiving information between server and device according to the hacker's whim. In this campaign's case, devices are hijacked to simulate clicks on online advertisements and generate profit. Some of the applications also send premium SMS messages, and the proxy allows for DDoS attacks, spamming, and remote code execution. Your device pretty much becomes the hacker's puppet.
Checkpoint Security traced 44% of the infections to Russia, which is explained by the prevalence of Android 4.4 in the country. Later operating system versions (Lollipop and Marshmallow) have stricter permissions control, thus the malware which relies on very suspicious permission sets is less likely to get past observant users. Alas, the researchers haven't made recommendation about anything you could do in the event of infection. Hopefully, a decent antivirus app will be able to bring things back in order.
Checkpoint notified Google about the discovery in early May. Unfortunately, this isn't the first time malware apps have invaded the Google Play store. In 2014, a number of applications with embedded BitCoin miners got loose and wrangled users' handsets into mining cyber-gold for the attackers' advantage. Although occurrences of malware apps inside the Play store are isolated incidents rather than a tendency, the mere possibility of infection by means of downloading a top-ranked, seemingly harmless app is quite alarming.
Posts: 14967; Member since: Sep 25, 2013
Nothing to worry about, if you don't download them.
posted on May 18, 2016, 8:17 AM 10
Posts: 713; Member since: Sep 19, 2014
And it won't brick the device.
posted on May 18, 2016, 10:17 AM 4
posted on May 18, 2016, 11:35 AM 5
Posts: 520; Member since: Jun 22, 2015
Just another day in the android world (no offence intended).
posted on May 18, 2016, 8:29 AM 5
Posts: 5029; Member since: Mar 30, 2015
None taken. After all i can count on 1 hand the number of infected android device i saw in past 6 year i work in cellphone industry. So overblown article like this from pro apple website dont hurt me much.
posted on May 18, 2016, 3:02 PM 3
Posts: 122; Member since: Jul 22, 2009
It's almost like PhoneArena would intentionally run an article like this to take away from Google on their big day. Guarantee you ain't seeing something like this on Apple's big day....just saying!
posted on May 18, 2016, 8:34 AM 4
Posts: 7493; Member since: Feb 17, 2016
Google's big day? Who's the lucky groom?
posted on May 18, 2016, 8:39 AM 6
Posts: 399; Member since: May 02, 2016
And dck rhymes with dickjedii. Coincidence. Leave Mxzy alone. He is way much better than that Darkkjeddi Apple fanboy. Well Mxzy replies with facts and quotes, aswell as knowledge. But that Darkkjeddi is a troll.
posted on May 18, 2016, 11:07 AM 0
Send a warning to post author
Send a warning to Selected user.
The user has 0 warnings currently.
Next warning will result in ban!
Ban user and delete all posts
Message to PhoneArena moderator (optional):