Slashdot Mirror


Spyware Apps Found on Google Play Store (bleepingcomputer.com)

Researchers at the security firm Lookout have identified a family of malicious Android apps, referred to as SonicSpy. From a report: Experts say the malware author modified a version of the official Telegram app, injected the spyware code, rebranded it, and uploaded the modified app on the Play Store. In total, the crook uploaded the app three times on the Play Store under the names Soniac, Hulk Messenger, and Troy Chat. Only Soniac was active on Google's app store when researchers first spotted the spyware, as the other two apps were already taken down, most likely by the developer himself. At the time of writing, Lookout says they identified over 1,000 variations of this new spyware called SonicSpy, which they believe to be a new version of an older Android spyware named SpyNote.

37 comments

  1. Linux, again by Anonymous Coward · · Score: 0

    Why is it always Linux that's susceptible to these kinds of attacks? Perhaps it's time we harden our operating system before Apple and Microsoft step up attacking our operating system as not being secure. I truly believe that Linux is better than the alternatives, but unless we take actions to harden it, we'll lose out to the competitors.

    1. Re:Linux, again by K.+S.+Kyosuke · · Score: 3, Interesting

      Why is it always Linux that's susceptible to these kinds of attacks?

      That's about as meaningful as asking why is it always roads that are susceptible to speeding.

      --
      Ezekiel 23:20
    2. Re:Linux, again by Anonymous Coward · · Score: 0

      Can you please supply accurate sources for this information?

    3. Re:Linux, again by Anonymous Coward · · Score: 0

      And when I say "we" I mean you guys, because I'm sure not doing it.

    4. Re:Linux, again by Anonymous Coward · · Score: 0

      Myself. I work for the group.

    5. Re:Linux, again by Anonymous Coward · · Score: 0

      so you offer no actual proof?

      thanks for playing along at home

  2. THIS is why I use Windows Phone by Anonymous Coward · · Score: 5, Funny

    No software available at all. Feel safe. Secure. Fresh.

    1. Re:THIS is why I use Windows Phone by Techkt · · Score: 1

      No software available at all. Feel safe. Secure. Fresh.

      I use iPhone for the same reason.

      --
      -Pratyaksh Somani reach me at https://www.techkt.com Posts about Technology, cool gadgets, Android, iPhone and lots mo
  3. "Troy Chat"? by Anonymous Coward · · Score: 4, Insightful

    Come on now! Who wouldn't trust that?

    1. Re:"Troy Chat"? by TheFakeTimCook · · Score: 2

      Come on now! Who wouldn't trust that?

      Followed by "TrojanChat" and "GiftHorseChat", of course!

    2. Re:"Troy Chat"? by antdude · · Score: 1

      Trojans would trust that! ;)

      --
      Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
  4. Ya don't say by Tablizer · · Score: 2

    I'd be more surprised if a decent survey found zero malware.

    1. Re:Ya don't say by Anonymous Coward · · Score: 0

      Windows 10 found to be clean from malware... More news at 11.

    2. Re:Ya don't say by Tablizer · · Score: 1

      Technically Microsoft may have been accurate. They probably scanned for malware themselves, removing any KNOWN problems, and then announcing they "found it to be clean". Sure, it's probably misleading even if technically accurate, but that's what marketers are paid to do: spin.

  5. Isn't Andruid itself spyware? by Anonymous Coward · · Score: 0

    I've never seen such a sticky, gooey bit of spyware as Andruid.

  6. Is anyone NOT spying today? by Anonymous Coward · · Score: 0

    /ilovechimps

  7. Nice to see Google Looking Out For Users, as Usual by TheFakeTimCook · · Score: 1

    IOW, not at all.

    Bitch all you want about iOS: When I download an App from iOS App Store, I don't have to worry about this kind of shit.

    There is NO excuse for this on the Play Store either. It's not like this was some shady, back-ally "App Store" site.

    C'mon Google! I KNOW it doesn't contribute ad-dollars; but could you at least PRETEND to "vet" Apps on the Play Store?

    Oh, wait! That IS what they're doing... PRETENDING to give a shit about their Users' privacy...

  8. It's only Monday, this is a Tuesday story by BLToday · · Score: 1

    Aren't the usual android spyware/malware stories posted on Tuesday?

  9. Re:Nice to see Google Looking Out For Users, as Us by tepples · · Score: 1

    When I download an App from iOS App Store, I don't have to worry about this kind of shit.

    Instead, you have to worry about there not being any apps at all for a particular task when the App Store Review Guidelines block iOS apps from performing certain tasks.

  10. Shocking Or Not by Anonymous Coward · · Score: 0

    "I am shocked! SHOCKED!"

  11. Re:Nice to see Google Looking Out For Users, as Us by Anonymous Coward · · Score: 0

    Seems preferable to identity theft.

  12. Re:Nice to see Google Looking Out For Users, as Us by drinkypoo · · Score: 1

    wah wah wah

    Your beloved Apple dickheads are not infallible

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  13. Not very surprising, here are other spy-apps: by Anonymous Coward · · Score: 0

    Facebook Messenger, Google Allo, Skype, Snapchat, etc. etc.

  14. Problems w/o solutions are meaningless by shanen · · Score: 1

    Why is Slashdot recycling this OLD story again? All the incarnations are the same.

    Feels like wasting keystrokes, but I'll repeat my best solution proposal:

    The google should add a financial model tab to Play. When you are looking at an app and trying to assess whether or not it's legitimate, you should be able to see where the money is supposed to be coming from. That includes the google commenting on whether or not they have any evidence to support what the developer says.

    In many cases the developer will just pick one of the obvious options. For a simple example, "This is a limited version of the software that is supported to encourage sales of the premium version", and the google's comment would be something along the lines of "The premium version of the software is generating substantial income for the developer." They don't have to give full details to give us a picture of whether or not it's legit.

    However, if the financial model tab sounds like BS, or if the google's assessment says they have zero evidence of the developer's claims, then at least the suckers can earn their victimization.

    --
    Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
    1. Re:Problems w/o solutions are meaningless by Anonymous Coward · · Score: 0

      There is lots of stuff that that alleged "search" company could have done to make Play Store *useable*: Specifically, some means to filter apps by permissions, as well as something to exclude anything which uses third-party advertisements or in-app billing (or both concurrently)

      My guess is the current business model is what works for Google - that it's more profitable to ram ads and "free to play" junk down everybody's throats than to cater to a crazy minority which would rather pay up-front for something decent... I found it simpler just to discontinue any attempt to use Play Store.

  15. Re: Nice to see Google Looking Out For Users, as U by Anonymous Coward · · Score: 0

    What happens in China stays in China. Fuckboy.

  16. ubiquitous by Reverend+Green · · Score: 1

    Pretty much all apps - with the exception of a tiny handful of FOSS - are spyware. So is the OS. So are the competing OSes and their apps.

    Moral of the story: the Machine is always watching. Think much, speak little, and write nothing down.

  17. Re:Nice to see Google Looking Out For Users, as Us by TheFakeTimCook · · Score: 1

    When I download an App from iOS App Store, I don't have to worry about this kind of shit.

    Instead, you have to worry about there not being any apps at all for a particular task when the App Store Review Guidelines block iOS apps from performing certain tasks.

    That's what my laptop is for.

  18. Show me the source code by Anonymous Coward · · Score: 0

    If the source code were available, and if people insisted on only downloading programs for which the source code were available, we'd avoid this scenario. Yet inexplicably, people still don't get it. Sigh....they've brought it on themselves.

  19. Re:Nice to see Google Looking Out For Users, as Us by tepples · · Score: 1

    How fast is it to earn $999 (source) to buy a MacBook Air?* And how convenient is it to carry a MacBook Air everywhere that you would carry an iPhone?

    * Less expensive laptops made by other companies are available, but TheFakeTimCook has already expressed a preference for Apple products.

  20. Re:Nice to see Google Looking Out For Users, as Us by TheFakeTimCook · · Score: 1

    How fast is it to earn $999 (source) to buy a MacBook Air?* And how convenient is it to carry a MacBook Air everywhere that you would carry an iPhone?

    * Less expensive laptops made by other companies are available, but TheFakeTimCook has already expressed a preference for Apple products.

    I already have a suitable laptop, which I use for other things, too.

    So, I that regard, the cost of the laptop is exactly ZERO.

    Or are you REALLY so stupid to suggest that a phone and a laptop are equivalent devices?

  21. Re:Nice to see Google Looking Out For Users, as Us by tepples · · Score: 1

    I already have a suitable laptop, which I use for other things, too.

    But do you carry your MacBook with you everywhere in case you need to suddenly use an app that isn't available for your iPhone?

    Your experience differs from mine. I have a laptop. A lot of other people in another circle of friends I'm in do not. When asked why they can't do something or didn't notice something, they say "I'm on mobile". They would need to buy and start carrying a laptop in addition to the phone.

    Or are you REALLY so stupid to suggest that a phone and a laptop are equivalent devices?

    No. But if most everybody needs a laptop anyway, why does the iPad continue to exist?

  22. Re:Nice to see Google Looking Out For Users, as Us by TheFakeTimCook · · Score: 1

    I already have a suitable laptop, which I use for other things, too.

    But do you carry your MacBook with you everywhere in case you need to suddenly use an app that isn't available for your iPhone?

    No, but if I am doing something where I suspect I might need such apps, I try to remember to bring it. Plus, it's not like there are no network troubleshooting tools on iOS. I use "Fing" if I want to find IP addresses on a LAN, etc. And there are others...

    Having said that, of all the App/API restrictions on iOS, the ONE that I would like to see addressed is the ability to enumerate and provide statistics on nearby WiFi networks.

    But that isn't that big of a deal, and as I said, that's what I have a laptop for. Perhaps if that was a huge part of my life, I would carry a smaller device for those (now rare) occasions.

    Afterall, all I have to do on my iPhone to get a listing of "discoverable" WiFi networks and at least a rudimentary idea of their signal strengths and Security Settings is to open the "Settings" App and choose "Other" under the "WiFi Settings". For example, sitting at my desk, my iPhone can "see" 10 "secure" WiFi Networks and 2 "Open" ones. I can't tell if they are 2.4 or 5 GHz (unless the name suggests same), but at least I know what is around me, and whether it is "Public" or not.

    So, in the end, since my job is not Network Analysis, my personal needs are actually served on the one thing I would actually like to see in a more "complete" fashion.

    Your experience differs from mine. I have a laptop. A lot of other people in another circle of friends I'm in do not. When asked why they can't do something or didn't notice something, they say "I'm on mobile". They would need to buy and start carrying a laptop in addition to the phone.

    Yup.

    And quite frankly, the very real limitation of screen size on a phone makes some Applications simply impractical. That is NOT something that is likely to be fixed, until humans do some serious upgrading of our OWN capabilities, like grow eagle-vision.

    Or are you REALLY so stupid to suggest that a phone and a laptop are equivalent devices?

    No. But if most everybody needs a laptop anyway, why does the iPad continue to exist?

    Most people are beginning to ask that question the other way around. I would frankly LOVE to see an iPad Pro running full-blown macOS. And what's funny, is that when Apple was first designing the iPad, there were actually two "competing" teams created by Steve Jobs. One was to develop an OS very similar to what we know as iOS; the other was to see what would happen with OS X essentially ported to ARM for the iPad.

    The interesting thing is that Jobs actually favored the "OS X"-version. But when they were both demoed, apparently everyone (including Jobs) agreed that the "finger-friendly" "iOS" version made much more sense.

    But now that, with iOS 11, the iPad is growing what appears to be pretty much a macOS "Dock", plus side-by-side Apps, and essentially a "real" Filesystem-browser, and has an available Pencil for dealing with smaller "click-targets", it seems like things are really starting to move in that direction, anyway.

    I predict that within two or three years, you'll be able to:

    1. Run a macOS/iOS hybrid on an iPad Pro. I would doubt very much (actually I hope not!) that this will extend to the iPhone, due to screen-size limitations...

    2. MAYBE be able to run iOS apps on Macs.

    I would also imagine that #1 is already working in the Apple labs... MacOS is VERY processor-agnostic, and macOS and iOS share a Darwin Core; so...

  23. Yelp for hotspots; AirPlay for desktop apps by tepples · · Score: 1

    So, in the end, since my job is not Network Analysis

    It doesn't need to be someone's job; it could be a hobby, with users helping users avoid bad networks. An app listing nearby Wi-Fi hotspots and letting users read and post reviews of the hotspots would need to see which MACs or SSIDs are near a particular user. For example: "The Subway Guest Wi-Fi here cuts you off after half an hour and then locks you out of rejoining for another half hour." The app would use the SSID and/or MAC to ensure that the review actually refers to the same AP. Unfortunately, with the API restrictions on iOS, you won't be getting Yelp for Hotspots on an iPhone.

    And quite frankly, the very real limitation of screen size on a phone makes some Applications simply impractical.

    What (technical) limitation? Try connecting your iPhone to your living room TV through AirPlay to an Apple TV or through the Lightning to HDMI cable. At that point, the iPhone's touch screen could behave as a Magic Trackpad. The only thing keeping an iPhone from running desktop-like apps in this way is the lockdown.

    1. Re:Yelp for hotspots; AirPlay for desktop apps by TheFakeTimCook · · Score: 1

      So, in the end, since my job is not Network Analysis

      It doesn't need to be someone's job; it could be a hobby, with users helping users avoid bad networks. An app listing nearby Wi-Fi hotspots and letting users read and post reviews of the hotspots would need to see which MACs or SSIDs are near a particular user. For example: "The Subway Guest Wi-Fi here cuts you off after half an hour and then locks you out of rejoining for another half hour." The app would use the SSID and/or MAC to ensure that the review actually refers to the same AP. Unfortunately, with the API restrictions on iOS, you won't be getting Yelp for Hotspots on an iPhone.

      Ok, so that's ONE corner-case application. And I already conceded that the ability to gather more info on WiFi networks is the ONE API/App restriction I would like to see removed.

      But it is STILL nowhere NEAR-enough to give up the security of iOS, sorry!

      And quite frankly, the very real limitation of screen size on a phone makes some Applications simply impractical.

      What (technical) limitation? Try connecting your iPhone to your living room TV through AirPlay to an Apple TV or through the Lightning to HDMI cable. At that point, the iPhone's touch screen could behave as a Magic Trackpad. The only thing keeping an iPhone from running desktop-like apps in this way is the lockdown.

      Thanks, I already can do exactly that with AirPlay through my AppleTV and one of several VNC Apps, like "Jump". But:

      1. You generally don't haul your TV set around with you; so now we're off the topic of "mobile" operation.

      2. I can't run macOS, Linux or Windows Applications on my iPhone for the same reason you can't run Linux Applications on your Android phone; i.e., because they don't share a processor architecture; not because of screen-size limitations. It has NOTHING to do with "Lockdown", FFS!

      But, if you've ever tried to use a VNC App on your Phone, you know very well that it IS a matter of screen-size limitation that makes it an exercise in frustration. And AirPlay doesn't really count when you're on the Subway or in the Coffee Shop, etc., now does it?

      3. If I am at home, I have a laptop, which also has AirPlay. So, did you have a point?

      You're reachin', man! Quit while you've just started losing...

  24. GNURoot Debian by tepples · · Score: 1

    You generally don't haul your TV set around with you; so now we're off the topic of "mobile" operation.

    The use case that Ubuntu Touch tried to address was "I want mobile apps while mobile, but I want desktop apps when I've set the phone on the top of my desk, and I don't want to have to buy a $999 laptop in addition to the perfectly good computing device I already own."

    I can't run macOS, Linux or Windows Applications on my iPhone for the same reason you can't run Linux Applications on your Android phone; i.e., because they don't share a processor architecture; not because of screen-size limitations. It has NOTHING to do with "Lockdown", FFS!

    Install GNURoot Debian and optionally XSDL on an unrooted Android device with an ARM CPU, and you can recompile GNU/Linux applications from source code for ARM, or you can apt-get compiled versions from the ARM version of the Debian repository. The biggest thing a user of GNU/Linux on ARM misses compared to GNU/Linux on x86-64 is Wine.

    If I am at home, I have a laptop

    You do. Others don't.