New Attack Uses Attackers' Own Ad Network To Deliver Android Malware 59
Trailrunner7 writes "The concept of malware riding shotgun with legitimate mobile apps is not a new one. There have been a slew of cases in which attackers have compromised apps in the Google Play store and inserted malware into the file. But a new attack uncovered by Palo Alto Networks is using a new technique that starts with the user installing an app on her Android phone. The app could be a legitimate one or a malicious one, but it will include some code that, once the app is installed, will reach out to an ad network. Many apps include such code for legitimate ad revenue purposes, but these apps are connecting to a malicious ad network. Once the connection is made, the app will then wait until the user is trying to install another app and will pop up an extra dialog box asking for permission to install some extra code. That code is where the bad things lie. The malicious code immediately gains control of the phone's SMS app for both command and control and in order to sign the victim up for some premium-rate SMS services. The attack is interesting, said Wade Williamson, a senior security analyst at Palo Alto, because the attackers can use a legitimate ad network that's already connected to a group of apps and then at any given time flip the switch and begin using it for malicious purposes."
Then it is malicious... (Score:5, Insightful)
The app could be a legitimate one or a malicious one, but it will include some code that, once the app is installed, will reach out to an ad network. Many apps include such code for legitimate ad revenue purposes, but these apps are connecting to a malicious ad network.
Inotherwords "but it has malware in it for the ad portion that goes to a malicious ad network" - or the app IS malicious and not legitimate. An app isn't magically legitimate if only some portions of it are malware.
Re:Then it is malicious... (Score:5, Funny)
The app could be a legitimate one or a malicious one, but it will include some code that, once the app is installed, will reach out to an ad network. Many apps include such code for legitimate ad revenue purposes, but these apps are connecting to a malicious ad network.
Inotherwords "but it has malware in it for the ad portion that goes to a malicious ad network" - or the app IS malicious and not legitimate. An app isn't magically legitimate if only some portions of it are malware.
"Sometimes is difficult differentiate between Stupidware and Malware - Stupidware being sloppily written, which allows attacks and Malware which was purposefully written to allow attacks. Both date back at least a decade. That it's happening on a mobile device is simply a logical iteration of a predictable progression, Captain."
"That ... still ... does not fix the ... communicator, Spock."
Re: (Score:3)
I guess ... I mean, if you want to use words and definitions and stuff, then yes, you're right.
BTW, this story has some kind of clustersummary. Monkeys and keyboards don't mix.
I read the summary thinking "citation needed... citation needed" and "What does that mean?" Turns out the words were just lifted from the article at threatpost.com which was just as poorly written, and also only includes one link -- to another [threatpost.com] page on the same site. That original article simply describes a method of carrying out a DDOS attack by paying for some ads then using javascript (could even be html) on those ads to contribute to the DDOS. Cheap, not fancy, put would work if someone is stupid enou
Android (Score:4, Funny)
The only unix-based platform riddled with security issues, viruses and trojans problems.
Re: (Score:2)
Popularity != Vulnerability.
Stop spreading FUD.
Re: (Score:2)
Popularity maps to number of attackers in an exponential curve.
Obscurity =/= hardening against hacking, and one does not properly derive confidence for the security of one's system when it is attacked at 1/1000th another system's attack load.
Re: (Score:2)
oh the unix like part is fine it is the Java vm that like in many other software stacks is the root of the problem.
Re: (Score:2)
Out of curiosity, has anyone here actually run into any Android malware? Most of the people I know have been using Android for quite some time and nobody has encountered any (but they do tend to tick to the Play or Amazon stores).
Re: (Score:3)
um android is generally found on tablets. Keyboards generally don't apply.
this is either an ID10T or MUE(Moronic User Error) depending on your point of view.
Re:FAIL (Score:5, Funny)
Problem
Between
Kindle
And
Chair?
Re: (Score:1)
Advertising has ran amok... (Score:2)
Yet another good reason to avoid ads, and ignore those you can't avoid.
cross-site attacks (Score:5, Insightful)
Advertising on the internet is the most common route for malware by far. That's why I install ad blocking software everywhere. Marketers whine and complain about lost revenue and try to guilt you by saying they need that revenue to run the sites "for free"... but the truth is the way most advertising networks operate allow for "dancing, singing" ads -- that is, injectable javascript. Everything in the marketer's world these days is about using java to track, probe, manipulate, etc., web pages, with pop-overs, pop-unders, drive-bys, side to side scrollers, sound, motion, and anything else to get your attention.
None of this would be a problem if they stuck to fixed-size IMG tags and graphics. In other words... marketing is a virus. It's the plague. It's not the browser's fault... it's these asshole profiteers who try to be endlessly creative in force-feeding people crap they don't want.
Re: (Score:2)
Re: (Score:1)
No. It's the word "more", which is confusing when used with percentages.
A word with 6 typos would have "20% more typos" than a word with 5 typos. However, this is in itself disputable, because even if a word has more than one error in it, we often just say "it's a typo" instead of "it has 5 typos in it". For instance, if you transpose two letters by mistake (e.g. "flase"), do you say it has 2 typos in it? I know I don't.
Even if we accept the premise that each incorrect letter counts as one "typo", then you
Re: (Score:1)
Re: (Score:3)
Re: (Score:1)
It's true. Adblock+ is security software. Much better than any firewall or AV package I might ad.
Ad vendors are scum and often lack diligence. Why? Because money that's why.
Ad networks are vulnerable and are frequently hijacked because one ad network reaches out to a huge attack surface. (You get to touch every single user on every web page that that ad network uses)
Re: (Score:3)
Re:cross-site attacks (Score:4, Insightful)
Except well, how do you expect developers to eat?
I suppose the same way everyone else does: By providing a good or service in exchange for monentary compensation. I know, it's an outmodded concept in the Web 2.0 way of thinking... but There Ain't No Such Thing As A Free Lunch. Advertising is not required for the survival of the species nor is its absence detrimental to long-term economic growth and stability.
Remember, the ad is loaded by the app, and given Android's fairly limited ways of monetization, developers would like to make some money back. If not through a 4rd party ad network, then through siphoning your user data off the phone to their servers.
I would ask you whether Linux requires monetization of its applications in order to be useful, or that developers are not compensated in other ways. Short answer: Yes.
Ads pretty much the only way to beat iOS at the revenue game.
Call me old fashioned, but the way to beat someone at a game is to play it better than they do. It's called competition, and if you provide a better product or service, then in a fair and open market, you should win. If this isn't true, then the problem is with the market, your perception of it, or with external forces.
Re: (Score:2)
Re: (Score:2)
Find a way to display tasteful ads responsibly?
The Matrix (Score:5, Insightful)
Marketing is a disease, a cancer of the Web, it is a plague, and blocking software is the cure.
Re: (Score:2)
I described this two weeks ago, /.rs said impossib (Score:3)
A couple of weeks ago when I described this attack, some commenters said it was impossible - an app can't wait until the user was expecting a permission prompt from a different app, then request more permissions itself, they said.
I wonder if they still think it's impossible now that it's publicly reported to be in the wild.
Re: (Score:2)
So Android apps aren't in a sandbox? Why does an app get a notification that another app is being installed AT ALL?
Re: (Score:2)
"It's working! Neville - It's working..." (Score:2, Interesting)
I avoid ads totally (especially malscripted ones) via hosts files:
---
APK Hosts File Engine 9.0++ 32/64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74 [start64.com]
---
Yes, even on an android smartphone
(Via ADB/Android Debugging Bridge & its PULL command, but use smaller optimized hosts there folks - not much room, shitty caching (sorry google, it's true)).
As long as attacks = host-domain name based
How does this happen? (Score:2)
... in order to sign the victim up for some premium-rate SMS services.
The fuck?
Why the hell doesn't the FTC shut these companies down? Why doesn't the FCC kick the carrier's behind into policing these companies better? Why doesn't the US attorney's office rain hellfire and brimstone down on these companies to the extent it did to Aaron Schwartz?
Premium SMS is billed through the carriers, so they have a relationship with the SMS company. There is a clear money trail. The recipient is most likely incorporated. This should be easy.
With all the US mistrust of government right now
Good thing I have sprint (Score:1)
Good thing I have sprint, I never get any signal for the virus to send SMS messages, and forget about signing up for any services (useful or not). :/