NurPhoto | Getty Images

Researchers have identified a massive adware campaign that invaded the official Google Play market with more than 200 highly aggressive apps that were collectively downloaded almost 150 million times.

The 210 apps discovered by researchers from security firm Checkpoint Software bombarded users with ads, even when an app wasn’t open, according to a blog post published by the company on Wednesday. The apps also had the ability to carry out spearphishing attacks by causing a browser to open an attacker-chosen URL and open the apps for Google Play and third-party market 9Apps with a specific keyword search or a specific application’s page. The apps reported to a command-and-control server to receive instructions on which commands to carry out.

Once installed, the apps installed code that allowed them to perform actions as soon as the device finished booting or while the user was using the device. The apps also could remove their icon from the device launcher to make it harder for users to uninstall the nuisance apps. The apps all used a software development kit called RXDrioder, which Checkpoint researchers believe concealed its abusive capabilities from app developers. The researchers dubbed the campaign SimBad, because many of the participating apps are simulator games.

“With the capabilities of showing out-of-scope ads, exposing the user to other applications, and opening a URL in a browser, SimBad acts now as an Adware, but already has the infrastructure to evolve into a much larger threat,” Checkpoint researchers wrote.

The top 14 apps were collectively downloaded a whopping 75 million times, with the No. 1 app receiving 10 million installs and the next 13 getting 5 million downloads each. The next 53 each received 1 million downloads. They are:

Package Name App Name # Installs
com.heavy.excavator.simulator.driveandtransport Snow Heavy Excavator Simulator 10,000,000
com.hoverboard.racing.speed.simulator Hoverboard Racing 5,000,000
com.zg.real.tractor.farming.simulator.game Real Tractor Farming Simulator 5,000,000
com.ambulancerescue.driving.simulator Ambulance Rescue Driving 5,000,000
com.heavymountain.bus2018simulator Heavy Mountain Bus Simulator 2018 5,000,000
com.firetruckemergency.driver Fire Truck Emergency Driver 5,000,000
com.farming.tractor.realharvest.simulator Farming Tractor Real Harvest Simulator 5,000,000
com.carparking.challenge.parksimulator Car Parking Challenge 5,000,000
com.speedboat.jetski.racing.simulator Speed Boat Jet Ski Racing 5,000,000
com.watersurfing.carstunt.racing.simulator Water Surfing Car Stunt 5,000,000
com.offroad.woodtransport.truckdriver Offroad Wood Transport Truck Driver 2018 5,000,000
com.volumen.booster.equalizer Volumen booster & Equalizer 5,000,000
com.ks.prado.Car.parking.race.drive.apps Prado Parking Adventure 5,000,000
com.zg.offroad.Oil.tanker.transporter.truck.cargo.simulator Oil Tanker Transport Truck Driver 5,000,000
com.monstertruck.demolition Monster Truck Demolition 1,000,000
com.hummerlimotaxi.simulator.driving Hummer taxi limo simulator 1,000,000
com.excavator.wreckingball.demolition.simulator Excavator Wrecking Ball Demolition Simulator 1,000,000
com.offroad.gold.transport.truck Offroad Gold Transport Truck Driver 2018 1,000,000
com.sea.animals.trucktransport.simulator Sea Animals Truck Transport Simulator 1,000,000
com.water.surfingrace.motorbike.stunt Water Surfing Motorbike Stunt 1,000,000
com.policechase.thiefpersecution Police Chase 1,000,000
com.police.plane.transporter.game Police Plane Transporter 1,000,000
com.ambulance.driver.extreme.rescue.simulator Ambulance Driver Extreme Rescue 1,000,000
com.hovercraftracer.speedracing.boat Hovercraft Racer 1,000,000
com.cars.transport.truckdriver.simulator Cars Transport Truck Driver 2018 1,000,000
com.motorbike.pizza.delivery.drivesimulator Motorbike Pizza Delivery 1,000,000
com.heavy.excavator.stonecutter.simulator Heavy Excavator – Stone Cutter Simulator 1,000,000
com.bottle.shoot.archery.game Bottle shoot archery 1,000,000
com.offroadbuggy.car.racingsimulator Offroad buggy car racing 1,000,000
com.garbagetruck.city.trash.cleaningsimulator Garbage Truck – City trash cleaning simulator 1,000,000
com.tanks.attack.simulator.war.attack Tanks Attack 1,000,000
com.dinosaurpark.trainrescue Dinosaur Park – Train Rescue 1,000,000
com.pirateshipboat.racing3d.simulator Pirate Ship Boat Racing 3D 1,000,000
com.flyingtaxi.simulator.race Flying taxi simulator 1,000,000
com.jetpackinwater.racersimualtor.danger Jetpack Water 1,000,000
com.boostervolumen.amplifiersoundandvolumen Volumen Booster 1,000,000
com.farmgames.animal.farming.simulator Animal Farming Simulator 1,000,000
com.monstertruck.racing.competition.simulator Monster Truck 1,000,000
com.simulator.offroadjeep.car.racing Offroad jeep car racing 1,000,000
com.simulator.flyingcar.stunt.extremetracks.racing Flying Car Stunts On Extreme Tracks 1,000,000
com.simulator.tractorfarming.driving Tractor Farming 2018 1,000,000
com.impossible.farming.transport.simulator Impossible Farming Transport Simulator 1,000,000
com.volumenbooster.equalizerboost Volumen Booster 1,000,000
com.mustang.rally.championship.racingsimulator Mustang Rally Championship 1,000,000
com.deleted.photo.recovery Deleted Photo Recovery 1,000,000
com.race.boat.speedy Speed Boat Racing 1,000,000
com.cycle.bike.racing.game Super Cycle Jungle Rider 1,000,000
com.write.name.live.wallpaper.hd My name on Live Wallpaper 1,000,000
com.maginal.unicorn.game Magical Unicorn Dash 1,000,000
com.grafton.cycle.jungle.rider.race Super Cycle Jungle Rider 1,000,000
com.lovecallingapps.lovecaller.Screen Love Caller Screen 1,000,000
com.city.car.funny.racing.stunt.game.pro Racing Car Stunts On Impossible Tracks 1,000,000
com.citycar.funny.racinggame.stunt.simulator Racing Car Stunts On Impossible Tracks 2 1,000,000
com.urban.Limo.taxi.simulation.games Urban Limo Taxi Simulator 1,000,000
com.cg.heavy.tractor.simulator.game Tractor Farming Simulator 1,000,000
com.campervan.drivingsimulator.caravan Camper Van Driving 1,000,000
com.bootleshoot.sniper Bottle Shoot Sniper 3D 1,000,000
com.globalcoporation.fullscreenincomingcaller.app Full Screen Incoming Call 1,000,000
com.mustache.beard.editor Beard mustache hairstyle changer Editor 1,000,000
com.volumenbooster.increaservolumen Volumen Booster 1,000,000
com.photoeditor.girlfriend.addgirlstophoto.pic girlfriend photo editor 1,000,000
com.tracker.location.number.free.spy Mobile Number Tracker & Locator 1,000,000
com.garden.editor.app Garden Photo Editor 1,000,000
com.fortunewheel.game Fortune Wheel 1,000,000
com.farming.transport.tractor.simulator Farming Transport Simulator 2018 1,000,000
com.offroad.tractor.transport.drivingsimulator OffRoad Tractor Transport 1,000,000
com.customwallpaper.mynameonlivewallpaper my name on live wallpaper 1,000,000

The remainder received 500,000 or fewer downloads each. Checkpoint has a full list of all the apps here.

Web searches found that many apps with similar or identical names were still available in Google Play at the time this story was being reported. This will make it harder for users to determine if an installed app is benign or abusive. One possibly useful method for determining abuse is to use the package name to search a phone for abusive apps. While Google has removed all the reported apps from Play, it wasn’t immediately clear if those apps will automatically be uninstalled from infected devices or if users must do so manually. Company representatives didn’t immediately respond to emails seeking comment for this post.

Malicious and abusive apps in Google Play have been an ongoing problem for years. The company is quick to remove bad apps once they’re reported, but often, by that point, hundreds of millions of users have already been infected. While there’s no sure-fire way to know if a Google Play app is safe, reading user reviews, scrutinizing requested permissions, and avoiding apps from unknown developers or with fewer than 10,000 downloads can often help. When in doubt, or in cases where apps have minimal benefit, it’s best to steer clear.

Let’s block ads! (Why?)


Source link

Load More By admin
Load More In App & Software

Leave a Reply

Your email address will not be published. Required fields are marked *

Check Also

Reaction: How Will Google's Stadia Affect PlayStation? – Push Square

Google announced its ambitious game streaming platform Stadia this week, and it’s a …