New Attack Uses Attackers' Own Ad Network To Deliver Android Malware

Trailrunner7 writes "The concept of malware riding shotgun with legitimate mobile apps is not a new one. There have been a slew of cases in which attackers have compromised apps in the Google Play store and inserted malware into the file. But a new attack uncovered by Palo Alto Networks is using a new technique that starts with the user installing an app on her Android phone. The app could be a legitimate one or a malicious one, but it will include some code that, once the app is installed, will reach out to an ad network. Many apps include such code for legitimate ad revenue purposes, but these apps are connecting to a malicious ad network. Once the connection is made, the app will then wait until the user is trying to install another app and will pop up an extra dialog box asking for permission to install some extra code. That code is where the bad things lie. The malicious code immediately gains control of the phone's SMS app for both command and control and in order to sign the victim up for some premium-rate SMS services. The attack is interesting, said Wade Williamson, a senior security analyst at Palo Alto, because the attackers can use a legitimate ad network that's already connected to a group of apps and then at any given time flip the switch and begin using it for malicious purposes."

Comments

Then it is malicious...

[RobertM1968]

The app could be a legitimate one or a malicious one, but it will include some code that, once the app is installed, will reach out to an ad network. Many apps include such code for legitimate ad revenue purposes, but these apps are connecting to a malicious ad network.

Inotherwords "but it has malware in it for the ad portion that goes to a malicious ad network" - or the app IS malicious and not legitimate. An app isn't magically legitimate if only some portions of it are malware.

cross-site attacks

[girlintraining]

Advertising on the internet is the most common route for malware by far. That's why I install ad blocking software everywhere. Marketers whine and complain about lost revenue and try to guilt you by saying they need that revenue to run the sites "for free"... but the truth is the way most advertising networks operate allow for "dancing, singing" ads -- that is, injectable javascript. Everything in the marketer's world these days is about using java to track, probe, manipulate, etc., web pages, with pop-overs, pop-unders, drive-bys, side to side scrollers, sound, motion, and anything else to get your attention.

None of this would be a problem if they stuck to fixed-size IMG tags and graphics. In other words... marketing is a virus. It's the plague. It's not the browser's fault... it's these asshole profiteers who try to be endlessly creative in force-feeding people crap they don't want.