Android malware from Chinese ad firm infects 10 million devices

[patent10021]

Android malware from Chinese ad firm infects 10 million devices

The Android malware Hummingbad has infected 10 million devices so far, but what's most interesting is where it comes from. First discovered by the security firm Check Point in February, the researchers have tied it to Yingmob, a highly organized Chinese advertising and analytics company that looks like your typical hum-drum ad firm. Once it successfully infects and sets up a rootkit on Android devices (giving it full administrative control), Hummingbad generates as much as $300,000 a month through fraudulent app installs and ad clicks. As Check Point describes it, Hummingbad is an example of how malware companies can support themselves independently.

Walled-Graden doesn't seem so bad sometimes.

OT but on a semi-related note, Android Studio is the worst IDE ever created.

 

[Loco Emperor]

It's okay.
Android is open and there is ABSOLUTELY nothing wrong with open as long as you can make your homescreen look artistic and have a bunch of widgets on them to see live views of things without opening apps. It's okay as well that it I open and what not because it has features that IOS still lacks or is just now getting. Android is the best.
/sarcasm

 

[mi7chy]

It's ok to be ignorant. /s

This is an issue affecting Asia, primarily China, where the government block Google Play Store forcing their citizens to side load apps forgoing the protection of Google malware scanning which is considered top in the business.

https://virustotal.com/

Getting apps from questionable sources is universally risky and also affects iOS per the article.

iPhone users aren't safe from Yingmob either -- researchers have also found that the group is behind the Yispecter iOS malware

As of 9/2015 there were 1.4 billion Android devices so 10 million is 0.7% so less than 1%.

Along with built-in Google malware scanning a lot of devices don't even have working root for years like my Moto G with Android 4.4. That's unlike iOS that has had jailbreak (root) for majority of the versions.

 

[flyinmac]

Not to mention that in China the Internet is monitored, so in a sense just connecting to the Internet is malware.

 

[L_Virtue]

Much like iOS, the probability of getting malware/viruses from a Play Store apps are almost completely minuscule. The infections stem from bypassing the Play Store and side-loading (and turning off the ability for Android to block the installs) infected apks. This is the fault of the user, not the OS.

 

[LIVEFRMNYC]

OMG, time to throw all my Android devices in the trash!!!!!

Time to use my iPhone only, and disable jailbreak. Apple SAVE ME!!!!!

 

[gotluck]

I would rather have malware out there than be locked into a walled garden.

Are you guys against freedom in real life too? There would be less crime if the government controlled our lives more. Freedom isn't perfect but it's better than censorship and what is essentially a dictatorship.

 

[Surf Donkey]

I would rather have malware out there than be locked into a walled garden.

Are you guys against freedom in real life too? There would be less crime if the government controlled our lives more. Freedom isn't perfect but it's better than censorship and what is essentially a dictatorship.

Yeah well my mother in law asked me to check out her computer this weekend because it was running slow. Lets just say some people need a walled garden. Glad the iPhone is out there for them.

 

[gotluck]

Yeah well my mother in law asked me to check out her computer this weekend because it was running slow. Lets just say some people need a walled garden. Glad the iPhone is out there for them.

I hear you, but I don't get why those people cant just leave the 'allow apps from third party sources' box unchecked, we all must suffer for the benefit of the lowest common denominator! (I know windows pcs don't really have that, but android and osx do)

 

[Surf Donkey]

I hear you, but I don't get why those people cant just leave the 'allow apps from third party sources' box unchecked, we all must suffer for the benefit of the lowest common denominator! (I know windows pcs don't really have that, but android and osx do)

According to this in depth on the malware, that check box might not have stopped it though:

http://blog.checkpoint.com/wp-content/uploads/2016/07/HummingBad-Research-report_FINAL-62916.pdf

If rooting fails, a second component uses a fake system update notification, tricking users into granting HummingBad system-level permissions.

If the device is rooted, it installs the APK silently; if not, SSP attempts installation with a user dialog. Once installed, SSP launches the APK and broadcasts INSTALL_REFERRER, using information received from the server to imitate an installation from GP and acquire revenue from the ad networks

 

[gotluck]

According to this in depth on the malware, that check box might not have stopped it though:

http://blog.checkpoint.com/wp-content/uploads/2016/07/HummingBad-Research-report_FINAL-62916.pdf

If rooting fails, a second component uses a fake system update notification, tricking users into granting HummingBad system-level permissions.

If the device is rooted, it installs the APK silently; if not, SSP attempts installation with a user dialog. Once installed, SSP launches the APK and broadcasts INSTALL_REFERRER, using information received from the server to imitate an installation from GP and acquire revenue from the ad networks

well then that there is quite a vulnerability indeed!

the walled garden argument doesn't seem all that applicable here then though? It seems like google play store's code is more to blame, given the device is unrooted.

the real main issue is these devices are surely some old unpatched android version, updates are important is moreso the moral of the story for me but I know you all are sick of me beating that drum

 

[Surf Donkey]

well then that there is quite a vulnerability indeed!

the walled garden argument doesn't seem all that applicable here then though?

Well there was a related malware attack on iOS last year that did the same thing. It impacted both jailbroken and non-jailbroken devices. Within the walled garden Apple did fix it quickly once they knew about it (but it has been circulating for the good part of 10 months), The wall had a hole.

So to your point, yes in the case of this pretty ingenious malware, Apple's walled garden didn't fare any better than keeping your 'allow apps from third party sources' box checked!

 

[IFRIT]

Bit of a fail Android bashing thread TBH.

 

[flyinmac]

I would rather have malware out there than be locked into a walled garden.

Are you guys against freedom in real life too? There would be less crime if the government controlled our lives more. Freedom isn't perfect but it's better than censorship and what is essentially a dictatorship.

We could apply the walled garden to our daily lives...

Everybody pays $100 a month to live in a jail cell. We each get our own cell. We all only eat what we're given. And we only interact with the people the warden has allowed to come into our cells. And we only watch shows permitted by the warden.

If we want any decorations, the warden must approve of them first.

We will have a peaceful life, no crime, no negative influences, and only want for..... Everything.

 

[Tsepz]

Android malware from Chinese ad firm infects 10 million devices



Walled-Graden doesn't seem so bad sometimes.

OT but on a semi-related note, Android Studio is the worst IDE ever created.

Oh look, another piece of Malware that requires turning Off a Security feature to be installed.

Lol, love these articles, as they always leave out that part.

Thanks!

 

[Surf Donkey]

Oh look, another piece of Malware that requires turning Off a Security feature to be installed.

Lol, love these articles, as they always leave out that part.

Thanks!

What security feature is that in this case?

 

[Tsepz]

What security feature is that in this case?

Allowing Install from Unknown Sources, as well as turning Off both the Verify Apps options.

 

[decafjava]

I would rather have malware out there than be locked into a walled garden.

Are you guys against freedom in real life too? There would be less crime if the government controlled our lives more. Freedom isn't perfect but it's better than censorship and what is essentially a dictatorship.

I wish people would stop comparing real life to what ecosystems we like to play in.

 

[Surf Donkey]

Allowing Install from Unknown Sources, as well as turning Off both the Verify Apps options.

I have read the report again (I love this stuff):
http://blog.checkpoint.com/wp-content/uploads/2016/07/HummingBad-Research-report_FINAL-62916.pdf

And I think you might be right actually. I thought it was coming in with a "system update" pop-up via a browser or other back door in KK or JB to gain root permissions, but it is a bit vague there. Anyway, yes, keep those on an you are very well likely going to be safe.

 

[gotluck]

I wish people would stop comparing real life to what ecosystems we like to play in.

As electronic devices become more and more prevalent, ecosystems are a great part of our real lives.

 

[Fanaticalism]

I have read the report again (I love this stuff):
http://blog.checkpoint.com/wp-content/uploads/2016/07/HummingBad-Research-report_FINAL-62916.pdf

And I think you might be right actually. I thought it was coming in with a "system update" pop-up via a browser or other back door in KK or JB to gain root permissions, but it is a bit vague there. Anyway, yes, keep those on an you are very well likely going to be safe.

Only problem is, there is no play store in China so "allow unknown sources" has to be checked or they can't install any apps.

This is not an Android issue per se but an Asian market one.

 

[flyinmac]

Only problem is, there is no play store in China so "allow unknown sources" has to be checked or they can't install any apps.

This is not an Android issue per se but an Asian market one.

The correct story line should be "China's government rules cause phones to be infected by malware".

Not that it's really any different from just using the Internet in China.