#แจ้งเตือน #
"The clicker" Zombie malware
หรือ Trojan porn clicker
**************************************************************
"The clicker" Zombie malware
หรือ Trojan porn clicker
**************************************************************
“The Clickers” – Zombie Malware that feed on the mobile ecosystem
Authors: Tianfang Guo, Jinjian Zhai; Special Thanks: Steven Chen
Last week, Trustlook exposed the Facebook credential phishing malware
“Cowboy Adventure”. In the article we pointed out that phishing is one
kind of behavior that is difficult to detect via an automated technical
approach. This may be one reason it sneaked by the Google Play Store’s
“Bouncer” automated security check.In this article, we will highlight several examples of Zombie malware on Google Play we very recently uncovered. These are Called – “The “Clickers”.They commit another stealthy kind of malicious behavior, that will likely be overlooked by automated analysis solutions.
“Clicker” is a malware that affects a large part of the mobile ecosystem creating fraud for the vendors, spamming the networks and exploiting the resources of user the community. This form of malware launches requests through Advertizing links. “Clickers” generate costly, false user traffic for advertisers, while draining the user’s battery life and consuming their monthly data plan bandwidth allowances. Everyone loses when a “Clicker” is unleashed.
The latest malware we detected is called “Best: Dubsmash”. It has no actual functionality other than a confusing UI. Most users are likely to spend some time to figure out what it does. In the mean time, let’s see what is doing in the background:
Communicate a C&C server. This server will serve the target URL that needs users to click.
According to our test, this URL will give different URLs each time you refresh it. Most of the URLs are porn sites.
Our behavioral analysis shows the Zombie requests are generated by
using invisible webview calls, in a continuous 20s time interval. There
goes the user’s battery life and bandwidth. data plan. Also it will (or
rather should) create events on a properly monitored corporate network.
Just what your SecOps team needs, right? More Spam remediation.
As of Jul 13 PST 2:40PM, this app, as well as 3 similar “clickers” are still alive on Google Play. We already reported this issue to our colleagues at Google Play and will look forward to timely remediation.
ที่มา : blog.trustlook.com
ไม่มีความคิดเห็น:
แสดงความคิดเห็น