Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

09:49 PM

Jury Still Out On Mobile Adware

Malicious software or not? Defining the threat on mobile platforms becomes more difficult as some advertising software enters a gray area

On Friday, security firm Symantec warned that a baker's dozen of applications available through the Android Marketplace hosted a "bot-like threat" that could leak information.

With an estimated 1 million to 5 million installations, the threat -- dubbed Counterclank by Symantec -- would have been one of the largest outbreaks of mobile malware to date. Yet other security firms disagreed over the details: The affected programs incorporated third-party software that was not malicious but comprised "an aggressive form of ad network," concluded mobile security firm Lookout.

The incident highlights that uncertain gray areas continue to inhabit the space between what is definitely a legitimate mobile application and what is purely malicious.

"I think we are in a place where people are being very experimental, and people are coming up with new ideas for a new platform," says Tim Wyatt, a principal engineer at Lookout. "We will definitely see ideas that push the boundaries of what is acceptable and what is not."

The debate follows a similar trajectory as the concerns over spyware, adware, and unwanted programs that plagued PC users at the beginning of last decade. In the early 2000s, the infamous affiliate adware maker 180Solutions, later known as Zango, paid partners to install its software on systems, which they often did without the users' permission.

In a similar way, some mobile advertising platforms perform functions that users would likely not want, if they had a choice. Counterclank, which is actually the Apperhand software development kit, collects the international mobile equipment identifier (IMEI) and uses the push notification mechanism to send personalized ads to the user's device. Software using the development kit also leaves a search icon on a mobile device's desktop and can modify bookmarks.

The last capability is unacceptable behavior but not malicious, Lookout states in its analysis.

Other companies agree. Counterclank may not be malware, but its definitely unwanted, says Roel Schouwenberg, senior researcher with security firm Kaspersky. The company classifies the program, not as malicious, but as something that users would not want on their mobile device. Whether that determination stays constant is an open question, he says.

"It is definitely grayware," Schouwenberg says. "We haven't quite hashed out yet whether [programs using it] are malicious or not. We are currently detecting it, but I would not be surprised if somewhere down the line, we decide not to detect it or detect it in a different way."

On the Android platform, many security firms focus on the types and number of permissions requested by programs as an initial indicator that something may be amiss. However, permissions by themselves are not sufficient, says Schouwenberg.

"We see quite a lot of apps out there that ask for a ton of permissions," he says. "Developers are copy-pasting the permissions list off of a template, and going with it, when in reality, they will never use some of those permissions."

Yet, permissions that seem excessive -- such as GPS tracking, connecting to an Internet server and the ability to read data from the phone -- are actually necessary, argues some developers. Full-function advertising platforms need to assign a user a unique ID and offer other benefits to their clients, argues mobile advertising software maker Mobclix.

"GPS activation, Internet connectivity and read phone state, when accessed, are not signs you’ve accidentally put malware into your application," the company writes in a blog post. "They’re usually legitimately accessed – along with other data and functions we rarely think about."

As mobile application development -- and the business models that drive it -- matures, the gray area will shrink, says Schouwenberg. In addition, customer concerns will likely drive developers to focus on reducing the expansive permission sets that are currently the norm.

"Quick growth and security generally don't go hand in hand," he says. "When the rapid growth starts winding down a bit, that's when Google [and developers] will look and see what they can improve on."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-12
INTELBRAS TELEFONE IP TIP200 version allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.
PUBLISHED: 2021-04-12
** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover pa...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.