Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Judy Malware: Possibly the largest malware campaign found on Google Play

blog.checkpoint.com

Post reply on HN
Print view View original

21–30 of 85 posts

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#21

Post by Cyph0n »

openasocket wrote: post #20
Cyph0n wrote: post #7

Earlier quoted context omitted.

This is the kind of malware that is difficult to block imo. As long as the auto clicking is done at a suitable interval, there really is no easy way to detect it. The question is: would such an attack work on Apple devices? I'm assuming that the iOS API provides similar functionality to apps running on the device.

You don't need to detect it as it's going on, it should be a part of the approval process for getting the app accepting into the Play store. Apps should undergo regular static and dynamic analysis. And probably some improvements to Bouncer

Static analysis likely will not detect this type of malware as the malicious payload is only retrieved once the app is running. As for dynamic analysis, it's usually pretty easy to evade for a capable malware author. The only surefire way to catch this is to have someone manually analyze the app.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#22

Post by bobsam »

ge96 wrote: post #11
bluetwo wrote: post #8

Earlier quoted context omitted.

Maybe the Apple "walled garden" keeps the animals from eating your fruit.

Partly related to ads I heard of something with Apple, somebody was able to change the checksum or something to an Apple app before it was submitted to a store and all the ad revenue went to that person. It was on a podcast I heard a few month(s) ago.

That happens on a daily basis, on both stores.

There is no way either company can manually inspect billion+ apps plus their updates. So they are putting AI in charge which people seem to ba able to fool once in a while.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#23

Post by openasocket »

Cyph0n wrote: post #21
openasocket wrote: post #20

Earlier quoted context omitted.

You don't need to detect it as it's going on, it should be a part of the approval process for getting the app accepting into the Play store. Apps should undergo regular static and dynamic analysis. And probably some improvements to Bouncer

Static analysis likely will not detect this type of malware as the malicious payload is only retrieved once the app is running. As for dynamic analysis, it's usually pretty easy to evade for a capable malware author. The only surefire way to catch this is to have someone manually analyze the app.

Dynamic analysis isn't perfect by any means, but I expect Google to at least try, to get the low hanging fruit. As the OP said: "at least make them work a little." Do we know if this malware had sandbox detection techniques?

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#24

Post by freeflight »

problems wrote: post #10
samdung wrote: post #2

Android is the new Windows. Expecting some downvotes. But truth must be told. You're welcome.

Not really the truth - Android apps are all sandboxed and have relatively little access. In fact the only thing this oh-so-evil malware did was generate fake Google Ad clicks. Not really an offense against its users at all and it can be trivially uninstalled. I certainly wouldn't compare that to ransomware, DDoS botnets, search hijackers, etc that deeply nest themselves in your system and resist uninstallation so muc…

>I certainly wouldn't compare that to ransomware, DDoS botnets, search hijackers, etc that deeply nest themselves in your system and resist uninstallation so much that reinstalling the OS is often the suggested recovery option.

Lot's of adware can be equally sticky because it keeps on loading new crap on the system if you just miss it in one place. Tbh the worst disaster system I've seen usually involved adware, sure it's not a total data loss but I'd guess it's far more widespread than ransomware.

And I'd consider any behavior, that's not approved by the user, as an offense against the user. After all, this stuff is taking up resources that otherwise wouldn't be used (traffic, memory, CPU cycles and as such battery)

I also consider having random ads pop up, with no way around them except clicking them, pretty offensive behavior towards the user.

This stuff might, for now, be rather easy to uninstall but nobody can guarantee that won't change in the future and infected phones end up in a similar bad state like Windows systems with sticky adware infections.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#25

Post by openasocket »

mtgx wrote: post #4

This is why no matter how much Google brags about its machine learning-powered anti-malware protection, it can't rely solely on it to defend Android users, because it's still a cat and mouse game with sophisticated attackers. They need to find a way to patch all devices in a timely manner.

This isn't really an issue with a vulnerability, AFAICT. The App is basically just automatically clicking ads in the background. I'm not sure there's an easy way to prevent this from happening at the end user level, except by static and dynamic analysis on the part of Google to keep the Play store free of malicious Apps.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#26

Post by bobsam »

yeukhon wrote: post #17
problems wrote: post #14

This isn't really malware in the traditional sense, it doesn't damage users of the app itself or harvest information from them, this is simply ad fraud, it only damages Google and its advertisers. It seems to me like CheckPoint is fishing for internet points with this title.

Well malware has many categories and one is adware.

If I read the article correct it downloads JavaScript code to load ad pages.

It never bypassed the sandbox. I don't think you can call this malware

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#27

Post by bobsam »

H1Supreme wrote: post #12
michaelbuckbee wrote: post #5

I'm curious if anyone has a sense for how much they made from this? I just don't have a good sense for scale and dimensions of this. If it went undetected for so long they must not have been at least somewhat conservative in their approach, so say 5mil DAU times 1 click a day at $0.25/click. So, million-ish dollars a day?

So, this was an ad-referral click of some sort (article doesn't say)? AdWord clicks generate revenue for Google, not advertisers.

FTA:

Upon clicking the ads, the malware author receives payment from the website developer, which pays for the illegitimate clicks and traffic

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#28

Post by bobsam »

Cyph0n wrote: post #19
eridius wrote: post #16

Earlier quoted context omitted.

It would make sense to target both.

Who's to say they haven't already?

From the article: "The company develops mobile apps for both Android and iOS platform"

The apps are probably removed from both stores by now so we will never know ;)

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#29

Post by NikolaeVarius »

openasocket wrote: post #23
Cyph0n wrote: post #21

Earlier quoted context omitted.

Static analysis likely will not detect this type of malware as the malicious payload is only retrieved once the app is running. As for dynamic analysis, it's usually pretty easy to evade for a capable malware author. The only surefire way to catch this is to have someone manually analyze the app.

Dynamic analysis isn't perfect by any means, but I expect Google to at least try, to get the low hanging fruit. As the OP said: "at least make them work a little." Do we know if this malware had sandbox detection techniques?

Why do you assume Google doesn't try?

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#30

Post by openasocket »

bobsam wrote: post #26
yeukhon wrote: post #17

Earlier quoted context omitted.

Well malware has many categories and one is adware.

If I read the article correct it downloads JavaScript code to load ad pages. It never bypassed the sandbox. I don't think you can call this malware

I work in the security space, and I would definitely consider this malware. Generally, any software used with a malicious purpose is considered malware. As an example, keyloggers generally aren't exploiting any vulnerability (though malware often uses a vulnerability to install the keylogger in the first place), they're using the standard functionality of the computer as intended, but with malicious intent, and so keyloggers are considered malware. It's not breaking out of the sandbox, but it turns out the sandbox is a pretty big place with a lot of room to do what it wants, so why bother trying to break out?
Post reply on HN