Infected Apps in the Google Play Store Turn Android Phones into Porn Hubs

[The AchieVer]

Infected Apps in the Google Play Store Turn Android Phones into Porn Hubs 

Security company Trend Micro has discovered another batch of malicious apps published in the Google Play Store and which users have downloaded millions of times.

The malware is hiding in the code of what claim to be beauty camera apps which promise to offer filters and further edits that would help improve your photos.

However, after installing the apps, they hide their icons from the application list to make users can’t disable them and use packers to make it more difficult to be analyzed.

But the truly dangerous behavior comes down to full screen ads that are displayed on compromised devices when they are unlocked. Trend Micro’s analysis reveals that the malicious ads typically point to pornography, and the company also detected a paid online pornography player that was downloaded when tapping the popup.

Furthermore, the company discovered that some of these malicious apps also point users to phishing websites that ask for personal information, including addresses and phone numbers.Stealing users’ photosInterestingly, Trend Micro says it also detected a second category of infected apps which only tried to trick users into uploading their photos to a hidden server.

“These apps seemingly allows users to “beautify” their pictures by uploading them to the designated server. However, instead of getting a final result with the edited photo, the user gets a picture with a fake update prompt in nine different languages. The authors can collect the photos uploaded in the app, and possibly use them for malicious purposes — for example as fake profile pics in social media,” the analysis reveals.

Google has already been alerted of these apps and the search giant removed them all, though it’s critical for all users to try to stay away from such malicious listings in the Google Play Store. In most of the cases, the reviews page helps investigate the legitimacy of an app, so just don’t rush to press the install button regardless of the app name.

 

Source

[steven36]

Google Play apps with >4.3 million downloads stole pics and pushed porn ads

 

 

 

 

The 29 apps concealed their malice and were hard for many infected users to uninstall.

 

Google has banned dozens of Android apps downloaded millions of times from the official Play Store after researchers discovered they were being used to display phishing and scam ads or perform other malicious acts.

 

A blog post published by security firm Trend Micro listed 29 camera- or photo-related apps, with the top 11 of them fetching 100,000 to 1 million downloads each. One crop of apps caused browsers to display full-screen ads when users unlocked their devices. Clicking the pop-up ads in some cases caused a paid online pornography player to be downloaded, although it was incapable of playing content. The apps were carefully designed to conceal their malicious capabilities.

 

“None of these apps give any indication that they are the ones behind the ads, thus users might find it difficult to determine where they’re coming from,” Trend Micro Mobile Threats Analyst Lorin Wu wrote. “Some of these apps redirect to phishing websites that ask the user for personal information, such as addresses and phone numbers.”

 

The apps also hid their icons from the Android app list. That made it hard for users to uninstall the apps, since there was no icon to drag and delete. The apps also used compression archives known as packers to make it harder for researchers—or presumably, tools Google might use to weed out malicious apps—from analyzing the wares.

Your selfies are ours

Trend Micro researchers discovered another batch of apps that falsely promised to allow users to “beautify” their pictures by uploading them to a designated server. Instead of delivering an edited photo, however, the server provided a picture with a fake update prompt in nine different languages. The apps made it possible for the developers to collect the uploaded photos, possibly for use in fake profile pics or for other malicious purposes. The developers took pains to prevent users from detecting what was happening.

 

“The remote server used by these apps is encoded with BASE64 twice in the code,” Wu wrote. “In addition, several of these apps can also hide themselves via the same hidden technique mentioned above.”

 

 

The report is the latest to demonstrate that Google can’t be counted on to proactively detect malicious apps available in Play. That puts the onus on end users to carefully scrutinize apps before installing them. One way to do this is to read comments to see if anyone has reported suspicious things, such as receiving pop-up ads, after installing an app. Another important strategy is to limit downloads to those that are truly necessary or useful, and then only when they’re developed by a recognized company. Niche apps that provide little tangible benefit should be avoided.

 

Source