Malware-infected apps sneak into Google Play, leave Android devices wide open for attacks
The legend of vikings who siege settlements to loot their goods and set them ablaze is alive and well in the latest Android malware scenario. Apparently, not only do they still exist, but they also strike dangerously close to home. In April, researchers from ‘Checkpoint’ investigated a malware campaign in which a horde of malicious apps somehow breached the Google Play store’s gates and attacked unsuspecting Android phones. Some of them even climbed to the top ranks with their large volume of downloads, before users started sensing there’s something wrong with them and lowered their rankings.
The apps ‘Viking Jump’, ‘WiFi Plus’, ‘Parrot Copter’, ‘Memory Booster’, and ‘Simple 2048′ contain malicious components that begin their activity post their initial launch. Two binaries named like Android system files are installed on the storage, with one used for exchanging information between the malware’s parts, and the other keeping a list of all its components. The virus checks for root permissions, and if your device is rooted, two additional components are installed for the attackers’ purposes. Regardless of whether you have root access or not, the malware will connect to its command and control server, sending the device’s battery charge, type of data connection, and phone number.
Finally, the server opens a proxy connection capable of sending and receiving information between server and device according to the hacker’s whim. In this campaign’s case, devices are hijacked to simulate clicks on online advertisements and generate profit. Some of the applications also send premium SMS messages, and the proxy allows for DDoS attacks, spamming, and remote code execution. Your device pretty much becomes the hacker’s puppet.
Checkpoint Security traced 44% of the infections to Russia, which is explained by the prevalence of Android 4.4 in the country. Later operating system versions (Lollipop and Marshmallow) have stricter permissions control, thus the malware which relies on very suspicious permission sets is less likely to get past observant users. Alas, the researchers haven’t made recommendation about anything you could do in the event of infection. Hopefully, a decent antivirus app will be able to bring things back in order.
