https://krebsonsecurity.com/2023/08/how-malicious-android-apps-slip-into-disguise/ Advertisement Advertisement Krebs on Security Skip to content * Home * About the Author * Advertising/Speaking How Malicious Android Apps Slip Into Disguise August 3, 2023 4 Comments [grandroidude] Researchers say mobile malware purveyors have been abusing a bug in the Google Android platform that lets them sneak malicious code into mobile apps and evade security scanning tools. Google says it has updated its app malware detection mechanisms in response to the new research. At issue is a mobile malware obfuscation method identified by researchers at ThreatFabric, a security firm based in Amsterdam. Aleksandr Eremin, a senior malware analyst at the company, told KrebsOnSecurity they recently encountered a number of mobile banking trojans abusing a bug present in all Android OS versions that involves corrupting components of an app so that its new evil bits will be ignored as invalid by popular mobile security scanning tools, while the app as a whole gets accepted as valid by Android OS and successfully installed. "There is malware that is patching the .apk file [the app installation file], so that the platform is still treating it as valid and runs all the malicious actions it's designed to do, while at the same time a lot of tools designed to unpack and decompile these apps fail to process the code," Eremin explained. Eremin said ThreatFabric has seen this malware obfuscation method used a few times in the past, but in April 2023 it started finding many more variants of known mobile malware families leveraging it for stealth. The company has since attributed this increase to a semi-automated malware-as-a-service offering in the cybercrime underground that will obfuscate or "crypt" malicious mobile apps for a fee. Eremin said Google flagged their initial May 9, 2023 report as "high" severity. More recently, Google awarded them a $5,000 bug bounty, even though it did not technically classify their finding as a security vulnerability. "This was a unique situation in which the reported issue was not classified as a vulnerability and did not impact the Android Open Source Project (AOSP), but did result in an update to our malware detection mechanisms for apps that might try to abuse this issue," Google said in a written statement. Google also acknowledged that some of the tools it makes available to developers -- including APK Analyzer -- currently fail to parse such malicious applications and treat them as invalid, while still allowing them to be installed on user devices. "We are investigating possible fixes for developer tools and plan to update our documentation accordingly," Google's statement continued. [tf-apk] Image: ThreatFabric. According to ThreatFabric, there are a few telltale signs that app analyzers can look for that may indicate a malicious app is abusing the weakness to masquerade as benign. For starters, they found that apps modified in this way have Android Manifest files that contain newer timestamps than the rest of the files in the software package. More critically, the Manifest file itself will be changed so that the number of "strings" -- plain text in the code, such as comments -- specified as present in the app does match the actual number of strings in the software. One of the mobile malware families known to be abusing this obfuscation method has been dubbed Anatsa, which is a sophisticated Android-based banking trojan that typically is disguised as a harmless application for managing files. Last month, ThreatFabric detailed how the crooks behind Anatsa will purchase older, abandoned file managing apps, or create their own and let the apps build up a considerable user base before updating them with malicious components. ThreatFabric says Anatsa poses as PDF viewers and other file managing applications because these types of apps already have advanced permissions to remove or modify other files on the host device. The company estimates the people behind Anatsa have delivered more than 30,000 installations of their banking trojan via ongoing Google Play Store malware campaigns. Google has come under fire in recent months for failing to more proactively police its Play Store for malicious apps, or for once-legitimate applications that later go rogue. This May 2023 story from Ars Technica about a formerly benign screen recording app that turned malicious after garnering 50,000 users notes that Google doesn't comment when malware is discovered on its platform, beyond thanking the outside researchers who found it and saying the company removes malware as soon as it learns of it. "The company has never explained what causes its own researchers and automated scanning process to miss malicious apps discovered by outsiders," Ars' Dan Goodin wrote. "Google has also been reluctant to actively notify Play users once it learns they were infected by apps promoted and made available by its own service." The Ars story mentions one potentially positive change by Google of late: A preventive measure available in Android versions 11 and higher that implements "app hibernation," which puts apps that have been dormant into a hibernation state that removes their previously granted runtime permissions. This entry was posted on Thursday 3rd of August 2023 07:22 AM A Little Sunshine The Coming Storm Web Fraud 2.0 Aleksandr Eremin Anatsa Android malware Ars Technica Google Play ThreatFabric Post navigation - Russia Sends Cybersecurity CEO to Jail for 14 Years 4 thoughts on "How Malicious Android Apps Slip Into Disguise" 1. Steven Hebert August 3, 2023 Are there any recommendations for current Android users? Was this bug patched in the July security update? I just checked my Android and was still on the June 2023 security update and July 2023 was available. Reply - 1. Tim Cook August 3, 2023 Buy an iPhone. Reply - 2. DJ Molny August 3, 2023 Thanks for the report! How can Android owners check their devices to see if they're affected? Reply - 3. Mahhn August 3, 2023 Goog play store has been the most prolific spreader of malware by volume than any other single source for so many years. Although they Require an Email to download apps, they never send notices to people that an app they downloaded from goog was malicious, nor provide advice on remediation. I am very surprised there hasn't been a class action suit filed against them for negligence. Bluntly it's the main reason to avoid android, (second is their own spying). Reply - Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment * [ ] Name * [ ] Email * [ ] Website [ ] [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] Advertisement [20] Advertisement Mailing List Subscribe here Search KrebsOnSecurity Search for: [ ] [Search] Recent Posts * How Malicious Android Apps Slip Into Disguise * Russia Sends Cybersecurity CEO to Jail for 14 Years * Who and What is Behind the Malware Proxy Service SocksEscort? * Few Fortune 100 Firms List Security Pros in Their Executive Ranks * LeakedSource Owner Quit Ashley Madison a Month Before 2015 Hack Spam Nation Spam Nation A New York Times Bestseller! Thinking of a Cybersecurity Career? Thinking of a Cybersecurity Career? Read this. All About Skimmers All About Skimmers Click image for my skimmer series. Story Categories * A Little Sunshine * All About Skimmers * Ashley Madison breach * Breadcrumbs * Data Breaches * DDoS-for-Hire * Employment Fraud * How to Break Into Security * Internet of Things (IoT) * Latest Warnings * Ne'er-Do-Well News * Other * Pharma Wars * Ransomware * Russia's War on Ukraine * Security Tools * SIM Swapping * Spam Nation * Target: Small Businesses * Tax Refund Fraud * The Coming Storm * Time to Patch * Web Fraud 2.0 The Value of a Hacked PC valuehackedpc Badguy uses for your PC Badguy Uses for Your Email Badguy Uses for Your Email Your email account may be worth far more than you imagine. Donate to Krebs On Security Most Popular Posts * Sextortion Scam Uses Recipient's Hacked Passwords (1076) * Online Cheating Site AshleyMadison Hacked (798) * Sources: Target Investigating Data Breach (620) * Trump Fires Security Chief Christopher Krebs (534) * Why Paper Receipts are Money at the Drive-Thru (530) * Cards Stolen in Target Breach Flood Underground Markets (445) * Reports: Liberty Reserve Founder Arrested, Site Shuttered (416) * Was the Ashley Madison Database Leaked? (376) * DDoS-Guard To Forfeit Internet Space Occupied by Parler (374) * True Goodbye: 'Using TrueCrypt Is Not Secure' (363) Why So Many Top Hackers Hail from Russia [computered-580x389] Category: Web Fraud 2.0 Criminnovations Innovations from the Underground [shreddedID-copy-285x189] ID Protection Services Examined Is Antivirus Dead? Is Antivirus Dead? The reasons for its decline The Growing Tax Fraud Menace The Growing Tax Fraud Menace File 'em Before the Bad Guys Can Inside a Carding Shop Inside a Carding Shop A crash course in carding. Beware Social Security Fraud Beware Social Security Fraud Sign up, or Be Signed Up! How Was Your Card Stolen? How Was Your Card Stolen? Finding out is not so easy. Krebs's 3 Rules... Krebs's 3 Rules... ...For Online Safety. (c) Krebs on Security - Mastodon