Malicious app on Google Play drops banking malware on users’ devices

https://blog.pradeo.com/vultur-malware-dropper-google-play

by caaqil • 4 years ago

104 38 4 years ago

blog.pradeo.com

chetangoti• 4 years ago

It was discussed yesterday at https://news.ycombinator.com/item?id=30115132 which has 57 comments.

eMGm4D0zgUAVXc73• 4 years ago

The thread does not seem to answer the most interesting question:

Is it really possible for app developers to leave out permissions in the list of requested permissions on Google Play and then get them nevertheless when the app is actually installed?

See my other reply for a more lengthy description: https://news.ycombinator.com/item?id=30126488

lnxg33k14• 4 years ago

Another question would be: If google gives me an app from their official playstore, on their OS, should they be considered responsible for any loss that it causes to bank accounts, or we have given up accountability for big corps, hope regulators are sleeping well

phh4• 4 years ago

No it's not possible.

Google Play hides some permissions on its own, but very basic one (like the one allowing access to internet). That's it.

The dangerous permissions mentioned in the article need to be manually enabled by the user, after installing the application.

eMGm4D0zgUAVXc73• 4 years ago

I am *very* surprised that the list of requested permissions on Google Play does *not* have to match the actual permissions which the app gets when installed.

I would have thought that the list on Google Play is computed from the binary so it cannot be fake.

Is it really true that you can just leave out permissions in this list and then just get them once people install your app?

spockz• 4 years ago

I expected it to work that what is listed in the marketplace is the design and when signing the app it includes the permissions as mentioned in the marketplace. If the binary requests different permissions they are rejected by the OS without prompting the users.

TrianguloY2• 4 years ago

As far as I know (and I have quite a few apps on google play) the list is compiled from the apk itself. On android you need to specify all permissions in the manifest (a file in the app that describes what the app requires). If you don't and try to use it, the device rejects it. The play store description is a "human version" of the list. Some permissions are grouped and other ignored.

The app from the post had a list of permissions declared in the manifest, and on first look it seem to match what play store shows.

In any case: no, you can't leave out permissions and use them later. If you don't declare them, you can't use them. (At least not by normal means, it is possible with adb and root, and also by installing extra apps).

eMGm4D0zgUAVXc73• 4 years ago

Thanks, but why does the post show two screenshots juxtaposed:

- one labeled as "2FA Authenticator permissions disclosed on Google Play"

- and the other as "2FA Authenticator permissions requested"

They even made "disclosed" and "requested" bold to stress that there'd be a difference, and in fact the former list of permissions is shorter than the latter?

You said that some permissions are "ignored". Is that the explanation?

Where is a list of all Android permissions which are "ignored", i.e. not told to the user when installing apps?

From the screenshots it looks like the permission to install software is part of whats lacking to be disclosed.

That has a rather big security impact, why does Google ignore it?

I can't believe Android is that insecure :(

jeroenhd• 4 years ago

I think it used to be back in the day, but many normal apps use tons of permissions so people skipped over them. Google revamped their UI to only show a select bunch of them at some point. Perhaps in this step they managed to mess up and miss a bunch of permissions that these apps use.

You can't get a permission that's not in your app manifest without root access.

Seeing as the app appears to install apps silently, it probably manages to exploit devices with outdated security to elevate its system permissions. Altering the installed binary and system permission table are probably the easiest way to use the standard Android API to install software in the background, because doing so programmatically is a pain.

bigyellow• 4 years ago

You're telling me a for-profit, closed source, proprietary application store where anyone can submit software and call it anything they want has perverse incentives? I'm shocked. Shocked, I tell you.

superasn• 4 years ago

So many such issues could be easily mitigated if we just moved away from apps to PWAs/Web apps with better support from mobile vendors for the push api, camera, etc - but the powers that be (Apple, Google, Microsoft) and also the sites (Reddit, Amazon, etc) want to move in the opposite direction because who cares about security and users when apps bring in the moolah.

As a matter of fact sometimes the websites are so much better too, like Amazon, which doesn't even have a "Find.." function in the app. I really wish we could done be with these apps and everything just ran in the browser, except maybe apps that need some low level api or something.

mrtksn• 4 years ago

Aren't PWA's vulnerable to browser extension attacks?

antihero• 4 years ago

In order to compete with native apps the APIs would have to grow and thus the attack surface would also grow

secondcoming• 4 years ago

Such issues could be mitigated if Android didn't let it happen. It was pretty much impossible for this to happen with Symbian so there's really no excuse (maybe that's part of the reason it died)

seanw444• 4 years ago

And then there are those of us that hate that everything is made with Electron these days, so I say thank God they're not doing this.

JadeNB• 4 years ago

I thought we edited clickbait-y headlines like this. The name of the malicious app is "2FA Authenticator".

Malicious app on Google Play drops banking malware on users’ devices

Related Stories