7 ms·

Viking Horde: A New Type of Android Malware on Google Play

103 points by reimertz 10y ago

hbz 10y ago
Cached version: http://webcache.googleusercontent.com/search?q=cache:http://blog.checkpoint.com/2016/05/09/viking-horde-a-new-type-of-android-malware-on-google-play/ http://webcache.googleusercontent.com/search?q=cache:http://...
m4dc4pXXX 10y ago
Nasty. Great read though.
throwaway0209 10y ago
so if I don't have Viking Horde or Viking Jump installed, my devices are not infected by this?
- chki 10y ago
  There are 4 other Apps mentioned in the article that seem to distribute the Malware, but it appears as if you need to install this malicious code yourself
- reimertz 10y ago
  The article mentions 5 different apps by I would assume there are a lot more apps in the store utilizing this scheme. Here are the apps mentioned: - Viking Jump - Parrot Copter - Wifi Plus - Memory Booster - Simple 2048
  - sgarman 10y ago
    I would also add that they have not provided a comprehensive list of infected apps or any way to stop them from being uploaded in the future. It's possible you are still compromised from another app. Looks like next steps are getting a tool out to check that.
deprave 10y ago
I feel like every time I read about something ad-related it's usually in a negative context. This malware doesn't even care if it's not executed as root... it just needs the device to falsify ad clicks/impressions. And I guess nobody really cares, because the probably huge amount of bot action on ad exchanges just makes the pie larger for everyone. (With all of Google's talent and machine learning and AI, it can't detect this junk? please...) All the more reason to avoid hardware from this company.
- chki 10y ago
  -Typing this on a Nexus- I'm pretty sure that this is not what Google wants although they might -as you correctly point out- profit from it in the first place. But the negative publicity in combination with possibly loosing companies buying ad space on Google because of fake clicks can not be worth it. Google is too big to profit from a scam like this in the long-term.
  - deprave 10y ago
    I agree, and like you, I doubt fake clicks/impressions have an impact on Google's revenue. Still, one has to wonder how one arm of the company can be so successful at creating artificial intelligence (smart cars, tensor flow, deep dream, just OTOH), while the other - its primary revenue driver, at that - manages to overlook things that are so simple. Or am I really expecting it to be much more difficult than simple heuristics like "game + SMS privileges = fishy"?
DocG 10y ago
I dont know why the change happened but I use play store only in every couple of months when I need something really specific. Long gone are the days I was intrested in searching for new apps and trying them out. Similar with updates, I've been hurt couple of times by keeping apps updated, so now it happens only when it stops working completely.
- saganus 10y ago
  That's part of the over-saturation of apps I guess. I also do the same regarding updates. More than once I've found that functionality is crippled in a newer version or it's simply is less usable so now I also avoid updating unless there's a feature I really want or as you say, it stops working altogether.
  - haddr 10y ago
    Same here, I only update when necessary. Also having auto update is painful, when you suddenly switch from 4G to WiFi your phone will try to update everything making it sluggish, regardless of what you want to do on your phone...
  - DocG 10y ago
    Yes. When I am using app, it is usually already doing everything I need it to be doing. Example is shazam. Used to be really simple. Big button, listen and get the name and thats about it. Now its loaded with buy now links, the big listen button is gone, wants you to register, takes too long to set up and so on.
- bane 10y ago
  I used to experiment around with some games and other interesting apps, but the free-to-play garbage has pretty much pushed me off of looking for new things in the store all together. Google used to do a decent job curating some recommended apps, but all that seems to have gone by the wayside some time ago. Now most of what I see are free-to-play apps with like 100 million downloads and 4-5 stars, but none of the stuff I've downloaded in that criteria has managed to hold my interest for longer than 10-20 minutes. I've gotten a lot more enjoyment out of a few humble mobile bundles than just about anything in the store.
TheGuyWhoCodes 10y ago
The article doesn't go into details of how the app manged to do all these things, isn't there some sandboxing that was broken, know vulnerability or some 0day that was used or anything like it? I've heard that android security is broken but it's seems a little too easy.
- deprave 10y ago
  Sandboxing isn't a magical solution. All it does is limit resources available to an app. Usually, until a user authorizes access to such resources. "Here's a list of thirty privileges this app needs to run. Do you approve?" Given you just downloaded it, why wouldn't you? After all, every other app requires a huge set of privileges to run, too. Do you see the problem? :)
  - StavrosK 10y ago
    Not any more, Marshmallow permissions are on-demand.
    - nitrogen 10y ago
      It's not all that effective; some apps (like the Hue app) just crash if you deny them anything. Why didn't Android add the option to provide blank data to apps?
      - StavrosK 10y ago
        > It's not all that effective I find it perfectly effective: If you deny an app a permission, it doesn't get any information for that permission. > some apps (like the Hue app) just crash if you deny them anything That sounds like the app is badly implemented, really. > Why didn't Android add the option to provide blank data to apps? Because it's a completely new API and it shouldn't have to, apps should check the return code to see if the permission was denied or not. Are you talking about denying permissions to apps that don't support the new-style permissions natively, perhaps?
yompers888 10y ago
I've been contemplating for a few weeks now rooting my phone. My justification for this plan is the convenience and added security of system-wide ad block. But I always wonder if I should be more concerned with the new vulnerabilities I open than with the ones I'm closing. I guess I'm wondering what people here think: is rooting something that makes sense if you're careful, or is it something you do if you're smart enough to want to play with your phone while not being smart enough to know better?
- StavrosK 10y ago
  It definitely makes sense, just be careful what you install and don't give root capabilities to apps that have no business having them.
- sudojudo 10y ago
  If you're a careless user, don't root your phone. If you pay attention, use common sense, and don't have a thousand Play store apps installed; you'll probably be okay. Another way to look at it is by comparing your phone to your desktop or laptop computer. How often do you unintentionally break it with malware? Often? Don't root your phone. Rarely or never? You'll be okay. The best advice I can offer is to stay the hell away from Google Play. That trash, and the rest of their services, are the first things I strip from my phones. Instead, use properly licensed open source software, from the F-Droid repository (or similar). If it's not a proprietary app (Twitter/Facebook/Snapchat/etc.), there's likely a FOSS version that's better than anything on the Play store. Flashlight apps don't need to access your contact list, or read your call logs, or have an open port in your firewall. The damned bastards. On F-Droid you'll find (for your rooted phone): AFWall+, an IPTables firewall GUI. Very nice looking and intuitive. Don't think I've ever used a firewall so easy to configure. Autostart, an app that prevents garbage from auto-starting. A bunch of junkware usually loads up when you activate things like WiFi and GPS, or reboot the phone. Autostart can be configured to block the bloat, and in turn, make your phone run much more efficiently. Disable Manager, to disable unsavory services (Play, Facebook, etc.). If you're worried that deleting things will break the phone, this app will put your mind at ease, because you can use it to turn things off and on, like a switch, instead of outright deleting. AdAway, generic name, but it does what it's supposed to; system-wide ad blocking. It's FOSS, under GPL. If you avoid the Play store, configure your firewall, and use an ad blocker addon on Firefox, you might not even need an app like this one. There's a bunch of other cool, trustworthy, stuff on F-Droid that's not going to abuse your phone. When it comes down to it, if you stick with FOSS, you won't need to root the phone; a non-root firewall will suffice. Apologies for the rant, this was supposed to be a short reply, I don't know what happened.
ams6110 10y ago
Too bad Google isn't more aggressive at keeping malware out of the Play Store. As it stands, I will not install anything that isn't from something very mainstream such as Google, Amazon, Netflix, etc. No small/indy apps for me.
- incepted 10y ago
  > Too bad Google isn't more aggressive at keeping malware out of the Play Store. I don't know, how often do we hear about this kind of malware on Google Play? Not nearly as often as I would have thought a few years back, especially given that Google does zero reviews of what gets uploaded. I think their current system is working reasonably well, but obviously, it's not perfect.
- chickenbane 10y ago
  Check out Google's excellent Android security review [1]. Google is pretty effective at keeping harmful apps out of the the Play Store; if you don't sideload apps less than 0.15% devices had malware. [1] http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf http://static.googleusercontent.com/media/source.android.com...
  - deleted 10y ago
    [deleted]
  - r00fus 10y ago
    How does that compare with iOS? I mean, Google may be doing yeoman's work, but if that compares with near-zero (due to Apple's walled garden), it's still looks bad in comparison (esp with the huge Android installed base).
    - ori_b 10y ago
      I don't have stats (and I'd be surprised if Apple released them), but it's not like IOS malware is unheard of. For example: http://www.computerworld.com/article/2989037/malware-vulnerabilities/iphone-malware-yispecter-apple-app-store-itbwcw.html http://www.computerworld.com/article/2989037/malware-vulnera...

103 points by reimertz 10y ago

hbz 10y ago

Cached version: http://webcache.googleusercontent.com/search?q=cache:http://blog.checkpoint.com/2016/05/09/viking-horde-a-new-type-of-android-malware-on-google-play/ http://webcache.googleusercontent.com/search?q=cache:http://...

m4dc4pXXX 10y ago

Nasty. Great read though.

throwaway0209 10y ago

so if I don't have Viking Horde or Viking Jump installed, my devices are not infected by this?

chki 10y ago
There are 4 other Apps mentioned in the article that seem to distribute the Malware, but it appears as if you need to install this malicious code yourself
reimertz 10y ago
The article mentions 5 different apps by I would assume there are a lot more apps in the store utilizing this scheme. Here are the apps mentioned: - Viking Jump - Parrot Copter - Wifi Plus - Memory Booster - Simple 2048
- sgarman 10y ago
  I would also add that they have not provided a comprehensive list of infected apps or any way to stop them from being uploaded in the future. It's possible you are still compromised from another app. Looks like next steps are getting a tool out to check that.

deprave 10y ago

I feel like every time I read about something ad-related it's usually in a negative context. This malware doesn't even care if it's not executed as root... it just needs the device to falsify ad clicks/impressions. And I guess nobody really cares, because the probably huge amount of bot action on ad exchanges just makes the pie larger for everyone. (With all of Google's talent and machine learning and AI, it can't detect this junk? please...) All the more reason to avoid hardware from this company.

chki 10y ago
-Typing this on a Nexus- I'm pretty sure that this is not what Google wants although they might -as you correctly point out- profit from it in the first place. But the negative publicity in combination with possibly loosing companies buying ad space on Google because of fake clicks can not be worth it. Google is too big to profit from a scam like this in the long-term.
- deprave 10y ago
  I agree, and like you, I doubt fake clicks/impressions have an impact on Google's revenue. Still, one has to wonder how one arm of the company can be so successful at creating artificial intelligence (smart cars, tensor flow, deep dream, just OTOH), while the other - its primary revenue driver, at that - manages to overlook things that are so simple. Or am I really expecting it to be much more difficult than simple heuristics like "game + SMS privileges = fishy"?

DocG 10y ago

I dont know why the change happened but I use play store only in every couple of months when I need something really specific. Long gone are the days I was intrested in searching for new apps and trying them out. Similar with updates, I've been hurt couple of times by keeping apps updated, so now it happens only when it stops working completely.

saganus 10y ago
That's part of the over-saturation of apps I guess. I also do the same regarding updates. More than once I've found that functionality is crippled in a newer version or it's simply is less usable so now I also avoid updating unless there's a feature I really want or as you say, it stops working altogether.
- haddr 10y ago
  Same here, I only update when necessary. Also having auto update is painful, when you suddenly switch from 4G to WiFi your phone will try to update everything making it sluggish, regardless of what you want to do on your phone...
- DocG 10y ago
  Yes. When I am using app, it is usually already doing everything I need it to be doing. Example is shazam. Used to be really simple. Big button, listen and get the name and thats about it. Now its loaded with buy now links, the big listen button is gone, wants you to register, takes too long to set up and so on.
bane 10y ago
I used to experiment around with some games and other interesting apps, but the free-to-play garbage has pretty much pushed me off of looking for new things in the store all together. Google used to do a decent job curating some recommended apps, but all that seems to have gone by the wayside some time ago. Now most of what I see are free-to-play apps with like 100 million downloads and 4-5 stars, but none of the stuff I've downloaded in that criteria has managed to hold my interest for longer than 10-20 minutes. I've gotten a lot more enjoyment out of a few humble mobile bundles than just about anything in the store.

TheGuyWhoCodes 10y ago

The article doesn't go into details of how the app manged to do all these things, isn't there some sandboxing that was broken, know vulnerability or some 0day that was used or anything like it? I've heard that android security is broken but it's seems a little too easy.

deprave 10y ago
Sandboxing isn't a magical solution. All it does is limit resources available to an app. Usually, until a user authorizes access to such resources. "Here's a list of thirty privileges this app needs to run. Do you approve?" Given you just downloaded it, why wouldn't you? After all, every other app requires a huge set of privileges to run, too. Do you see the problem? :)
- StavrosK 10y ago
  Not any more, Marshmallow permissions are on-demand.
  - nitrogen 10y ago
    It's not all that effective; some apps (like the Hue app) just crash if you deny them anything. Why didn't Android add the option to provide blank data to apps?
    - StavrosK 10y ago
      > It's not all that effective I find it perfectly effective: If you deny an app a permission, it doesn't get any information for that permission. > some apps (like the Hue app) just crash if you deny them anything That sounds like the app is badly implemented, really. > Why didn't Android add the option to provide blank data to apps? Because it's a completely new API and it shouldn't have to, apps should check the return code to see if the permission was denied or not. Are you talking about denying permissions to apps that don't support the new-style permissions natively, perhaps?

yompers888 10y ago

I've been contemplating for a few weeks now rooting my phone. My justification for this plan is the convenience and added security of system-wide ad block. But I always wonder if I should be more concerned with the new vulnerabilities I open than with the ones I'm closing. I guess I'm wondering what people here think: is rooting something that makes sense if you're careful, or is it something you do if you're smart enough to want to play with your phone while not being smart enough to know better?

StavrosK 10y ago
It definitely makes sense, just be careful what you install and don't give root capabilities to apps that have no business having them.
sudojudo 10y ago
If you're a careless user, don't root your phone. If you pay attention, use common sense, and don't have a thousand Play store apps installed; you'll probably be okay. Another way to look at it is by comparing your phone to your desktop or laptop computer. How often do you unintentionally break it with malware? Often? Don't root your phone. Rarely or never? You'll be okay. The best advice I can offer is to stay the hell away from Google Play. That trash, and the rest of their services, are the first things I strip from my phones. Instead, use properly licensed open source software, from the F-Droid repository (or similar). If it's not a proprietary app (Twitter/Facebook/Snapchat/etc.), there's likely a FOSS version that's better than anything on the Play store. Flashlight apps don't need to access your contact list, or read your call logs, or have an open port in your firewall. The damned bastards. On F-Droid you'll find (for your rooted phone): AFWall+, an IPTables firewall GUI. Very nice looking and intuitive. Don't think I've ever used a firewall so easy to configure. Autostart, an app that prevents garbage from auto-starting. A bunch of junkware usually loads up when you activate things like WiFi and GPS, or reboot the phone. Autostart can be configured to block the bloat, and in turn, make your phone run much more efficiently. Disable Manager, to disable unsavory services (Play, Facebook, etc.). If you're worried that deleting things will break the phone, this app will put your mind at ease, because you can use it to turn things off and on, like a switch, instead of outright deleting. AdAway, generic name, but it does what it's supposed to; system-wide ad blocking. It's FOSS, under GPL. If you avoid the Play store, configure your firewall, and use an ad blocker addon on Firefox, you might not even need an app like this one. There's a bunch of other cool, trustworthy, stuff on F-Droid that's not going to abuse your phone. When it comes down to it, if you stick with FOSS, you won't need to root the phone; a non-root firewall will suffice. Apologies for the rant, this was supposed to be a short reply, I don't know what happened.

ams6110 10y ago

Too bad Google isn't more aggressive at keeping malware out of the Play Store. As it stands, I will not install anything that isn't from something very mainstream such as Google, Amazon, Netflix, etc. No small/indy apps for me.

incepted 10y ago
> Too bad Google isn't more aggressive at keeping malware out of the Play Store. I don't know, how often do we hear about this kind of malware on Google Play? Not nearly as often as I would have thought a few years back, especially given that Google does zero reviews of what gets uploaded. I think their current system is working reasonably well, but obviously, it's not perfect.
chickenbane 10y ago
Check out Google's excellent Android security review [1]. Google is pretty effective at keeping harmful apps out of the the Play Store; if you don't sideload apps less than 0.15% devices had malware. [1] http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf http://static.googleusercontent.com/media/source.android.com...
- deleted 10y ago
  [deleted]
- r00fus 10y ago
  How does that compare with iOS? I mean, Google may be doing yeoman's work, but if that compares with near-zero (due to Apple's walled garden), it's still looks bad in comparison (esp with the huge Android installed base).
  - ori_b 10y ago
    I don't have stats (and I'd be surprised if Apple released them), but it's not like IOS malware is unheard of. For example: http://www.computerworld.com/article/2989037/malware-vulnerabilities/iphone-malware-yispecter-apple-app-store-itbwcw.html http://www.computerworld.com/article/2989037/malware-vulnera...