“This story shows that even official markets can be source of malware sometimes. However, it is up to users to protect themselves from malicious apps. There are not that many techniques used by malware apps to attack users, and most of them use privilege escalation by requesting device admin permission (to protect themselves from being deleted). The easiest way to protect yourself is not to grant any dangerous permissions such as device admin permission to games or guides applications. It’s much easier to exploit inexperienced user to get control over his device so stay alert and you will most likely be safe.”
“This is an interesting discovery on the Google Play Store with a huge number of installs, however the real question is how it got through Google security systems. I believe it managed to get to the Play Store due to a missing payload – which displays unwanted adds – that was downloaded not using typical HTTP protocol but Firebase Cloud Messaging (FCM). But that isn’t the worst thing, an attacker using this payload could not only display aggressive advertisement but also download additional apps or even malware with excessive permissions. We at ESET detect this threat as Android/TrojanDownloader.Agent.JR.”
Nikolaos Chrysaidos, Head of Mobile Threats & Security at Avast:
At the moment, it seems like the cybercriminals behind the threat are only interested in making money from ads. The threat currently has very basic functionalities, that are managed through Firebase Cloud Messaging. However, there is nothing stopping the threat from becoming more sophisticated in the future. With the high amount of phones that are supposedly infected, the group behind the botnet could send commands to the infected devices, or bots, and have them download further, more malicious, modules to have them carry out DDoS attacks, for example. We have observed Firebase Cloud Messaging being used by malware authors more and more to send commands and download modules onto infected devices.
“The ongoing challenge of keeping malware out of app stores is another reason why companies must remain vigilant on their own networks, especially if they allow customer-controlled devices onto their corporate networks. Knowing what’s in your IT environment at all times, and being able to detect compromised devices and limit the access of their users becomes increasingly important in reducing overall cyber risk. In this case, it is not enough that the problem applications have been removed from the store, since the devices will remain compromised.”
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.