Tag Archive for: play

How cybercriminals use common apps on Google Play to spread malware

/in


Google Play is home to more than three million unique apps, most of which get updated regularly to update security patches and implement changes. However, cybercriminals have found ways to make use of these periodic updates to sneak malicious apps onto Google Play.

In 2023, apps with malicious codes were found to have been downloaded more than 600 million times on Google Play, Kaspersky shared in a blog post.

Some of the commonly downloaded apps that contain malware include photo editing apps, file managers, games, music and video players as well as health tracking apps.

The malware in these apps has been found to not just hide adware, but also track users’ location, cellular operator information, load spyware, record voice, and other sensitive user information.

(For top technology news of the day, subscribe to our tech newsletter Today’s Cache)

How threat actors post malicious apps on Google Play?

Cybercriminals create multiple developer accounts to upload apps on Google Play. Through these accounts they upload seemingly unremarkable apps with simple functionality and no malicious code to ensure they are able to sail through Google’s moderation checks. Once the app is downloaded by a sizeable audience, cybercriminals add malicious functionality in the app through an update.

An example of this is seen in the case of iRecorder app, which when uploaded to Google Play in 2021 was able to get past Google’s moderation checks as it did not contain any malicious code. However, once the app garnered close to 50,000 downloads, threat actors updated the app with malicious functionality, allowing the app to record sound from the device’s microphone every 15 minutes and sending it to a server of the app creators.

Threat actors have also been found to have made use of multiple developer accounts to ensure that they can continue uploading malicious apps if one of their accounts is blocked by the moderators.

From signing up for subscriptions to data mining, malicious apps do it all

Malicious codes in apps can be used to access sensitive user data including files, photos, videos and device’s location and cellular information. Such apps have also been found to sign up the user’s cellular…

Source…

Android VPNs to get audit badges in Google Play Store if they aren’t comically crap • The Register

/in


Google wants to help Android users find more trustworthy VPN apps through better badging alerting to independent audits.

The ad impresario and cloud concession has afforded independently audited applications in its Play store a more prominent display of their security bonafides, specifically a banner atop their Google Play page.

VPN apps are the first to receive this special treatment, explained Nataliya Stanetsky, from Google’s Android Security and Privacy Team, in an announcement, because they handle significant amounts of sensitive data. And they’re thus a popular target for subversion by miscreants.

“When a user searches for VPN apps, they will now see a banner at the top of Google Play that educates them about the ‘Independent security review’ badge in the Data Safety Section,” said Stanetsky.

Last year, Google’s partnership with the App Defense Alliance (ADA), launched in 2019, was expanded to include the Mobile App Security Assessment (MASA), a way to check Android apps to ensure they comply with a security standard defined by OWASP.

It’s not a particularly thorough audit. As the ADA’s website states, “MASA is intended to provide more transparency into the app’s security architecture, however the limited nature of testing does not guarantee complete safety of the application.”

The ADA also advises that MASA does not necessarily check app developers’ safety declarations. Obviously the alliance doesn’t want to be blamed if it misses something and an info-stealing app slips by, but the group’s MASA endorsement counts for something.

MASA looks for obvious bad practices, like whether sensitive data gets written to application log files and whether the app reuses cryptographic keys for multiple purposes, among its many checks. It’s safe to say you’re better off with apps that avoid such missteps, even if it’s not safe to say they’re guaranteed to be secure.

At least if MASA misses, the Android ecosystem has other security measures in place. As Google proudly proclaims, it tries to protect against PHAs and MUwS – potentially harmful applications and mobile unwanted software, in case your gibberish translator is down. It does so through static and dynamic risk…

Source…

Millions install mobile adware apps on Google Play – SC Media

/in



Millions install mobile adware apps on Google Play  SC Media

Source…

How culture drives foul play on the internet and how new “upcode” can protect us

/in


Shapiro’s book arrives just in time for the last gasp of the latest crypto wave, as major players find themselves trapped in the nets of human institutions. In early June, the US Securities and Exchange Commission went after Binance and Coinbase, the two largest cryptocurrency exchanges in the world, a few months after charging the infamous Sam Bankman-Fried, founder of the massive crypto exchange FTX, with fraud. While Shapiro mentions crypto only as the main means of payment in online crime, the industry’s wild ride through finance and culture deserves its own hefty chapter in the narrative of internet fraud. 

It may be too early for deep analysis, but we do have first-person perspectives on crypto from actor Ben McKenzie (former star of the teen drama The O.C.) and streetwear designer and influencer Bobby Hundreds, the authors of—respectively—Easy Money and NFTs Are a Scam/NFTs Are the Future. (More heavily reported books on the crypto era from tech reporter Zeke Faux and Big Short author Michael Lewis are in the works.) 

“If we are committing serious crimes like fraud, it is crucially important that we find ways to justify our behavior to others, and crucially, to ourselves.”

Ben McKenzie, former star of The O.C.

McKenzie testified at the Senate Banking Committee’s hearing on FTX that he believes the cryptocurrency industry “represents the largest Ponzi scheme in history,” and Easy Money traces his own journey from bored pandemic dabbler to committed crypto critic alongside the industry’s rise and fall. Hundreds also writes a chronological account of his time in crypto—specifically in nonfungible tokens, or NFTs, digital representational objects that he has bought, sold, and “dropped” on his own and through The Hundreds, a “community-based streetwear brand and media company.” For Hundreds, NFTs have value as cultural artifacts, and he’s not convinced that their time should be over (although he acknowledges that between 2019 and the writing of his book, more than $100 million worth of NFTs have been stolen, mostly through phishing scams). “Whether or not NFTs are a scam poses a philosophical question that wanders into moral judgments…

Source…