Android Attackers Launch Fake App Market

Malicious apps include a fake version of Skype that surreptitiously sends text messages to premium-rate numbers, racking up charges to the user and revenue for the cybercriminals.

Having a difficult time distributing your malicious smartphone apps? Then why not just create an entire fake app store to peddle your wares?
In fact, that appears to be the strategy employed by the creator of myadroidmaklet.net, a third-party app market that purports to offer more than 50 apps for free download, including Adobe Flash Player,
Angry Birds Rio
, Google Maps, Mozilla Firefox, Need for Speed Hot Pursuit, Opera, Skype, and World of Goo. But in fact, all of these apps are really a Trojan app--malware--in disguise.
Microsoft has dubbed the underlying Trojan Android app as SMSFakeSky, and noted that its designed to target Russian-speaking users. It poses as a legitimate application, so when you try to install the Trojan, it may ask you for permissions to run, according to Microsofts
malware analysis
. Notably, the app will request permission to read a users sent and received SMS and MMS messages, to see the users location, have full Internet access capabilities, modify and delete the contents of removable storage, and to gather all information related to phone calls. The app also typically requests permission to download further required software, such as Adobe Flash Player, although even this installation will be just another version of the Trojan app in disguise.
[ Even legit mobile apps can carry risks. See
Free Android Apps Have Privacy Cost
. ]
Android permission requests are
meant to give Android users pause
, prompting them to ask: Is the app that wants full Internet access legitimate, or really malware? But if attackers can trick a user via a
social-engineering attack
into downloading a Skype app that they think is real, then its likely that theyll grant the malicious app whatever permissions it requests. In addition, the number of different
permissions requested
is no giveaway, given the
excessive permissions requested
by many legitimate Android apps.
Once the disguised SMSFakeSky receives those permissions, it executes. When it runs, the Trojan displays a fake progress bar, so as to appear as though it is downloading an app to your mobile device, according to Microsoft. It then displays a URL to a supposed statement of agreement, but you cannot access this link. When you click the Agree button, the Trojan will send multiple SMS messages to premium numbers at your expense.
The malwares use of prompts helps hide what its really doing. The deception behind the UI [user interface] controls is difficult for users to detect. It is likely that the malicious activity would cause mobile charges before the victim notices it, and this creates a large incentive for cybercriminals to continue perpetrating this fraud, said a
blog post
from Methusela Cebrian Ferrer at the Microsoft Malware Protection Center.
SMSFakeSky is far from the first piece of malware designed to make Russian phones
send messages to premium-rate SMS numbers
, thus draining funds from the accounts tied to infected smartphones, and delivering the money to attackers. The prevalence of such malware reflects a lack of legislation holding telecommunications providers accountable for attacks that make use of premium numbers. Indeed, Russia and many other Eastern European countries allow anyone to
anonymously rent a premium-rate number
, and the labyrinthian relationship between telecommunications companies and resellers who can lease such numbers makes tracing even providers of such numbers difficult.
Beyond setting up fake storefronts such as myadroidmaklet.net, another up-and-coming Android scam, according to Microsoft, is the use of paid archives that contain malware. These are less aggressive by nature as they dont infect the system. Instead, they use a more cunning way to trick users into giving them money without using scare tactics--by getting them to pay for software thats otherwise free, or for pirated copies of paid software, according to Microsoft researchers Sergey Chernyshev and Daniel Chipiristeanu. They plan to detail their
research into paid archives
, including the use of automated fake-archive generation tools, as well as a breakdown of how the money is earned and distributed by the bad guys, in September 2012 at the VB2012 conference in Dallas.

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Android Attackers Launch Fake App Market