Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

09:49 PM

Jury Still Out On Mobile Adware

Malicious software or not? Defining the threat on mobile platforms becomes more difficult as some advertising software enters a gray area

On Friday, security firm Symantec warned that a baker's dozen of applications available through the Android Marketplace hosted a "bot-like threat" that could leak information.

With an estimated 1 million to 5 million installations, the threat -- dubbed Counterclank by Symantec -- would have been one of the largest outbreaks of mobile malware to date. Yet other security firms disagreed over the details: The affected programs incorporated third-party software that was not malicious but comprised "an aggressive form of ad network," concluded mobile security firm Lookout.

The incident highlights that uncertain gray areas continue to inhabit the space between what is definitely a legitimate mobile application and what is purely malicious.

"I think we are in a place where people are being very experimental, and people are coming up with new ideas for a new platform," says Tim Wyatt, a principal engineer at Lookout. "We will definitely see ideas that push the boundaries of what is acceptable and what is not."

The debate follows a similar trajectory as the concerns over spyware, adware, and unwanted programs that plagued PC users at the beginning of last decade. In the early 2000s, the infamous affiliate adware maker 180Solutions, later known as Zango, paid partners to install its software on systems, which they often did without the users' permission.

In a similar way, some mobile advertising platforms perform functions that users would likely not want, if they had a choice. Counterclank, which is actually the Apperhand software development kit, collects the international mobile equipment identifier (IMEI) and uses the push notification mechanism to send personalized ads to the user's device. Software using the development kit also leaves a search icon on a mobile device's desktop and can modify bookmarks.

The last capability is unacceptable behavior but not malicious, Lookout states in its analysis.

Other companies agree. Counterclank may not be malware, but its definitely unwanted, says Roel Schouwenberg, senior researcher with security firm Kaspersky. The company classifies the program, not as malicious, but as something that users would not want on their mobile device. Whether that determination stays constant is an open question, he says.

"It is definitely grayware," Schouwenberg says. "We haven't quite hashed out yet whether [programs using it] are malicious or not. We are currently detecting it, but I would not be surprised if somewhere down the line, we decide not to detect it or detect it in a different way."

On the Android platform, many security firms focus on the types and number of permissions requested by programs as an initial indicator that something may be amiss. However, permissions by themselves are not sufficient, says Schouwenberg.

"We see quite a lot of apps out there that ask for a ton of permissions," he says. "Developers are copy-pasting the permissions list off of a template, and going with it, when in reality, they will never use some of those permissions."

Yet, permissions that seem excessive -- such as GPS tracking, connecting to an Internet server and the ability to read data from the phone -- are actually necessary, argues some developers. Full-function advertising platforms need to assign a user a unique ID and offer other benefits to their clients, argues mobile advertising software maker Mobclix.

"GPS activation, Internet connectivity and read phone state, when accessed, are not signs you’ve accidentally put malware into your application," the company writes in a blog post. "They’re usually legitimately accessed – along with other data and functions we rarely think about."

As mobile application development -- and the business models that drive it -- matures, the gray area will shrink, says Schouwenberg. In addition, customer concerns will likely drive developers to focus on reducing the expansive permission sets that are currently the norm.

"Quick growth and security generally don't go hand in hand," he says. "When the rapid growth starts winding down a bit, that's when Google [and developers] will look and see what they can improve on."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Virginia a Hot Spot For Cybersecurity Jobs
Jai Vijayan, Contributing Writer,  10/9/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-15
An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter.
PUBLISHED: 2019-10-15
qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...
PUBLISHED: 2019-10-15
In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.
PUBLISHED: 2019-10-15
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.
PUBLISHED: 2019-10-15
In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.