Attacks/Breaches
7/19/2012
08:46 AM
Connect Directly
RSS
E-Mail
50%
50%

Android Attackers Launch Fake App Market

Malicious apps include a fake version of Skype that surreptitiously sends text messages to premium-rate numbers, racking up charges to the user and revenue for the cybercriminals.

Having a difficult time distributing your malicious smartphone apps? Then why not just create an entire fake app store to peddle your wares?

In fact, that appears to be the strategy employed by the creator of "myadroidmaklet.net," a third-party app market that purports to offer more than 50 apps for free download, including Adobe Flash Player, Angry Birds Rio, Google Maps, Mozilla Firefox, Need for Speed Hot Pursuit, Opera, Skype, and World of Goo. But in fact, all of these apps are really a Trojan app--malware--in disguise.

Microsoft has dubbed the underlying Trojan Android app as SMSFakeSky, and noted that it's designed to target Russian-speaking users. "It poses as a legitimate application, so when you try to install the Trojan, it may ask you for permissions to run," according to Microsoft's malware analysis. Notably, the app will request permission to read a user's sent and received SMS and MMS messages, to see the user's location, have full Internet access capabilities, modify and delete the contents of removable storage, and to gather all information related to phone calls. The app also typically requests permission to download further required software, such as Adobe Flash Player, although even this installation will be just another version of the Trojan app in disguise.

[ Even legit mobile apps can carry risks. See Free Android Apps Have Privacy Cost. ]

Android permission requests are meant to give Android users pause, prompting them to ask: "Is the app that wants full Internet access legitimate, or really malware?" But if attackers can trick a user via a social-engineering attack into downloading a "Skype" app that they think is real, then it's likely that they'll grant the malicious app whatever permissions it requests. In addition, the number of different permissions requested is no giveaway, given the "excessive permissions" requested by many legitimate Android apps.

Once the disguised SMSFakeSky receives those permissions, it executes. "When it runs, the Trojan displays a fake progress bar, so as to appear as though it is downloading an app to your mobile device," according to Microsoft. "It then displays a URL to a supposed statement of agreement, but you cannot access this link. When you click the 'Agree' button, the Trojan will send multiple SMS messages to premium numbers at your expense."

The malware's use of prompts helps hide what it's really doing. "The deception behind the UI [user interface] controls is difficult for users to detect. It is likely that the malicious activity would cause mobile charges before the victim notices it, and this creates a large incentive for cybercriminals to continue perpetrating this fraud," said a blog post from Methusela Cebrian Ferrer at the Microsoft Malware Protection Center.

SMSFakeSky is far from the first piece of malware designed to make Russian phones send messages to premium-rate SMS numbers, thus draining funds from the accounts tied to infected smartphones, and delivering the money to attackers. The prevalence of such malware reflects a lack of legislation holding telecommunications providers accountable for attacks that make use of premium numbers. Indeed, Russia and many other Eastern European countries allow anyone to anonymously rent a premium-rate number, and the labyrinthian relationship between telecommunications companies and resellers who can lease such numbers makes tracing even providers of such numbers difficult.

Beyond setting up fake storefronts such as myadroidmaklet.net, another up-and-coming Android scam, according to Microsoft, is the use of paid archives that contain malware. "These are less aggressive by nature as they don't infect the system. Instead, they use a more cunning way to trick users into giving them money without using scare tactics--by getting them to pay for software that's otherwise free, or for pirated copies of paid software," according to Microsoft researchers Sergey Chernyshev and Daniel Chipiristeanu. They plan to detail their research into paid archives, including the use of automated fake-archive generation tools, as well as a breakdown of "how the money is earned and distributed by the bad guys," in September 2012 at the VB2012 conference in Dallas.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.