Android may be the most widely-used mobile operating system and the most famous. But another day, another instance of malware found on the operating system by Google.
According to researchers at Kaspersky Lab, they found an app with more than 100 million downloads that has an embedded malware module capable of pushing intrusive ads, or download more apps surreptitiously onto the compromised Android devices.
The malicious component was found by the researchers after they were alerted to ‘suspicious behavior’ in the free version of CamScanner, the popular document scanning app, following a series of negative reviews left by users on Google Play Store.
The researchers said on Kaspersky's blog post:
According to Kaspersky, the module is identified as Trojan-Dropper.AndroidOS.Necro.n, which is essentially a trojan dropper, previously found pre-installed on some smartphones in China.
In other words, the malware when installed, can extract and run a second malicious component encrypted within the app. Utilizing this malicious behavior, this trojan downloaded can be used to infect devices by downloading even more malware.
The researchers said that when CamScanner is first opened, the dropper will decrypt and execute malicious code contained in a mutter.zip file within the app, before downloading more encrypted code from a command-and-control server, at https://abc.abcdserver.com.
"The above-described Trojan-Dropper.AndroidOS.Necro.n functions carry out the main task of the malware: to download and launch a payload from malicious servers," the researchers said. "As a result, the owners of the module can use an infected device to their benefit in any way they see fit, from showing the victim intrusive advertising to stealing money from their mobile account by charging paid subscriptions."
After the researchers reported their findings to Google, the CamScanner app was promptly removed from Google Play.
However, the app has later been reinstated after its developers said that they've removed the malicious code in an update. The researchers urge users to "Keep in mind, though, that versions of the app vary for different devices, and some of them may still contain malicious code."
This incident marks more than a few times that Google Play Store was found plagued with app-ridden malware.
While it's certainly difficult for even Google to police everything in its platform, bad actors have found many ways to hide their malicious intentions by obfuscating malicious code behind encryption barriers. This makes it difficult for Google to understand what the code is for, allowing it to easily pass Google’s app vetting process.
Although the Mountain View behemoth has efforts in place, including the Google Play Protect, which has removed hundreds of thousands of harmful apps, the security layers have shown to be not that effective and foolproof.
For end users, they are advised to always stick to Play Store as it should be the safest app store.
But still, they need to always check for app permissions, reviews, and only download apps that are absolutely needed for their needs, only from known developers.
