Researchers found QR readers with embedded malware on Google Play
Malware analysts from SophosLabs have discovered an Android virus[1] strain which resides in deceptive OR reading utilities. Currently, antivirus programs detect the thread under the name of Andr/HiddnAd-AJ which refers to the ad-supported application or also known as adware.
The malware was designed to deliver never-ending ads after the installation of the infected app. According to the researchers, this malicious program would open random tabs with ads, send links or display notifications with advertising content continuously.
The experts have identified six QR code scanning applications and one supposedly called “Smart Compass.” Even though the analysts have reported Google Play about the malicious programs, more than 500 000 users had downloaded them before they were taken down[2].
Malware circumvented Google's security by making its code look regular
During the analysis, researchers found out that hackers have used sophisticated techniques to help the malicious program surpass verification by Play Protect. The script of the malware was designed to look like an innocent Android programming library by adding deceptive graphics subcomponent[3]:
Third, the adware part of each app was embedded in what looks at first sight like a standard Android programming library that was itself embedded in the app.
By adding an innocent-looking “graphics” subcomponent to a collection of programming routines that you’d expect to find in a regular Android program, the adware engine inside the app is effectively hiding in plain sight.
Additionally, crooks programmed the malicious QR code applications to hide their ad-supported features for a couple of hours in order not to raise any concerns by the users[4]. The main goal of the malware's authors is to lure the users into clicking on the advertisements and generating pay-per-click revenue[5].
Hackers can administer the behavior of adware remotely
During the research, IT experts managed to summarize the steps taken by the malware once it settles on the system. Surprisingly, it connects to the remote server which is controlled by the criminals right after the installation and asks for the tasks that should be completed.
Likewise, hackers send the malware a list of ads URLs, Google Ad Unit ID, and notification texts which should be displayed on the targeted smartphone. It gives the access to the criminals to control what ads they want to push through the ad-supported application for the victims and how aggressively it should be done.
- ^ Jake Doevan. Android virus. How to remove? (Uninstall guide). 2Spyware. Security and Spyware News.
- ^ Christian de Looper. 500,000 people downloaded QR code apps with embedded malware from Google Play. Digital Trends. Technology News and Product Reviews.
- ^ Paul Ducklin. Crooks infiltrate Google Play with malware in QR reading utilities. Naked Security. Computer Security News, Advice and Research.
- ^ Jon Fingas. Android malware found inside seemingly innocent QR code apps. Engadget. Technology News.
- ^ Scott Adam Gordman. Android malware hidden in QR code apps infects 1 million users. Android Authority. News.