- Jul 22, 2014
- 2,525
An Android app named "System Update" that secretly contained a spyware family named SMSVova, survived on the official Google Play Store for at least three years, since 2014, when it was updated the last time.
Google intervened this week, after a report from mobile security firm Zscaler, but by the time Google took it down, between one and five million users had already installed it on their phones.
This happened even if the app's Play Store page looked extremely suspicious, as it featured blank white screenshots and one sentence as its description, reading: "This application updates and enables special location features."
User reviews left on the Play Store page also reflected the app's shady behavior, with Android users complaining the app didn't update their system as promised but simplify disappeared from their screen after they ran it the first time.
New SMSVova spyware was hidden inside the app's code
According to Zscaler researcher Shivang Desai, who analyzed the app's source code in a technical write-up here, the System Update app didn't contain any "system updating" features, but only spyware-like behavior.
Desai says the malware found within, which he named SMSVova, included functionality that set up an Android service and a broadcast receiver.
.....
Google intervened this week, after a report from mobile security firm Zscaler, but by the time Google took it down, between one and five million users had already installed it on their phones.
This happened even if the app's Play Store page looked extremely suspicious, as it featured blank white screenshots and one sentence as its description, reading: "This application updates and enables special location features."
User reviews left on the Play Store page also reflected the app's shady behavior, with Android users complaining the app didn't update their system as promised but simplify disappeared from their screen after they ran it the first time.
New SMSVova spyware was hidden inside the app's code
According to Zscaler researcher Shivang Desai, who analyzed the app's source code in a technical write-up here, the System Update app didn't contain any "system updating" features, but only spyware-like behavior.
Desai says the malware found within, which he named SMSVova, included functionality that set up an Android service and a broadcast receiver.
.....
