Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Judy Malware: Possibly the largest malware campaign found on Google Play

blog.checkpoint.com

Post reply on HN
Print view View original

51–60 of 85 posts

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#51

Post by ry_ry »

openasocket wrote: post #25
mtgx wrote: post #4

This is why no matter how much Google brags about its machine learning-powered anti-malware protection, it can't rely solely on it to defend Android users, because it's still a cat and mouse game with sophisticated attackers. They need to find a way to patch all devices in a timely manner.

This isn't really an issue with a vulnerability, AFAICT. The App is basically just automatically clicking ads in the background. I'm not sure there's an easy way to prevent this from happening at the end user level, except by static and dynamic analysis on the part of Google to keep the Play store free of malicious Apps.

It'd be obvious on the ads side though - If this was activated across multiple apps simultaneously, their clickthrough rate would have gone through the roof.

Heck, even if it was dripped out slowly, average % clickthrough - even on mobile where ads get fat fingered more often - is a tiny fraction of views. They would have been reporting some pretty crazy numbers.

No way in the world this wasn't easily spotted, when clickfraud is already a well known thing and Google are in the business of tracking things to sell more ads.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#52

Post by lallysingh »

ocdtrekkie wrote: post #44
yeukhon wrote: post #18

Earlier quoted context omitted.

Android permission has been critized for many years. Not sure if Google has done anything to address.

They've done a little bit. Newer Android versions support setups where apps request permissions at runtime, instead of just having them all the time in the background. But the permissions are still too wide. Things like giving apps access to all your contacts, as opposed to having the OS only provide one contact, after the user picks it from a list.

There's a tradeoff in usability. I do wish Google (or a phone vendor! add real value!) would let users choose fine-grained or coarse-grained security at the UI level, and let developers just use fine-grained permissions APIs.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#53

Post by wordupmaking »

problems wrote: post #32
openasocket wrote: post #30

Earlier quoted context omitted.

I work in the security space, and I would definitely consider this malware. Generally, any software used with a malicious purpose is considered malware. As an example, keyloggers generally aren't exploiting any vulnerability (though malware often uses a vulnerability to install the keylogger in the first place), they're using the standard functionality of the computer as intended, but with malicious intent, and so ke…

Yeah, technically I can see it as malware, but not really in the same way... keyloggers obviously harm the user in collecting data against them, there's no malicious intent against the user here. This is only a minor increase over the already quite nasty but common mobile advertising practices. In fact, I'd argue the information harvesting most mobile ad networks do is much more harmful than this click fraud. Do we b…

This is not so much a matter of debate as of reading up.

https://en.wikipedia.org/wiki/Malware

> Some malware is used to generate money by click fraud, making it appear that the computer user has clicked an advertising link on a site, generating a payment from the advertiser. It was estimated in 2012 that about 60 to 70% of all active malware used some kind of click fraud, and 22% of all ad-clicks were fraudulent

If you want to coin a new term feel free, but malware means what it means and refers to malicious, not "more malicious than", not "malicious against the user" etc.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#54

Post by openasocket »

cortesoft wrote: post #41
wnevets wrote: post #35

Earlier quoted context omitted.

>there's no malicious intent against the user here Eating up their battery/resources running hidden code that pretends to be them is kinda malicious. I also count hidden bitcoin miners as malicious.

Isn't that all ads, then? I mean, as an end user, which is more harmful to you - downloading a bunch of ads and filling your screen with them, or downloading a bunch of ads and not displaying them? You are going to use more battery and resources actually displaying the ads, not to mention the worse user experience. If I had to pick between the two, I would prefer 'download and don't display' over 'download and displa…

Ads don't have malicious intent (usually). You may not like them, but displaying ads doesn't cause you harm. You could argue "having to see ads is inconvenient, which is a kind of harm" but just because software is inconvenient or doesn't do exactly what you want doesn't mean it's malicious. In this case, what makes Judy malicious is that it is using your machine to defraud advertisers.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#55

Post by ocdtrekkie »

lallysingh wrote: post #52
ocdtrekkie wrote: post #44

Earlier quoted context omitted.

They've done a little bit. Newer Android versions support setups where apps request permissions at runtime, instead of just having them all the time in the background. But the permissions are still too wide. Things like giving apps access to all your contacts, as opposed to having the OS only provide one contact, after the user picks it from a list.

There's a tradeoff in usability. I do wish Google (or a phone vendor! add real value!) would let users choose fine-grained or coarse-grained security at the UI level, and let developers just use fine-grained permissions APIs.

There really isn't a tradeoff.

Bad security: App requests all your contacts and shows you a list of people you can invite to play Candy Crush. The user clicks one, but the app already has access to all of them.

Good security: App requests a contact and the OS shows you a list of people you can invite to play Candy Crush. The user clicks one and the OS gives that contact info to the app.

The user experience is quite similar, but the security design is far better.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#56

Post by tyingq »

smilliken wrote: post #31

It looks like the common component across the apps mentioned is in the "net.shinhwa21.jsylibrary" namespace. I made a list of the apps with that namespace, preview here: https://mixrank.com/playstore/apps?expiration=2017-06-30&lis... This list is a few times bigger than the ones mentioned in the article (been crawling for a long time, and try to be complete). If there's any security folks here that want access to the…

Nice work. Odd that you would be ahead of Google though. They pulled only the apps mentioned in the article so far.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#57

Post by astrodust »

problems wrote: post #14

This isn't really malware in the traditional sense, it doesn't damage users of the app itself or harvest information from them, this is simply ad fraud, it only damages Google and its advertisers. It seems to me like CheckPoint is fishing for internet points with this title.

It's malware in the traditional sense: "Programs that do things you wouldn't expect or authorize them to do that are harmful either to yourself or to others."

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#58

Post by yeukhon »

openasocket wrote: post #50
bobsam wrote: post #37

Earlier quoted context omitted.

> keyloggers generally aren't exploiting any vulnerability That's a very odd definition you have. Rest assured, nobody is saying this kind of apps are acceptable. But calling them malware is not right when they technically don't use more than they been given access to (network + some cpu time)?

Which part is odd? You can use standard APIs like GetAsyncKeyState() or various utilities for screen scraping and reading the paste buffer to make a key logger, no vulnerabilities required. We still consider such a thing malware of course. The point is exploiting vulnerabilities is not a necessary condition for something to be considered malware.

He's probably referring to injecting/deploying the keylogger in the first place. Either it came with a malicious software, via a system exploit, or someone installed it having physical access.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#59

Post by rhizome »

bobsam wrote: post #26
yeukhon wrote: post #17

Earlier quoted context omitted.

Well malware has many categories and one is adware.

If I read the article correct it downloads JavaScript code to load ad pages. It never bypassed the sandbox. I don't think you can call this malware

A sandbox bypass would be an exploit, much more severe than malware.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#60

Post by rhizome »

problems wrote: post #32
openasocket wrote: post #30

Earlier quoted context omitted.

I work in the security space, and I would definitely consider this malware. Generally, any software used with a malicious purpose is considered malware. As an example, keyloggers generally aren't exploiting any vulnerability (though malware often uses a vulnerability to install the keylogger in the first place), they're using the standard functionality of the computer as intended, but with malicious intent, and so ke…

Yeah, technically I can see it as malware, but not really in the same way... keyloggers obviously harm the user in collecting data against them, there's no malicious intent against the user here. This is only a minor increase over the already quite nasty but common mobile advertising practices. In fact, I'd argue the information harvesting most mobile ad networks do is much more harmful than this click fraud. Do we b…

Adjust your sense of "technically," the original malware was shit like Hotbar and Comet Cursor. Trying to change the topic to "everybody who tracks anything" isn't helpful.
Post reply on HN