How mobile apps are attacked by Malware and create a problem for phone users?

If you remember about the recent Judy malware, which was reportedly found in 41 apps in the Google Play store you obviously then have the question as how mobile apps are attacked by such malwares. The latest malware seems to have made money for its creators by repeatedly auto-clicking on advertisements. Other mechanisms for mobile malware monetisation include covert sending of premium rate SMS messages, financial fraud and credential theft. With millions of apps for your mobile this is a growing problem. Here find below all about such malware and how they enter into your mobile.

What is Malware and what does it do

Malware is a computer program designed to have undesirable or harmful effects. This malicious software attacks your apps be it on popular mobile platforms such as iOS and Android and then creates a security threat to you, your data and businesses. Some perpetrators use it to infect apps and get inside your smartphone because of money. It’s difficult to get a firm idea of the size of the malware problem when it comes to apps.

In a study conducted as part of a project called ANDRUBIS, published in 2014, examined one million Android applications. These were gathered directly from the Google Play app marketplace, as well as from unofficial marketplaces and services offering pirated apps. This study found that 1.6% of apps sampled from Google Play to be malicious in nature at the time, though other studies have shown different ratios. Therefore there is a lack of comprehensive data available concerning malware on the Apple or Google App Store.

How mobile apps are attacked by Malware?

Just like mobile apps are developed so are the Malware apps. That means there are developers or programmers of Malware that intentionally release such apps. Getting into a market place is easy for them  as a developer who is willing to produce an application, market it, gain a following and then activate the hostile routines within the application.

Malware in apps

Four ways how these Malware apps are inserted into your mobile apps

It is far more common for malware to be inserted into already existing applications. There are a number of different mechanisms through which such crooks achieve this goal:

Application republishing

Apps are automatically downloaded, infected with malware, then republished to app stores, both official and unofficial. Attackers making use of this strategy may publish under the original app name or one that is slightly different. An example of republishing malware was seen recently with the MilkyDoor malware, which allows attackers to bypass firewalls.

Malvertising

Advertisers provide packages of code to allow developers to incorporate ads into their apps. There have been instances in which attackers have managed to purchase advertisements that perform malicious actions through an otherwise benign app. An example of this was the Svpeng malware, which was installed via Google AdSense ads targeting Google Chrome for Android users in Russia. The users did not have to click the ad – simply opening a page and displaying the ad was enough.

Application acquisition

Some developers may wish to sell their apps outright. There is potential for the new owners to release malicious updates that will be automatically installed. While there are no documented cases of this occurring on mobile platforms, developers of browser extensions have spoken out about this issue. In some cases, it is possible to purchase applications with hundreds of thousands of users for a few hundred dollars.

Infected development tools

In one case, it was reported that infected app development tools were being distributed to app authors. A version of XCode, the primary tool used by iOS developers, would insert malicious functionality into applications that it built and prepared for distribution. Apple told Reuters at the time it was working with the developers to ensure “they’re using the proper version of Xcode to rebuild their apps”.

How malware defeats app safeguards

The maintainers of official app marketplaces like Apple and Google have an interest in keeping malware off their platforms.

There are a number of schemes aimed at addressing this: Apple has its app review process, and Google has recently launched its Play Protect feature. Among other programs, these efforts make use of a mix of automated and manual examination of apps in an effort to determine whether they are safe or not.

Malware authors attempt to defeat these processes by concealing the true functionality of their code. There are many ways in which this is accomplished: an attacker may have the application download the hostile portion of the code at a later date after installation, rely on time delays or instruct apps to wait for an external signal before launching their malicious payload.

In fact, similar approaches were reportedly used by Uber developers to show a different version of their app to Apple’s engineers, based on their location.

How you can protect your mobile apps from such malwares?

Though there is no permanent way to protect your mobile or apps from such malware.

But only way is to be a bit cautious. You need to ensure that you only install applications from reputable developers.

The app market places continue to improve detection mechanisms and operating system developers continue to improve security to defeat the malwares but on the other end malware authors keep on improving their strategies and devising new ways to compromise device. Install anti malware software on your phones so that atleast you are at shield to protect yourself from such nuisance.

Find out which malware software is best for you in the next post.