More than 400 malicious apps infiltrate Google Play

[Batu69]

“DressCode” apps turned phones into listening posts that could bypass firewalls.

 

Google Play was recently found to be hosting more than 400 apps that turned infected phones into listening posts that could siphon sensitive data out of the protected networks they connected to, security researchers said Thursday.

 

One malicious app infected with the so-called DressCode malware had been downloaded from 100,000 to 500,000 times before it was removed from the Google-hosted marketplace, Trend Micro researchers said in a post. Known as Mod GTA 5 for Minecraft PE, it was disguised as a benign game, but included in the code was a component that established a persistent connection with an attacker controlled server. The server then had the ability to bypass so-called network address translation protections that shield individual devices inside a network. Trend Micro has found 3,000 such apps in all, 400 of which were available through Play.

 

 

"This malware allows threat actors to infiltrate a user's network environment," Thursday's report stated. "If an infected device connects to an enterprise network, the attacker can either bypass the NAT device to attack the internal server or download sensitive data using the infected device as a springboard."

The report continued:

Quote

The malware installs a SOCKS proxy on the device, building a general purpose tunnel that can control and give commands to the device. It can be used to turn devices into bots and build a botnet, which is essentially a network of slave devices that can be used for a variety of schemes like distributed denial-of-service (DDoS) attacks—which have become an increasingly severe problem for organizations worldwide—or spam email campaigns. The botnet can use the proxied IP addresses also generated by the malware to create fake traffic, disguise ad clicks, and generate revenue for the attackers.

 

A Google spokesman said in an e-mail: "We're aware of the issue and we're taking the necessary actions."

Trend Micro's report comes three weeks after researchers from separate security firm Checkpoint said they detected 40 DressCode-infected apps in Google Play.

 

Trend said that only a small portion of each malicious app contained the malicious functions, a feature that makes detection difficult. In 2012, Google introduced a cloud-based security scanner called Bouncer that scours Play for malicious apps. Since then, thousands of malicious apps have been detected by researchers. This raises a question: if outside parties can find them, why can't Google find them first?

 

Article source

[vissha]

DressCode Malware Found in 3,000 Android Apps, 400 on Google Play Store

 

 

Number of apps infected with DressCode malware grows

 

Quote

An Android malware family discovered this year has slowly spread and has become a big problem, currently found in over 3,000 Android application, 400 of which could be downloaded from the official Google Play Store, at one point or another.

 

Security researchers saw first versions of this malware in April, but the trojan came to the media's attention in late August, when Check Point found over 400 apps infected with this malware, 40 of which they found on the Google Play Store.

 

According to a more recent report from Trend Micro, the number of DressCode-infected apps has skyrocketed, and because of the malware's features, DressCode has become a danger for corporate networks.

 

DressCode's primary feature is a proxy

 

The malware has a unique feature, which you regularly see in desktop trojans, but which is much rarer in mobile threats.

 

After users download a DressCode-infected app from unofficial third-party app stores or the Google Play Store, the malware will set up a SOCKS proxy on the device.

 

This proxy acts like a pivot point for the malware's creators, allowing them to connect to the device, and access the network on which the device is connected to.

 

If the smartphone owner is at work, using his company's Wi-Fi, then the attacker has access to that network as well, allowing him to scan the internal network for weak points and attack servers and devices which would normally be protected by a firewall.

 

Since all traffic is funneled via the SOCKS proxy, firewalls will brand it as normal web browsing.

 

Mobile malware numbers grew 40%

 

"While DressCode’s infection methods and behavior isn’t unique, the number of Trojanized apps that found their way to a legitimate app store is certainly significant," said Echo Duan, Mobile Threat Response Engineer for Trend Micro.

 

In the past, there have been multiple instances where malware has made its way into the Google Play Store. Nevertheless, with a 40 percent increase in mobile malware compared to the same period of last year, these type of events are about to get more common.

 

As for DressCode, security researchers say they've seen it used to commit ad click fraud, but the malware could also be used for DDoS attacks if its creators ever wished to do so.

 

 

Source

[Batu69]

Topic moved from Mobile News Forum & merged.