//Google Play apps with >4.3 million downloads stole pics and pushed porn ads

Google Play apps with >4.3 million downloads stole pics and pushed porn ads

Screenshots of the pop-up ads displayed by malicious apps that were available in Google's Play Store.
Enlarge
/ Screenshots of the pop-up ads displayed by malicious apps that were available in Google’s Play Store.

Trend Micro

Google has banned dozens of Android apps downloaded millions of times from the official Play Store after researchers discovered they were being used to display phishing and scam ads or perform other malicious acts.

A blog post published by security firm Trend Micro listed 29 camera- or photo-related apps, with the top 11 of them fetching 100,000 to 1 million downloads each. One crop of apps caused browsers to display full-screen ads when users unlocked their devices. Clicking the pop-up ads in some cases caused a paid online pornography player to be downloaded, although it was incapable of playing content. The apps were carefully designed to conceal their malicious capabilities.

“None of these apps give any indication that they are the ones behind the ads, thus users might find it difficult to determine where they’re coming from,” Trend Micro Mobile Threats Analyst Lorin Wu wrote. “Some of these apps redirect to phishing websites that ask the user for personal information, such as addresses and phone numbers.”

The apps also hid their icons from the Android app list. That made it hard for users to uninstall the apps, since there was no icon to drag and delete. The apps also used compression archives known as packers to make it harder for researchers—or presumably, tools Google might use to weed out malicious apps—from analyzing the wares.

Your selfies are ours

Trend Micro researchers discovered another batch of apps that falsely promised to allow users to “beautify” their pictures by uploading them to a designated server. Instead of delivering an edited photo, however, the server provided a picture with a fake update prompt in nine different languages. The apps made it possible for the developers to collect the uploaded photos, possibly for use in fake profile pics or for other malicious purposes. The developers took pains to prevent users from detecting what was happening.

“The remote server used by these apps is encoded with BASE64 twice in the code,” Wu wrote. “In addition, several of these apps can also hide themselves via the same hidden technique mentioned above.”

The apps reported by Trend Micro are:

Indicators of Compromise (IoCs)

Package Label Installs
com.beauty.camera.years.pro Pro Camera Beauty 1,000,000+
com.cartoon.art.photo.ygy.camera Cartoon Art Photo 1,000,000+
com.lyrebirdstudio.emoji_camera Emoji Camera 1,000,000+
art.eff.filter.photo.editor Artistic effect Filter 500,000+
art.filter.editor.imge Art Editor 100,000+
com.beauty.camera.project.cloud Beauty Camera 100,000+
com.selfie.camerapro.pro Selfie Camera Pro 100,000+
com.camera.beauty.kwok.horizon Horizon Beauty Camera 100,000+
com.camera.ygysuper.photograph Super Camera 100,000+
com.effects.art.photo.for.self Art Effects for Photo 100,000+
com.solidblack.awesome.cartoon.art.pics.photo.editor Awesome Cartoon Art 100,000+
com.photoeditor.artfilterphoto Art Filter Photo 50,000+
com.photocorner.artfilter.arteffect.prizma Art Filter Photo Effcts 10,000+
com.picfix.cartoonphotoeffects Cartoon Effect 10,000+
com.picsartitude.arteffect Art Effect 10,000+
com.csmart.photoframelab Photo Editor 5,000+
com.wallpapers.nuclear.hd.hd3d.best.live.nuclear Wallpapers HD 5,000+
com.perfectmakeup.magicartfilter.photoeditor.selfiecamera Magic Art Filter Photo Editor 5,000+
appworld.fillartphotoeditor.technology Fill Art Photo Editor 1,000+
com.artflipphotoediting ArtFlipPhotoEditing 1,000+
com.artphoto.artfilter.artpiczone Art Filter 1,000+
com.photoeditor.cartoonphoto Cartoon Art Photo 1,000+
com.photoeditor.prismaeffects Prizma Photo Effect 1,000+
com.cmds.artphotofiltereffect Cartoon Art Photo Filter 100+
com.latestnewappzone.photoartfiltereditor Art Filter Photo Editor 100+
com.livewallpaperstudio.pixture Pixture 100+
app.pixelworlds.arteffect Art Effect 50+
timepassvideostatus.photoarteffect.cartoonpainteffect Photo Art Effect 10+
com.techbuzz.cartoonfilter Cartoon Photo Filter 5+

The report is the latest to demonstrate that Google can’t be counted on to proactively detect malicious apps available in Play. That puts the onus on end users to carefully scrutinize apps before installing them. One way to do this is to read comments to see if anyone has reported suspicious things, such as receiving pop-up ads, after installing an app. Another important strategy is to limit downloads to those that are truly necessary or useful, and then only when they’re developed by a recognized company. Niche apps that provide little tangible benefit should be avoided.