Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Judy Malware: Possibly the largest malware campaign found on Google Play

blog.checkpoint.com

Post reply on HN
Print view View original

41–50 of 85 posts

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#41

Post by cortesoft »

wnevets wrote: post #35
problems wrote: post #32

Earlier quoted context omitted.

Yeah, technically I can see it as malware, but not really in the same way... keyloggers obviously harm the user in collecting data against them, there's no malicious intent against the user here. This is only a minor increase over the already quite nasty but common mobile advertising practices. In fact, I'd argue the information harvesting most mobile ad networks do is much more harmful than this click fraud. Do we b…

>there's no malicious intent against the user here Eating up their battery/resources running hidden code that pretends to be them is kinda malicious. I also count hidden bitcoin miners as malicious.

Isn't that all ads, then? I mean, as an end user, which is more harmful to you - downloading a bunch of ads and filling your screen with them, or downloading a bunch of ads and not displaying them?

You are going to use more battery and resources actually displaying the ads, not to mention the worse user experience. If I had to pick between the two, I would prefer 'download and don't display' over 'download and display'

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#42

Post by yeukhon »

problems wrote: post #36
wnevets wrote: post #35

Earlier quoted context omitted.

>there's no malicious intent against the user here Eating up their battery/resources running hidden code that pretends to be them is kinda malicious. I also count hidden bitcoin miners as malicious.

For sure, but any extra battery and resource consumption here would be extremely minor compared to a bitcoin miner. Many apps do various forms of push advertising and background reporting which does quite similar things, do you consider that to be malware too? Ultimately the only difference here is that this one abuses Google and their advertisers instead of the user, which seems to be an accepted and common advertis…

What if this is a self-modifying code? Now instead of clicking ad now DoDDS? Malicious is basically bad intent. This is an unauthorized activity so it is malicious.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#43

Post by problems »

yeukhon wrote: post #42
problems wrote: post #36

Earlier quoted context omitted.

For sure, but any extra battery and resource consumption here would be extremely minor compared to a bitcoin miner. Many apps do various forms of push advertising and background reporting which does quite similar things, do you consider that to be malware too? Ultimately the only difference here is that this one abuses Google and their advertisers instead of the user, which seems to be an accepted and common advertis…

What if this is a self-modifying code? Now instead of clicking ad now DoDDS? Malicious is basically bad intent. This is an unauthorized activity so it is malicious.

It's not self-modifying code, it's looking specifically for google.com frames, see the source in the link. This is hardly worse intent than any other mobile ad these days.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#44

Post by ocdtrekkie »

yeukhon wrote: post #18
samdung wrote: post #2

Android is the new Windows. Expecting some downvotes. But truth must be told. You're welcome.

Android permission has been critized for many years. Not sure if Google has done anything to address.

They've done a little bit. Newer Android versions support setups where apps request permissions at runtime, instead of just having them all the time in the background.

But the permissions are still too wide. Things like giving apps access to all your contacts, as opposed to having the OS only provide one contact, after the user picks it from a list.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#45

Post by openasocket »

NikolaeVarius wrote: post #29
openasocket wrote: post #23

Earlier quoted context omitted.

Dynamic analysis isn't perfect by any means, but I expect Google to at least try, to get the low hanging fruit. As the OP said: "at least make them work a little." Do we know if this malware had sandbox detection techniques?

Why do you assume Google doesn't try?

Technically, I said "I expect Google to at least try," which is just stating my expectations rather than stating anything about whether Google met my expectations ;)

But seriously, that's a fair point, my statement implied an unsourced assumption. I think Google tries to some extent, but I can't find anything saying Judy had anti-analysis capabilities, which makes me suspicious as to the effectiveness of Google's dynamic analysis of Play Apps.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#46

Post by elliottcarlson »

"Some of the apps we discovered resided on Google Play for several years, but all were recently updated. It is unclear how long the malicious code existed inside the apps, hence the actual spread of the malware remains unknown."

If these apps were indeed popular, I would imagine the historical APK's are available for the various versions on pirate sites. Simply performing a Google search for "Fashion Judy: Snow Queen style apk" shows downloads for different versions of it. This can give a better idea of the length of infection.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#47

Post by chickenbane »

samdung wrote: post #2

Android is the new Windows. Expecting some downvotes. But truth must be told. You're welcome.

At Google IO they just announced Android has 2B active devices, which makes it easily the largest platform today, must larger than Windows ever was. If you remember the bad days of ILOVEYOU or SqlSlammer, I think Android is much safer. Or compare this Judy with WannaCry. Don't believe the hype. You're welcome.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#48

Post by dafrankenstein2 »

openasocket wrote: post #30
bobsam wrote: post #26

Earlier quoted context omitted.

If I read the article correct it downloads JavaScript code to load ad pages. It never bypassed the sandbox. I don't think you can call this malware

I work in the security space, and I would definitely consider this malware. Generally, any software used with a malicious purpose is considered malware. As an example, keyloggers generally aren't exploiting any vulnerability (though malware often uses a vulnerability to install the keylogger in the first place), they're using the standard functionality of the computer as intended, but with malicious intent, and so ke…

agree

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#49

Post by bitmapbrother »

samdung wrote: post #2

Android is the new Windows. Expecting some downvotes. But truth must be told. You're welcome.

No, nothing can ever wash off the stank and damage done by Windows. When Android starts shutting down hospitals, holding companies for ransom, crippling foreign centrifuges then we can have this conversation. Until then we're just waiting for the next Windows armageddon.

Re: The Judy Malware: Possibly the largest malware campaign found on Google Play

#50

Post by openasocket »

bobsam wrote: post #37
openasocket wrote: post #30

Earlier quoted context omitted.

I work in the security space, and I would definitely consider this malware. Generally, any software used with a malicious purpose is considered malware. As an example, keyloggers generally aren't exploiting any vulnerability (though malware often uses a vulnerability to install the keylogger in the first place), they're using the standard functionality of the computer as intended, but with malicious intent, and so ke…

> keyloggers generally aren't exploiting any vulnerability That's a very odd definition you have. Rest assured, nobody is saying this kind of apps are acceptable. But calling them malware is not right when they technically don't use more than they been given access to (network + some cpu time)?

Which part is odd? You can use standard APIs like GetAsyncKeyState() or various utilities for screen scraping and reading the paste buffer to make a key logger, no vulnerabilities required. We still consider such a thing malware of course. The point is exploiting vulnerabilities is not a necessary condition for something to be considered malware.
Post reply on HN