Security researchers find multistage Android malware on Google Play
Malware apps found on Google Play deliver their payload as a secondary app after installation
IDG News Service - Security researchers from antivirus vendor Symantec identified two malware apps on Google Play that used a multistage payload delivery system in order to remain undetected.
The apps, which have since been removed by Google, masqueraded as two games -- "Super Mario Bros." and "GTA 3 - Moscow city."
"Both were posted to Google Play on June 24 and since then have generated in the range of 50,000 to 100,000 downloads," Symantec security researcher Irfan Asrar said Tuesday in a blog post.
Once installed, the apps downloaded an additional package called Activator.apk from a Dropbox account and prompted the device owners to install it.
This secondary Activator app sent SMS messages to a premium-rate number located in Eastern Europe, after which it asked to be uninstalled.
The fact that the malicious payload was delivered in multiple stages is probably why the apps managed to remain undetected for so long on Google Play, Asrar said.
Earlier this year, Google started using an automated scanner called Bouncer to detect malware on Google Play. Bouncer runs all published apps in an emulated Android environment and monitors them for suspicious activity.
However, downloading a secondary app from a developer's server and prompting the user to install it might not necessarily represent malicious behavior.
This is not the first time when Android malware developers have used multi-stage payloads. The Android.Lightdd and Android.Jsmshider threats discovered in 2011 both downloaded additional components after the installation of an initial app.
There are several advantages to spreading the payload across multiple apps, Asrar said about those threats at the time. For one, the initial malicious app no longer needs to display an extensive list of permissions that might attract the user's attention.
Secondly, if the initial app is downloaded from the official Android marketplace -- now called Google Play -- the user is likely to assume that the additional apps also originate from there.
Symantec detects the two newly found malware apps as Android.Dropdialer. The Android security team immediately removed the threat after being notified by Symantec, Asrar said.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Accelerating Network Convergence in Virtualized and Cloud Data Centers Adopting a converged networking strategy enables organizations to traffic server and storage I/O workloads on consolidated data throughput channels. Intelligent software helps optimize...
- Omnichannel: From Buzzword to Strategy Customers demand a seamless experience across channels, especially mobile. Read this whitepaper for a research-based framework for using omnichannel for higher customer engagement.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts