If you remember about the recent Judy malware, which was reportedly found in 41 apps in the Google Play store you obviously then have the question as to how mobile apps are attacked by such malware. The latest malware seems to have made money for its creators by repeatedly auto-clicking on advertisements. Other mechanisms for mobile malware monetisation include covert sending of premium rate SMS messages, financial fraud and credential theft. With millions of apps for your mobile, this is a growing problem. Here find below all about such malware and how they enter into your mobile.
What is Malware and what does it do
Malware is a computer program designed to have undesirable or harmful effects. This malicious software attacks your apps be it on popular mobile platforms such as iOS and Android and then creates a security threat to you, your data and your businesses. Some perpetrators use it to infect apps and get inside your smartphone because of money. It’s difficult to get a firm idea of the size of the malware problem when it comes to apps.
A study conducted as part of a project called ANDRUBIS, published in 2014, examined one million Android applications. These were gathered directly from the Google Play app marketplace, as well as from unofficial marketplaces and services offering pirated apps. This study found that 1.6% of apps sampled from Google Play were malicious in nature at the time, though other studies have shown different ratios. Therefore there is a lack of comprehensive data available concerning malware on the Apple or Google App Store.
How Mobile Apps Attacked by Malware?
Just like mobile apps are developed so are Malware apps. That means there are developers or programmers of Malware that intentionally release such apps. Getting into a marketplace is easy for them as a developer who is willing to produce an application, market it, gain a following and then activate the hostile routines within the application.
Four Ways how these Malware Apps are Inserted into your Mobile Apps
It is far more common for malware to be inserted into already existing applications. There are a number of different mechanisms through which such crooks achieve this goal:
1. Application Republishing
Apps are automatically downloaded, infected with malware, and then republished to app stores, both official and unofficial. Attackers making use of this strategy may publish under the original app name or one that is slightly different. An example of republishing malware was seen recently with the MilkyDoor malware, which allows attackers to bypass firewalls.
Advertisers provide packages of code to allow developers to incorporate ads into their apps. There have been instances in which attackers have managed to purchase advertisements that perform malicious actions through an otherwise benign app. An example of this was the Svpeng malware, which was installed via Google AdSense ads targeting Google Chrome for Android users in Russia. The users did not have to click the ad – simply opening a page and displaying the ad was enough.
3. Application Acquisition
Some developers may wish to sell their apps outright. There is potential for the new owners to release malicious updates that will be automatically installed. While there are no documented cases of this occurring on mobile platforms, developers of browser extensions have spoken out about this issue. In some cases, it is possible to purchase applications with hundreds of thousands of users for a few hundred dollars.
4. Infected Development Tools
In one case, it was reported that infected app development tools were being distributed to app authors. A version of XCode, the primary tool used by iOS developers, would insert malicious functionality into applications that it built and prepared for distribution. Apple told Reuters at the time it was working with the developers to ensure “they’re using the proper version of Xcode to rebuild their apps”.
How Malware Defeats App Safeguards
The maintainers of official app marketplaces like Apple and Google have an interest in keeping malware off their platforms.
There are a number of schemes aimed at addressing this: Apple has its app review process, and Google has recently launched its Play Protect feature. Among other programs, these efforts make use of a mix of automated and manual examination of apps in an effort to determine whether they are safe or not.
Malware authors attempt to defeat these processes by concealing the true functionality of their code. There are many ways in which this is accomplished: an attacker may have the application download the hostile portion of the code at a later date after installation, rely on time delays or instruct apps to wait for an external signal before launching their malicious payload.
In fact, similar approaches were reportedly used by Uber developers to show a different version of their app to Apple’s engineers, based on their location.
How you can Protect your Mobile Apps from Such Malware?
Though there is no permanent way to protect your mobile or apps from such malware.
But the only way is to be a bit cautious. You need to ensure that you only install applications from reputable developers.
The app market places continue to improve detection mechanisms and operating system developers continue to improve security to defeat the malware but on the other end malware authors keep on improving their strategies and devising new ways to compromise the device. Install anti-malware software on your phones so that at least you are a shield to protect yourself from such nuisance.
Find out which malware software is best for you in the next post.