- Dec 27, 2016
- 1,480
Even after multiple efforts by Google, malicious apps managed to bypass its Play Store's anti-malware protections. Security firm Check Point on Thursday published a blog post revealing at least 50 free Android apps on Play Store that were downloaded between 1 & 4.2 Million times before Google removed them.
These apps come with hidden malware payload that secretly registers victims for paid online services, sends fraudulent premium text messages from victims' smartphones and leaves them to pay the bill— all without the knowledge or permission of users.
Dubbed ExpensiveWall, the malware comes hidden in free wallpaper, video or photo editing apps. It's a new variant of malware that Mcafee spotted earlier this year on the Play Store.
But what makes ExpensiveWall malware different from its other variants, is that it makes use of an advanced obfuscation technique called "packed" — which compresses malicious code and encrypts it to evade Google Play Store's built-in anti-malware protections.
The researchers notified Google of the malicious apps on August 7, and the software giant quickly removed all of them, but within few days, the malware re-emerged on the Play Store and infected over 5,000 devices before it was removed four days later, Check Point said.
How ExpensiveWall works?
Once an app with ExpensiveWall—which researchers think came from an SDK called GTK—is downloaded on a victim's device, it asks for user's permission to access the Internet, and send and receive SMS.
The internet access is used by the malware to connect the victim's device to the attacker's command and control (C&C) server, where it sends information including its location alongside unique hardware identifiers, such as MAC and IP addresses, IMSI and IMEI numbers.
The C&C server then sends the malware a URL, which it opens in an embedded WebView window to download JavaScript code that begins to clock up bills for the victim by sending fraudulent premium SMS messages without their knowledge, and uses the victim's phone number to register for paid services.
A Brief History of Play Store Malware
These apps come with hidden malware payload that secretly registers victims for paid online services, sends fraudulent premium text messages from victims' smartphones and leaves them to pay the bill— all without the knowledge or permission of users.
Dubbed ExpensiveWall, the malware comes hidden in free wallpaper, video or photo editing apps. It's a new variant of malware that Mcafee spotted earlier this year on the Play Store.
But what makes ExpensiveWall malware different from its other variants, is that it makes use of an advanced obfuscation technique called "packed" — which compresses malicious code and encrypts it to evade Google Play Store's built-in anti-malware protections.
The researchers notified Google of the malicious apps on August 7, and the software giant quickly removed all of them, but within few days, the malware re-emerged on the Play Store and infected over 5,000 devices before it was removed four days later, Check Point said.
How ExpensiveWall works?
Once an app with ExpensiveWall—which researchers think came from an SDK called GTK—is downloaded on a victim's device, it asks for user's permission to access the Internet, and send and receive SMS.
The internet access is used by the malware to connect the victim's device to the attacker's command and control (C&C) server, where it sends information including its location alongside unique hardware identifiers, such as MAC and IP addresses, IMSI and IMEI numbers.
The C&C server then sends the malware a URL, which it opens in an embedded WebView window to download JavaScript code that begins to clock up bills for the victim by sending fraudulent premium SMS messages without their knowledge, and uses the victim's phone number to register for paid services.
A Brief History of Play Store Malware
- Last month, over 500 Android apps with spyware capabilities were found on Play Store, which had been downloaded more than 100 million times.
- In July, Lipizzan spyware apps were spotted on Play Store that can steal a whole lot of information on users, including text messages, emails, voice calls, photos, location data, and other files, and spy on them.
- In June, more than 800 Xavier-laden apps were discovered on Google Play that had been downloaded millions of times, and the same month researchers found first code injecting rooting malware making rounds on Google Play Store.
- A month prior to it, researchers spotted 41 apps on Play Store hidden with the Judy Malware that infected 36.5 million Android devices with malicious ad-click software.
- In April, over 40 apps with hidden FalseGuide malware were spotted on Play Store that made 2 Million Android users victims.
- Earlier this year, researchers also discovered a new variant of the HummingBad malware, dubbed HummingWhale, hidden in more than 20 apps on Google Play Store, which were downloaded by over 12 Million users.
