9 ms·

Malware on your Android device picked up from third party app stores (FDroid? Amazon?) that steals email accounts and auth tokens. Looks like it only works on t

Malware on your Android device picked up from third party app stores (FDroid? Amazon?) that steals email accounts and auth tokens. Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. You can see if your account has been affected here: https://gooligan.checkpoint.com/ https://gooligan.checkpoint.com/

deleted 10y ago
[deleted]
an_account 10y ago
How did they get a list of compromised email accounts?
- tyingq 10y ago
  This explains it better: https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi
wnevets 10y ago
>Malware on your Android device picked up from third party app stores well ok then.
tyingq 10y ago
>Malware on your Android device picked up from third party app stores They say that, but then Google's G+ post[1] says "These apps are most often downloaded outside of Google Play" You could read "most often" as "some of these were downloaded from Google Play". Either way, they are exploiting known vulnerabilities. The big issue to me is that phone manufacturers / carriers, by choice, stop patching phones whenever they please. [1]https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi
- dri_ft 10y ago
  "Most often" might just be hedging.
  - tyingq 10y ago
    Searched a bit more. This family of malware (Ghost Push) was being downloaded from the Play Store...at least in the past. http://www.cmcm.com/blog/en/security/2015-10-14/825.html http://www.cmcm.com/blog/en/security/2015-10-14/825.html "Apps infected with this Trojan have been found in Google Play as well as other popular app markets"
  - ocdtrekkie 10y ago
    Adrian also stated they were removing affected apps from the Play Store. Many of the more recent vulnerabilities even show up in the Play Store first. Adrian's constant defense hinges on saying "stick with the Play Store, where we protect you", but the Play Store really isn't much better, it's just that saying it is scares people from looking at competitors' markets.
- guelo 10y ago
  If you read further down in the G+ post it says: - Removing apps from Play: We’ve removed apps associated with the Ghost Push family from Google Play. We also removed apps that benefited from installs delivered by Ghost Push to reduce the incentive for this type of abuse in the future. Downloading apps from Google Play, rather than from unknown sources [https://goo.gl/9rqdiH https://goo.gl/9rqdiH], is a good practice and will help reduce the threat of installing one of these malicious apps in the future.
dsacco 10y ago
Thanks for making this comment. This post is a wonderful example of the rampant marketing that has given the security industry a bad name. - The title is technically accurate, which is the best kind of accurate for clickbait. This is not a novel vulnerability representative of an application security flaw within Google - the malware campaign specifically targets older devices using previously known vulnerabilities.[1] There is no new exploit research here. - There's a logo and cute name for something which is, again, not a novel vulnerability.[2] - Scaremongering tactics are used throughout to hype up the finding.[3][4] Deliberately ominous language like "...for now" is perhaps tolerable when it's coming from a media outlet, but it's certainly unacceptable from a firm conducting original security research. All things told, this is closer to "threat intelligence" than real security research. A much better source for this news is the blog post by Google's Director of Android Security, Adrian Ludwig (first footnote, linked elsewhere in this thread as well). In particular, notice the succinctness and the serious, yet detached professionalism associated with the post. In any case, there are legitimate arguments to be made in favor of extending software or device support lifetimes for vulnerability patches, but the onus is on device manufacturers to coordinate this. In the meantime, it would be great if fewer firms practiced this sort of manic self-promotion, but unfortunately there's little incentive not to. ------- 1. https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi 2. http://blog.checkpoint.com/wp-content/uploads/2016/11/goo_blog.jpg http://blog.checkpoint.com/wp-content/uploads/2016/11/goo_bl... 3. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_4_REVISED_11.23.16.jpg http://blog.checkpoint.com/wp-content/uploads/2016/11/info_4... 4. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_2_REVISED-11.23.16-Copy.jpg http://blog.checkpoint.com/wp-content/uploads/2016/11/info_2...
- mola 10y ago
  In a similar vain a Google employee has a very obvious incentive to downplay this campaign.
- zepto 10y ago
  The fact that most consumers aren't aware they most Android devices are susceptible to these kind of vulnerability argues for more noise about these issues - not calming press releases talking about how the issues are moot with the latest build.
tonyplee 10y ago
If it is just auth tokens instead of email password, should google be able to invalidate all these auth tokens in their backend immediately? Force those uses to re-login and get new auth tokens?
- KingMachiavelli 10y ago
  The malware is still installed and would just capture the new auth tokens. And forcing the user to login would also give the malware an opportunity to capture the actual password.
  - deleted 10y ago
    [deleted]
  - tonyplee 10y ago
    I see. Google should log other signatures such as device id, ip, network, region where the request coming from and use those data as additional layer of security in the backend to help id the folks/org behind hack.
undersuit 10y ago
Do you actually know which stores they mean? I'd hate for F-Droid to be vilified. F-Droid isn't just a store, it's an Android Repository Browser[1]. It would be a shame if the F-Droid repository was exploited beyond the concessions[2] that they allow. [1] https://f-droid.org/wiki/page/Known_Repositories https://f-droid.org/wiki/page/Known_Repositories [2] https://f-droid.org/wiki/page/Antifeatures https://f-droid.org/wiki/page/Antifeatures
- ohyoutravel 10y ago
  I do not, just wanted to throw a couple that I know of out there. Hopefully neither of those third party stores because I like and use them both. I hope it was clear from the question marks in my post that those were just examples, certainly don't want to smear either one.
  - JshWright 10y ago
    If you're going to name app stores, I would think places like Baidu would be more likely, given their size and popularity with users of lower-tier Android devices.
    - ohyoutravel 10y ago
      Agreed, however until you posted this, I didn't know Baidu had an app store.
curt15 10y ago
>Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. But devices running Android 5 and below "only" comprise the vast majority of devices out there https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html
- JamesSwift 10y ago
  Yep, I'm stuck on 4.4.2 because verizon doesn't provide OTA updates any more and the 4.4 update ensures that the phone bricks if you go through the process of installing cyanogenmod.
  - TenOhms 10y ago
    Was the same, went for an Iphone 7. I'll never blindly buy a locked Verizon phone ever again. Damn them, damn them to hell.
wfunction 10y ago
Is there some way to check without actually submitting our email address?
Yetanfou 10y ago
It is not likely that this malware is picked up through F-Droid as that 'store' only contains software which was built from source by the store maintainers. Any non-free code is removed from the build before the package is hosted on the download server. As such an Android device can be used (in a useful way) without having Google Play services (or, for that matter, any other Google apps) installed. I've been doing just that for more than 5 years now without having the feeling I'm missing out on something. AOSP or a tailor-made Cyanogenmod (with all the Cyanogen-account related stuff removed) plus F-Droid gives you a perfectly usable device. https://f-droid.org/about/ https://f-droid.org/about/

deleted 10y ago

[deleted]

an_account 10y ago

How did they get a list of compromised email accounts?

tyingq 10y ago
This explains it better: https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi

wnevets 10y ago

>Malware on your Android device picked up from third party app stores well ok then.

tyingq 10y ago

>Malware on your Android device picked up from third party app stores They say that, but then Google's G+ post[1] says "These apps are most often downloaded outside of Google Play" You could read "most often" as "some of these were downloaded from Google Play". Either way, they are exploiting known vulnerabilities. The big issue to me is that phone manufacturers / carriers, by choice, stop patching phones whenever they please. [1]https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi

dri_ft 10y ago
"Most often" might just be hedging.
- tyingq 10y ago
  Searched a bit more. This family of malware (Ghost Push) was being downloaded from the Play Store...at least in the past. http://www.cmcm.com/blog/en/security/2015-10-14/825.html http://www.cmcm.com/blog/en/security/2015-10-14/825.html "Apps infected with this Trojan have been found in Google Play as well as other popular app markets"
- ocdtrekkie 10y ago
  Adrian also stated they were removing affected apps from the Play Store. Many of the more recent vulnerabilities even show up in the Play Store first. Adrian's constant defense hinges on saying "stick with the Play Store, where we protect you", but the Play Store really isn't much better, it's just that saying it is scares people from looking at competitors' markets.
guelo 10y ago
If you read further down in the G+ post it says: - Removing apps from Play: We’ve removed apps associated with the Ghost Push family from Google Play. We also removed apps that benefited from installs delivered by Ghost Push to reduce the incentive for this type of abuse in the future. Downloading apps from Google Play, rather than from unknown sources [https://goo.gl/9rqdiH https://goo.gl/9rqdiH], is a good practice and will help reduce the threat of installing one of these malicious apps in the future.

dsacco 10y ago

Thanks for making this comment. This post is a wonderful example of the rampant marketing that has given the security industry a bad name. - The title is technically accurate, which is the best kind of accurate for clickbait. This is not a novel vulnerability representative of an application security flaw within Google - the malware campaign specifically targets older devices using previously known vulnerabilities.[1] There is no new exploit research here. - There's a logo and cute name for something which is, again, not a novel vulnerability.[2] - Scaremongering tactics are used throughout to hype up the finding.[3][4] Deliberately ominous language like "...for now" is perhaps tolerable when it's coming from a media outlet, but it's certainly unacceptable from a firm conducting original security research. All things told, this is closer to "threat intelligence" than real security research. A much better source for this news is the blog post by Google's Director of Android Security, Adrian Ludwig (first footnote, linked elsewhere in this thread as well). In particular, notice the succinctness and the serious, yet detached professionalism associated with the post. In any case, there are legitimate arguments to be made in favor of extending software or device support lifetimes for vulnerability patches, but the onus is on device manufacturers to coordinate this. In the meantime, it would be great if fewer firms practiced this sort of manic self-promotion, but unfortunately there's little incentive not to. ------- 1. https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi 2. http://blog.checkpoint.com/wp-content/uploads/2016/11/goo_blog.jpg http://blog.checkpoint.com/wp-content/uploads/2016/11/goo_bl... 3. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_4_REVISED_11.23.16.jpg http://blog.checkpoint.com/wp-content/uploads/2016/11/info_4... 4. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_2_REVISED-11.23.16-Copy.jpg http://blog.checkpoint.com/wp-content/uploads/2016/11/info_2...

mola 10y ago
In a similar vain a Google employee has a very obvious incentive to downplay this campaign.
zepto 10y ago
The fact that most consumers aren't aware they most Android devices are susceptible to these kind of vulnerability argues for more noise about these issues - not calming press releases talking about how the issues are moot with the latest build.

tonyplee 10y ago

If it is just auth tokens instead of email password, should google be able to invalidate all these auth tokens in their backend immediately? Force those uses to re-login and get new auth tokens?

KingMachiavelli 10y ago
The malware is still installed and would just capture the new auth tokens. And forcing the user to login would also give the malware an opportunity to capture the actual password.
- deleted 10y ago
  [deleted]
- tonyplee 10y ago
  I see. Google should log other signatures such as device id, ip, network, region where the request coming from and use those data as additional layer of security in the backend to help id the folks/org behind hack.

undersuit 10y ago

Do you actually know which stores they mean? I'd hate for F-Droid to be vilified. F-Droid isn't just a store, it's an Android Repository Browser[1]. It would be a shame if the F-Droid repository was exploited beyond the concessions[2] that they allow. [1] https://f-droid.org/wiki/page/Known_Repositories https://f-droid.org/wiki/page/Known_Repositories [2] https://f-droid.org/wiki/page/Antifeatures https://f-droid.org/wiki/page/Antifeatures

ohyoutravel 10y ago
I do not, just wanted to throw a couple that I know of out there. Hopefully neither of those third party stores because I like and use them both. I hope it was clear from the question marks in my post that those were just examples, certainly don't want to smear either one.
- JshWright 10y ago
  If you're going to name app stores, I would think places like Baidu would be more likely, given their size and popularity with users of lower-tier Android devices.
  - ohyoutravel 10y ago
    Agreed, however until you posted this, I didn't know Baidu had an app store.

curt15 10y ago

>Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. But devices running Android 5 and below "only" comprise the vast majority of devices out there https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html

JamesSwift 10y ago
Yep, I'm stuck on 4.4.2 because verizon doesn't provide OTA updates any more and the 4.4 update ensures that the phone bricks if you go through the process of installing cyanogenmod.
- TenOhms 10y ago
  Was the same, went for an Iphone 7. I'll never blindly buy a locked Verizon phone ever again. Damn them, damn them to hell.

wfunction 10y ago

Is there some way to check without actually submitting our email address?

Yetanfou 10y ago

It is not likely that this malware is picked up through F-Droid as that 'store' only contains software which was built from source by the store maintainers. Any non-free code is removed from the build before the package is hosted on the download server. As such an Android device can be used (in a useful way) without having Google Play services (or, for that matter, any other Google apps) installed. I've been doing just that for more than 5 years now without having the feeling I'm missing out on something. AOSP or a tailor-made Cyanogenmod (with all the Cyanogen-account related stuff removed) plus F-Droid gives you a perfectly usable device. https://f-droid.org/about/ https://f-droid.org/about/