Slashdot Mirror
Google Play Apps With Over 4.3 Million Downloads Stole Pics, Pushed Porn Ads (arstechnica.com)
Google has banned dozens of Android apps downloaded millions of times from the official Play Store after researchers discovered they were being used to display phishing and scam ads or perform other malicious acts. Ars Technica reports: A blog post published by security firm Trend Micro listed 29 camera- or photo-related apps, with the top 11 of them fetching 100,000 to 1 million downloads each. One crop of apps caused browsers to display full-screen ads when users unlocked their devices. Clicking the pop-up ads in some cases caused a paid online pornography player to be downloaded, although it was incapable of playing content. The apps were carefully designed to conceal their malicious capabilities. The apps also hid their icons from the Android app list. That made it hard for users to uninstall the apps, since there was no icon to drag and delete. The apps also used compression archives known as packers to make it harder for researchers -- or presumably, tools Google might use to weed out malicious apps -- from analyzing the wares.
Trend Micro researchers discovered another batch of apps that falsely promised to allow users to "beautify" their pictures by uploading them to a designated server. Instead of delivering an edited photo, however, the server provided a picture with a fake update prompt in nine different languages. The apps made it possible for the developers to collect the uploaded photos, possibly for use in fake profile pics or for other malicious purposes. The developers took pains to prevent users from detecting what was happening. "The remote server used by these apps is encoded with BASE64 twice in the code," Wu wrote. "In addition, several of these apps can also hide themselves via the same hidden technique mentioned above."
Trend Micro researchers discovered another batch of apps that falsely promised to allow users to "beautify" their pictures by uploading them to a designated server. Instead of delivering an edited photo, however, the server provided a picture with a fake update prompt in nine different languages. The apps made it possible for the developers to collect the uploaded photos, possibly for use in fake profile pics or for other malicious purposes. The developers took pains to prevent users from detecting what was happening. "The remote server used by these apps is encoded with BASE64 twice in the code," Wu wrote. "In addition, several of these apps can also hide themselves via the same hidden technique mentioned above."
"The remote server used by these apps is encoded with BASE64 twice in the code," Wu wrote.
Those tricky devils!
Stronger than D-ROT13, and MORE FIENDISH!
Like shareware and postcardware https://en.wikipedia.org/wiki/... during the early years of computing the apps do one needed task and do it well.
Domestic spying is now "Benign Information Gathering"
Indicators of Compromise (IoCs)
Package "Label" Installs
com.beauty.camera.years.pro "Pro Camera Beauty" 1,000,000+
com.cartoon.art.photo.ygy.camera "Cartoon Art Photo" 1,000,000+
com.lyrebirdstudio.emoji_camera "Emoji Camera" 1,000,000+
art.eff.filter.photo.editor "Artistic effect Filter" 500,000+
art.filter.editor.imge "Art Editor" 100,000+
com.beauty.camera.project.cloud "Beauty Camera" 100,000+
com.selfie.camerapro.pro "Selfie Camera Pro" 100,000+
com.camera.beauty.kwok.horizon "Horizon Beauty Camera" 100,000+
com.camera.ygysuper.photograph "Super Camera" 100,000+
com.effects.art.photo.for.self "Art Effects for Photo" 100,000+
com.solidblack.awesome.cartoon.art.pics.photo.editor "Awesome Cartoon Art" 100,000+
com.photoeditor.artfilterphoto "Art Filter Photo" 50,000+
com.photocorner.artfilter.arteffect.prizma "Art Filter Photo Effcts" 10,000+
com.picfix.cartoonphotoeffects "Cartoon Effect" 10,000+
com.picsartitude.arteffect "Art Effect" 10,000+
com.csmart.photoframelab "Photo Editor" 5,000+
com.wallpapers.nuclear.hd.hd3d.best.live.nuclear "Wallpapers HD" 5,000+
com.perfectmakeup.magicartfilter.photoeditor.selfiecamera "Magic Art Filter Photo Editor" 5,000+
appworld.fillartphotoeditor.technology "Fill Art Photo Editor" 1,000+
com.artflipphotoediting "ArtFlipPhotoEditing" 1,000+
com.artphoto.artfilter.artpiczone "Art Filter" 1,000+
com.photoeditor.cartoonphoto "Cartoon Art Photo" 1,000+
com.photoeditor.prismaeffects "Prizma Photo Effect" 1,000+
com.cmds.artphotofiltereffect "Cartoon Art Photo Filter" 100+
com.latestnewappzone.photoartfiltereditor "Art Filter Photo Editor" 100+
com.livewallpaperstudio.pixture "Pixture" 100+
app.pixelworlds.arteffect "Art Effect" 50+
timepassvideostatus.photoarteffect.cartoonpainteffect "Photo Art Effect" 10+
com.techbuzz.cartoonfilter "Cartoon Photo Filter" 5+
Package "Label" Installs
I deny that I have not avoided attaining the opposite of that which I do not want.
The basic problem (and benefit, sadly) of these wretched App Stores is pretty simple. They put everyone on a level playing field to publish apps. This seems like a good thing, but it's not. Not even close.
Gone are the days of going to a reputable vendor to acquire software you're interested in. Instead, you search the app store, and reputable and disreputable apps are offered up.
This is a serious problem and the Achilles heel of App Store, and why I've railed against them for years. They are not a good idea, not even close. We need to go back to the previous way of doing things, where reputable companies are rewarded by customers when they act responsibly, and disreputable companies go out of business cuz no one buys their garbage.
The App store model short circuits this, and when an App is found to be malicious, the publisher found to be disreputable, they just fold up their junk and republish under a new name, with a new malicious app. This is really broken folks.
I think you're projecting again.
People who say "sheeple" have about as much sophistication as an AOL user, and in fact are probably actually AOL users.
Wait -- so this means that Google has the ability to ban any app, for any reason they choose, at any time? I think this is a far bigger story. Do we really want to live in a world where Google has absolute control over any application on their platform?
People who say "sheeple" have about as much sophistication as an AOL user, and in fact are probably actually AOL users.
How came I never get apps that push porn? I feel somehow cheated.
I have Trend micro installed at work, it interferes with the OS, deletes software even code I've written and I'm debugging, locks files, slows down internet access and has annoying popups. I can't delete this junk due to corp policy. I lose hours of productivity every week due to it. Believe me, if you install TM products to deal with the problem of malware, then now you have two problems.
I found that interesting because that has long been common in PHP-based malware, snippets that bad actors add to legitimate PHP pages. Many years ago I wrote software to scan a web server for malware and base64_decode was one thing it looked for.
I understand your frustration. Unfortunately, in security the defender can do a very good job and still miss an attack.
"Missed one" doesn't mean they didn't catch and stop 10,000 others. Google could be catching and preventing 99.99% of attempts to put something nasty in the Play Store, and still some would get through - 0.01%, to be exact.
What we know is that Google didn't do the exact same checks that these researchers did, at the exact same time, on the same apps.
This isn't to excuse any weaknesses that Google may have, simply pointing out the reason security is hard. If the defender is successful 99.9% of the time and the attacker only 0.1% of the time, the attacker wins.
On the other hand, if the attacker gets away with 99 times before being criminally prosecuted one time, they lose. So there's that.
The problem is the stupid walled garden of "smart" phones. Either you're being fucked by Apple or Google. Take your pick. There's no way around it.
I don't respond to AC's.
That's not news because the fact that Google and Apple have complete control over their respective app stores is well known. Apple's control over iOS is tighter than Google's control over Android in some ways because at least there are alternative ways of getting pre-built applications for Android (for example, Amazon's app store or F-Droid), whereas the only ways of installing apps on an iOS device other than from Apple's store are to build them from source (on a Mac) or to have a corporate account that lets you install internal apps on a limited number of devices.
The more troubling thing is the number of Android apps that depend on Google Play Services and so won't work on an Android phone without some proprietary Google code running with elevated privileges, even if you could get them from another source.
I am TheRaven on Soylent News
It's quite understandable. The goal of the Play Store is to make it possible to install things that use Google Play Services and provide personal information on users to Google. Similarly, the goal of Chrome is to make it easy to load web pages that depend on Google Ads and Google Analytics, to send personal information on users to Google. Both are doing their job. Tightening restrictions on Chrome extensions makes it harder for things that prevent Google from data harvesting. Weakening restrictions in the Play Store makes it easier for things that data harvest on behalf of Google. They're entirely self consistent activities.
I am TheRaven on Soylent News
Wait.... Why is that even possible? Every app that is installed should have an icon on the home screen, and if the icon is missing or damaged, the OS should substitute a default icon. Is there some valid/reasonable use for this behavior that I'm missing? If not, it seems like the right fix is to just remove the feature.
Check out my sci-fi/humor trilogy at PatriotsBooks.
I didn't say you had a smartphone, nor did I say you need one. I said you're projecting.
People who say "sheeple" have about as much sophistication as an AOL user, and in fact are probably actually AOL users.