4 ms·
> So a dropper might be used to install malware that steals banking credentials or generates fake advertising clicks or signs up for fake subscriptions. This
by buildzr 7y ago
> So a dropper might be used to install malware that steals banking credentials or generates fake advertising clicks or signs up for fake subscriptions.
This is basically wrong, you can't modify a browser or charge someone's card without breaking out of the sandbox.
Worst case they could burn your cellular data or encrypt your photos and such if you gave it permission.
Is there any evidence they maliciously used this or was it probably just in there so they could drop more creepy ad code?
- hathawsh 7y agoThe exploit downloaded and executed code from some server, so there may have been targeted payloads that rooted specific devices. I hope I'm wrong, but that's the impression I get from the Kaspersky post: https://securelist.com/dropper-in-google-play/92496/ https://securelist.com/dropper-in-google-play/92496/
- nisa 7y ago> without breaking out of the sandbox. Every Android Security Advisory I looked at contained at least one often multiple Elevation of Privilegues or straight Remote Code Execution holes - my Android One smartphone usally gets the updates 20-35 days after the release of the Advisory - I'm the only one in my wider family that even got a smartphone that still receives monthly security updates at all. Most of them are stuck on an old Android version with years old patch-levels. So I doubt this is hard at all. I have no idea if there are public exploits for these issues but they probably exist.