Attacks/Breaches
7/19/2012
08:46 AM
Connect Directly
RSS
E-Mail
50%
50%

Android Attackers Launch Fake App Market

Malicious apps include a fake version of Skype that surreptitiously sends text messages to premium-rate numbers, racking up charges to the user and revenue for the cybercriminals.

Having a difficult time distributing your malicious smartphone apps? Then why not just create an entire fake app store to peddle your wares?

In fact, that appears to be the strategy employed by the creator of "myadroidmaklet.net," a third-party app market that purports to offer more than 50 apps for free download, including Adobe Flash Player, Angry Birds Rio, Google Maps, Mozilla Firefox, Need for Speed Hot Pursuit, Opera, Skype, and World of Goo. But in fact, all of these apps are really a Trojan app--malware--in disguise.

Microsoft has dubbed the underlying Trojan Android app as SMSFakeSky, and noted that it's designed to target Russian-speaking users. "It poses as a legitimate application, so when you try to install the Trojan, it may ask you for permissions to run," according to Microsoft's malware analysis. Notably, the app will request permission to read a user's sent and received SMS and MMS messages, to see the user's location, have full Internet access capabilities, modify and delete the contents of removable storage, and to gather all information related to phone calls. The app also typically requests permission to download further required software, such as Adobe Flash Player, although even this installation will be just another version of the Trojan app in disguise.

[ Even legit mobile apps can carry risks. See Free Android Apps Have Privacy Cost. ]

Android permission requests are meant to give Android users pause, prompting them to ask: "Is the app that wants full Internet access legitimate, or really malware?" But if attackers can trick a user via a social-engineering attack into downloading a "Skype" app that they think is real, then it's likely that they'll grant the malicious app whatever permissions it requests. In addition, the number of different permissions requested is no giveaway, given the "excessive permissions" requested by many legitimate Android apps.

Once the disguised SMSFakeSky receives those permissions, it executes. "When it runs, the Trojan displays a fake progress bar, so as to appear as though it is downloading an app to your mobile device," according to Microsoft. "It then displays a URL to a supposed statement of agreement, but you cannot access this link. When you click the 'Agree' button, the Trojan will send multiple SMS messages to premium numbers at your expense."

The malware's use of prompts helps hide what it's really doing. "The deception behind the UI [user interface] controls is difficult for users to detect. It is likely that the malicious activity would cause mobile charges before the victim notices it, and this creates a large incentive for cybercriminals to continue perpetrating this fraud," said a blog post from Methusela Cebrian Ferrer at the Microsoft Malware Protection Center.

SMSFakeSky is far from the first piece of malware designed to make Russian phones send messages to premium-rate SMS numbers, thus draining funds from the accounts tied to infected smartphones, and delivering the money to attackers. The prevalence of such malware reflects a lack of legislation holding telecommunications providers accountable for attacks that make use of premium numbers. Indeed, Russia and many other Eastern European countries allow anyone to anonymously rent a premium-rate number, and the labyrinthian relationship between telecommunications companies and resellers who can lease such numbers makes tracing even providers of such numbers difficult.

Beyond setting up fake storefronts such as myadroidmaklet.net, another up-and-coming Android scam, according to Microsoft, is the use of paid archives that contain malware. "These are less aggressive by nature as they don't infect the system. Instead, they use a more cunning way to trick users into giving them money without using scare tactics--by getting them to pay for software that's otherwise free, or for pirated copies of paid software," according to Microsoft researchers Sergey Chernyshev and Daniel Chipiristeanu. They plan to detail their research into paid archives, including the use of automated fake-archive generation tools, as well as a breakdown of "how the money is earned and distributed by the bad guys," in September 2012 at the VB2012 conference in Dallas.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant