Technology
42 malicious apps affected 8 million Android users
London, Oct 25
Security researchers have detected a massive year-long adware campaign where the involved apps were installed on users' Android devices eight million times from Google Play alone.
Slovak internet security company ESET identified 42 apps on Google Play as belonging to the campaign, which had been running since July 2018. Of those, 21 were still available at the time of discovery.
"We reported the apps to the Google security team and they were swiftly removed. However, the apps are still available in third-party app stores," said the researchers in a statement on Thursday.
Once launched, the "Ashas" adware family app sent "home" key data about the affected device: device type, OS version, language, number of installed apps, free storage space, battery status, whether the device is rooted and Developer mode enabled, and whether Facebook and FB Messenger are installed.
"The app receives configuration data from the command and control server (C&C) server, needed for displaying ads, and for stealth and resilience," said security researcher Lukas Stefanko.
Once a user installed an adware-infected app, the app will show full-screen ads on the device's display at intervals.
First, the malicious app tries to determine whether it is being tested by the Google Play security mechanism.
After dodging Google servers, the malicious app can set a custom delay between displaying ads. Based on the server response, the app can also hide its icon and create a shortcut instead.
"If a typical user tries to get rid of the malicious app, chances are that only the shortcut ends up getting removed. The app then continues to run in the background without the user's knowledge. This stealth technique has been gaining popularity among adware-related threats distributed via Google Play," the researchers noted.
According to the team, students at a Vietnamese university may be behind the malicious adware app.
"Due to poor privacy practices on the part of our culprit's university, we now know his date of birth, we know that he was a student and what university he attended. We retrieved his University ID; a quick googling showed some of his exam grades," said researchers.
"The malicious developer also has apps in Applea¿s App Store. Some of them are iOS versions of the ones removed from Google Play, but none contain adware functionality," said Stefanko.
Slovak internet security company ESET identified 42 apps on Google Play as belonging to the campaign, which had been running since July 2018. Of those, 21 were still available at the time of discovery.
"We reported the apps to the Google security team and they were swiftly removed. However, the apps are still available in third-party app stores," said the researchers in a statement on Thursday.
Once launched, the "Ashas" adware family app sent "home" key data about the affected device: device type, OS version, language, number of installed apps, free storage space, battery status, whether the device is rooted and Developer mode enabled, and whether Facebook and FB Messenger are installed.
"The app receives configuration data from the command and control server (C&C) server, needed for displaying ads, and for stealth and resilience," said security researcher Lukas Stefanko.
Once a user installed an adware-infected app, the app will show full-screen ads on the device's display at intervals.
First, the malicious app tries to determine whether it is being tested by the Google Play security mechanism.
After dodging Google servers, the malicious app can set a custom delay between displaying ads. Based on the server response, the app can also hide its icon and create a shortcut instead.
"If a typical user tries to get rid of the malicious app, chances are that only the shortcut ends up getting removed. The app then continues to run in the background without the user's knowledge. This stealth technique has been gaining popularity among adware-related threats distributed via Google Play," the researchers noted.
According to the team, students at a Vietnamese university may be behind the malicious adware app.
"Due to poor privacy practices on the part of our culprit's university, we now know his date of birth, we know that he was a student and what university he attended. We retrieved his University ID; a quick googling showed some of his exam grades," said researchers.
"The malicious developer also has apps in Applea¿s App Store. Some of them are iOS versions of the ones removed from Google Play, but none contain adware functionality," said Stefanko.
4 hours ago
Hundred million dollars to support Amritsar startups pledged by Indian-Americans
4 hours ago
Sikh activist's murder leads to three arrests in Canada
4 hours ago
Members of Congress from Indian-American communities send best wishes during AANHPI Heritage Month
5 hours ago
Rutgers University faces criticism from GOPIO over its policy of displaying the separatist Kashmiri flag on campus.
5 hours ago
Young child and elderly Indian couple killed in tragic Canadian collision
5 hours ago
The foreign minister of India has spoken out against Biden's "xenophobia" statement.
6 hours ago
UNGA president invokes Mahatma Gandhi to call for protecting journalists
6 hours ago
CMFRI holds awareness campaign on climate change for fishing communities
6 hours ago
President Murmu reaches Shimla for five-day visit
6 hours ago
K'taka CM chairs SIT meeting, orders immediate arrest of Prajwal Revanna
6 hours ago
Arvinder Singh Lovely and four others join BJP, days after quitting Congress
6 hours ago
Inspiring voices of India’s women panchayat leaders resonate at UN meet
6 hours ago
Ola Krutrim opens AI Cloud infrastructure for developers, launches mobile app