Google Play apps steal texts and pepper you with unauthorized purchases

Getty Photographs

Safety researchers have uncovered a batch of Google Play apps that stole customers’ textual content messages and made unauthorized purchases on customers’ dime.

The malware, which was hidden in eight apps that had greater than 700,000 downloads, hijacked SMS message notifications after which made unauthorized purchases, McAfee cell researchers Sang Ryol Ryu and Chanung Pak said Monday. McAfee is looking the malware Android/Etinu.

Consumer knowledge free for the taking

The researchers stated an investigation of the attacker-operated server that managed contaminated units confirmed it saved every kind of date from customers’ telephones, together with their cell service, telephone quantity, SMS messages, IP deal with, nation, and community standing. The server additionally saved auto-renewing subscriptions, a few of which seemed like this:

No joke

The malware is reminiscent, if not equivalent, to a prolific household of Android malware often called Joker, which also steals SMS messages and indicators up customers for dear providers.

“The malware hijacks the Notification Listener to steal incoming SMS messages like Android Joker malware does, with out the SMS learn permission,” the researchers wrote referring to Etinu. “Like a series system, the malware then passes the notification object to the ultimate stage. When the notification has arisen from the default SMS package deal, the message is lastly despatched out utilizing WebView JavaScript Interface.”

Whereas the researchers say that Etinu is a malware household distinct from Joker, safety software program from Microsoft, Sophos, and different firms use the phrase Joker of their detection names of a number of the newly found malicious apps. Etinu’s decryption move and use of multi-stage payloads are additionally related.

The decryption flow.

The decryption move.


In an e mail, McAfee’s Sang Ryol Ryu wrote: “Whereas Etinu seems similar to Joker, in-depth, its processes for loading payloads, encryption, focusing on geographies are completely different from Joker.”

The Etinu payloads seem in an Android Belongings folder with file names comparable to “cache.bin,” “settings.bin,” “knowledge.droid,” or “picture information.”


Multi stage

As depicted within the decryption move diagram above, hidden malicious code in the principle set up file downloaded from Play opens an encrypted file named “1.png” and decrypts it utilizing a key that’s the identical because the package deal title. The ensuing file, “loader.dex” is then executed, leading to an HTTP POST request to the C2 server.

“Curiously, this malware makes use of key administration servers,” the McAfee researchers wrote. “It requests keys from the servers for the AES encrypted second payload, ‘2.png.’ And the server returns the important thing because the ‘s’ worth of JSON. Additionally, this malware has self-update perform. When the server responds ‘URL’ worth, the content material within the URL is used as a substitute of ‘2.png’. Nonetheless, servers don’t at all times reply to the request or return the key key.”


The apps and corresponding cryptographic hashes are:

CC2DEFEF5A14F9B4B9F27CC9F5BBB0D2FC8A729A2F4EBA20010E81A362D5560C com.pip.editor.digicam
08FA33BC138FE4835C15E45D1C1D5A81094E156EEF28D02EA8910D5F8E44D4B8 com.tremendous.coloration.hairdryer
018B705E8577F065AC6F0EDE5A8A1622820B6AEAC77D0284852CEAECF8D8460C com.hit.digicam.pip
0E2ACCFA47B782B062CC324704C1F999796F5045D9753423CF7238FE4CABBFA8 com.daynight.keyboard.wallpaper

A number of the apps seem like this:


The researchers stated they reported the apps to Google, and the corporate eliminated them.

Source link

We will be happy to hear your thoughts

Leave a reply
Enable registration in settings - general
Compare items
  • Total (0)