Attacks/Breaches
7/19/2012
08:46 AM
50%
50%

Android Attackers Launch Fake App Market

Malicious apps include a fake version of Skype that surreptitiously sends text messages to premium-rate numbers, racking up charges to the user and revenue for the cybercriminals.

Having a difficult time distributing your malicious smartphone apps? Then why not just create an entire fake app store to peddle your wares?

In fact, that appears to be the strategy employed by the creator of "myadroidmaklet.net," a third-party app market that purports to offer more than 50 apps for free download, including Adobe Flash Player, Angry Birds Rio, Google Maps, Mozilla Firefox, Need for Speed Hot Pursuit, Opera, Skype, and World of Goo. But in fact, all of these apps are really a Trojan app--malware--in disguise.

Microsoft has dubbed the underlying Trojan Android app as SMSFakeSky, and noted that it's designed to target Russian-speaking users. "It poses as a legitimate application, so when you try to install the Trojan, it may ask you for permissions to run," according to Microsoft's malware analysis. Notably, the app will request permission to read a user's sent and received SMS and MMS messages, to see the user's location, have full Internet access capabilities, modify and delete the contents of removable storage, and to gather all information related to phone calls. The app also typically requests permission to download further required software, such as Adobe Flash Player, although even this installation will be just another version of the Trojan app in disguise.

[ Even legit mobile apps can carry risks. See Free Android Apps Have Privacy Cost. ]

Android permission requests are meant to give Android users pause, prompting them to ask: "Is the app that wants full Internet access legitimate, or really malware?" But if attackers can trick a user via a social-engineering attack into downloading a "Skype" app that they think is real, then it's likely that they'll grant the malicious app whatever permissions it requests. In addition, the number of different permissions requested is no giveaway, given the "excessive permissions" requested by many legitimate Android apps.

Once the disguised SMSFakeSky receives those permissions, it executes. "When it runs, the Trojan displays a fake progress bar, so as to appear as though it is downloading an app to your mobile device," according to Microsoft. "It then displays a URL to a supposed statement of agreement, but you cannot access this link. When you click the 'Agree' button, the Trojan will send multiple SMS messages to premium numbers at your expense."

The malware's use of prompts helps hide what it's really doing. "The deception behind the UI [user interface] controls is difficult for users to detect. It is likely that the malicious activity would cause mobile charges before the victim notices it, and this creates a large incentive for cybercriminals to continue perpetrating this fraud," said a blog post from Methusela Cebrian Ferrer at the Microsoft Malware Protection Center.

SMSFakeSky is far from the first piece of malware designed to make Russian phones send messages to premium-rate SMS numbers, thus draining funds from the accounts tied to infected smartphones, and delivering the money to attackers. The prevalence of such malware reflects a lack of legislation holding telecommunications providers accountable for attacks that make use of premium numbers. Indeed, Russia and many other Eastern European countries allow anyone to anonymously rent a premium-rate number, and the labyrinthian relationship between telecommunications companies and resellers who can lease such numbers makes tracing even providers of such numbers difficult.

Beyond setting up fake storefronts such as myadroidmaklet.net, another up-and-coming Android scam, according to Microsoft, is the use of paid archives that contain malware. "These are less aggressive by nature as they don't infect the system. Instead, they use a more cunning way to trick users into giving them money without using scare tactics--by getting them to pay for software that's otherwise free, or for pirated copies of paid software," according to Microsoft researchers Sergey Chernyshev and Daniel Chipiristeanu. They plan to detail their research into paid archives, including the use of automated fake-archive generation tools, as well as a breakdown of "how the money is earned and distributed by the bad guys," in September 2012 at the VB2012 conference in Dallas.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.