Researchers at Trend Micro discovered that 85 Android apps were adware posing as legitimate software.

Disguised as photo-editing apps and games, the adware apps have been caught delivering adware, thus enabling them to monetise affected devices while attempting to be “innocuous”.

The adware apps display advertisement that are difficult to close as well as employing techniques to evade detection through user behaviour and time-based triggers.

The adware apps include Magic Camera: Make Magical Photos, Blur Photo Editor, Background Replacement, Find the difference: smart detective, and Color House2019. All of which are been downloaded more than eight million times.

Once the app is launched, it records two timestamps; the current time and the network time. The timestamps are retrieved by “abusing a publicly available and legitimate RESTful application programming interface (API), then stored as ‘networkInstallTime’.”

Afterwards, it registers a Broadcast Receiver which helps monitor if the user is present after the affected device is woken up.

Every time the device is unlocked, the adware will conduct several checks before it executes the routines.

“With these, the adware-embedded app can determine if it has been installed on the device long enough, with the default delay time configured to 30 minutes. To a certain extent, using network time can evade time-based detection techniques or triggers employed by traditional sandboxes, as the app’s time settings can be configured by simply using networkInstallTime,” wrote Trend Micro.

“If the app has determined that it has been installed for more than 30 minutes, the app will then hide its icon and create a shortcut on the device’s home screen.”

By hiding its icon it will prevent easy uninstallation. As a result, adverts are then displayed whenever the device is unlocked. Each advert is displayed in a fullscreen mode – thus forcing users to watch the entire advert before exiting the screen.

Google removed all of the apps after Trend Micro disclosed its findings.

PrivSec Conferences will bring together leading speakers and experts from privacy and security to deliver compelling content via solo presentations, panel discussions, debates, roundtables and workshops.
For more information on upcoming events, visit the website.

comments powered by Disqus