Link to publishers apps here. I just randomly stumbled into one of the apps, recognized it and noticed that the publisher wasn't who it was supposed to be.
Super Guitar Solo for example is originally Guitar Solo Lite. I downloaded two of the apps and extracted the APK's, they both contain what seems to be the "rageagainstthecage" root exploit - binary contains string "CVE-2010-EASY Android local root exploit (C) 2010 by 743C". Don't know what the apps actually do, but can't be good.
I appreciate being able to publish an update to an app and the update going live instantly, but this is a bit scary. Some sort of moderation, or at least quicker reaction to malware complaints would be nice.
After some dexing and jaxing (where did I get these terms..) decompiling the code (with dex2jar and JD-GUI), the apps seem to be at least posting the IMEI and IMSI codes to http://184.105.245.17:8080/GMServer/GMServlet, which seems to be located in Fremont, CA.
The apps are also installing another embedded app (hidden as assets/sqlite.db), "DownloadProvidersManager.apk". Not sure what it does yet on top of monitoring what apps the user installs.
According to Android Police's analysis, the installed app can download and install more code.
Note, that Google has apparently started pulling at least some of the apps.
EDIT: The developer account and the apps have been removed from the market, and the links to the apps above do not work anymore. The app details are still available at Appbrain, also check this and this on Android Police, and this post by Lookout Mobile Security for a list of additional malicious apps they found on the market. Also I'd like to give credit to the devs at Teazel for helping in identifying the exploit yesterday.
EDIT2: According to Lookout Mobile Security these malicious apps were published on two additional dev accounts on top of the one I originally spotted. Appbrain links: Myournet, Kingmall2010 and we20090202. Kingmall2010's account seems to be the oldest of the bunch, according to Appbrain it started publishing around Feb 11th (so older than the four days). The other two around Feb 23rd.
Looking at the download counts for all three accounts on Appbrain. They're lagging behind the real counts, as they don't update daily, so when the Market's real download counts for Myournet on tuesday totalled at 50k-200k, Appbrain is only totalling to 10k to 35k. Even so, adding Kingmall2010's download counts from Appbrain (48k to 224k) to those I nabbed from myournet's account on Market yesterday brings the total downloads to 98k to 424k. And that estimate is probably on the low side.
Symantec on recognizing if you're infected: "If users feel that they may have installed one of these apps, they should also check com.android.providers.downloadsmanager (DownloadManageService) in the “running services“ settings of the phone"
Read more here http://www.reddit.com/r/netsec/top/?sort=top&t=all
Bom proveito.
Nenhum comentário:
Postar um comentário