Security News 75 Android Apps Remove Info-Stealing Adware From Their Code

[LASER_oneXM]

...some quotes from the articlae above:

Experts say that during the past two years, millions of users appear to have downloaded and installed apps infected with one of these three AdDown adware versions. Trend Micro researcher Ecular Xu said AdDown was distributed to various app developers as an advertising SDK, which explains why it was found in so many apps. Xu published a list of apps previously infected, but which have now removed AdDown from their code:

Seventy-five apps available for download from the official Google Play Store had to remove a malicious advertising library that was secretly an adware called AdDown, which Trend Micro researchers have been tracking for the last two years.

This adware appeared in January 2015 and besides showing ads to infected users, it also came with the ability to collect personal data on its victims, and at one point could even secretly install apps without the user's knowledge.

Over time, Trend Micro says it detected the adware in over 800 apps that were uploaded on the Play Store, usually as small utility apps, such as wallpaper changers, photo editors, and flashlight apps.

The first stage of evolution featured the simplest version of the adware, but was also the one with the most intrusive features, coming equipped with a method of installing apps behind the user's back.

The third and last stage of AdDown was first detected starting with September 2016, and while it generally improved the second stage's features, it also added support for detecting and evading sandbox environments.

 

[kamla5abi]

I knew I couldn't trust 100% of the apps that showed up on the play store, but maybe because this stuff pretended to be adware probably Google didn't scrutinize it too hard...They quickly glanced over it at first, saw its something to do with ads, then allowed. Then eventually they probably put those API/SDK on a whitelist to allow it automatically instead of having someone look it over each time?

When you search for any type of app there seems to be lots (maybe 20 or more sometimes) that appear to accomplish the same thing. Normal users probably just pick out of the first few they see, but i go through them to see which permissions they ask for and if any of those permissions seem "over the top" for what the app supposedly does... Ex, I saw a GPS test app that users online reported would improve the time it took to get a GPS fix (it modified some file with different/closer "GPS servers" or something) but the app requested permissions that didn't seem necessary (like able to see phone call list, text data, contacts data, etc etc). Many users probably don't even bother reading about that stuff, they just hit "ok" when it asks for permissions during install cuz they wanna get to the app...

Another, I remember a few years back before android and even iOS implemented native flashlight controls there was tons of apps in both app stores that would just turn on/off the flash light (some had gimmicky features like strobe light type behavior etc too). I think it would basically access and enable the camera API then turn on flashlight through that. Again, some apps from the app stores wanted access to other areas like contacts data, phone data, etc.

Majority of the apps in google play store don't provide any explanation for why they need certain permissions either. Some of them aren't too obvious to non-techy people based on their names, so I can see how so many users downloaded/installed these types of apps (they pretend they do something else, but in reality they are basically like malware). It seems like Google's app approval procedure doesn't really care if you make/upload an app that seems "useless" or "unnecessary" they will allow just about anything lol. Like why the hell do you need an app to change your background?? Theres a setting to do that... Either incredibly lazy people who don't want to go to settings to do that, or maybe just people who aren't very techy?

 

[Urusen]

I have never installed none of those apps, but I hope Google starts to care about Play Store safety.

Any report of CIA or NSA using Play Store apps to infect computer and phones?

 

[Arequire]

Any report of CIA or NSA using Play Store apps to infect computer and phones?

NSA Planned to Hijack Google App Store to Hack Smartphones