An estimated 600,000 users have mistakenly downloaded malware from Google Play, the official app store for Android devices. The malware attempts to build a botnet which delivers fraudulent mobile adware and earns money for the cybercriminals who created it. IT security experts from Positive Technologies, ESET, Avast and Tenable Network Security commented below.
Alex Mathews, Lead Security Evangelist at Positive Technologies:
“This story shows that even official markets can be source of malware sometimes. However, it is up to users to protect themselves from malicious apps. There are not that many techniques used by malware apps to attack users, and most of them use privilege escalation by requesting device admin permission (to protect themselves from being deleted). The easiest way to protect yourself is not to grant any dangerous permissions such as device admin permission to games or guides applications. It’s much easier to exploit inexperienced user to get control over his device so stay alert and you will most likely be safe.”
Lukáš Štefanko, Malware Researcher at ESET:
“This is an interesting discovery on the Google Play Store with a huge number of installs, however the real question is how it got through Google security systems. I believe it managed to get to the Play Store due to a missing payload – which displays unwanted adds – that was downloaded not using typical HTTP protocol but Firebase Cloud Messaging (FCM). But that isn’t the worst thing, an attacker using this payload could not only display aggressive advertisement but also download additional apps or even malware with excessive permissions. We at ESET detect this threat as Android/TrojanDownloader.Agent.JR.”
Nikolaos Chrysaidos, Head of Mobile Threats & Security at Avast:
At the moment, it seems like the cybercriminals behind the threat are only interested in making money from ads. The threat currently has very basic functionalities, that are managed through Firebase Cloud Messaging. However, there is nothing stopping the threat from becoming more sophisticated in the future. With the high amount of phones that are supposedly infected, the group behind the botnet could send commands to the infected devices, or bots, and have them download further, more malicious, modules to have them carry out DDoS attacks, for example. We have observed Firebase Cloud Messaging being used by malware authors more and more to send commands and download modules onto infected devices.
Cris Thomas, Strategist at Tenable Network Security:
“The ongoing challenge of keeping malware out of app stores is another reason why companies must remain vigilant on their own networks, especially if they allow customer-controlled devices onto their corporate networks. Knowing what’s in your IT environment at all times, and being able to detect compromised devices and limit the access of their users becomes increasingly important in reducing overall cyber risk. In this case, it is not enough that the problem applications have been removed from the store, since the devices will remain compromised.”
About the Author
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
