First Active Attack Exploiting CVE-2019-2215 Found on Google Play, Linked to SideWinder APT Group

  • Posted on:January 6, 2020 at 5:00 am
  • Posted in:Exploits, Mobile
  • Author:
    Trend Micro

We found three malicious apps in the Google Play store that work together to compromise a victim’s device and collect user information. One of these apps, called Camero, exploits CVE-2019-2215, a vulnerability that exists in Binder (the main Inter-Process Communication system in Android). This is the first known active attack in the wild that uses the use-after-free vulnerability.

Read More
Tags: appAPTgoogle play

Mobile Cyberespionage Campaign Distributed Through CallerSpy Mounts Initial Phase of a Targeted Attack

  • Posted on:December 2, 2019 at 5:31 am
  • Posted in:Bad Sites, Mobile
  • Author:
    Ecular Xu (Mobile Threat Response Engineer)

We found a new spyware family disguised as chat apps on a phishing website. We believe that the apps, which exhibit many cyberespionage behaviors, are initially used for a targeted attack campaign. We first came across the threat in May on the site http://gooogle.press/, which was advertising a chat app called “Chatrious.” Users can download the malicious Android application package (APK) file by clicking the download button indicated on the site.

Read More
Tags: androidAPKcyberespionagespyware

Patched GIF Processing Vulnerability CVE-2019-11932 Still Afflicts Multiple Mobile Apps

  • Posted on:November 25, 2019 at 5:00 am
  • Posted in:Mobile, Vulnerabilities
  • Author:
    Trend Micro

CVE-2019-11932, which is a vulnerability in WhatsApp for Android, was first disclosed to the public on October 2, 2019 after a researcher named Awakened discovered that attackers could use maliciously crafted GIF files to allow remote code execution. The vulnerability was patched with version 2.19.244 of WhatsApp, but the underlying problem lies in the library called libpl_droidsonroids_gif.so, which is part of the android-gif-drawable package. While this flaw has also been patched, many applications still use the older version and remain at risk.

Read More
Tags: vulnerabilitywhatsapp

49 Disguised Adware Apps With Optimized Evasion Features Found on Google Play

  • Posted on:November 7, 2019 at 4:52 am
  • Posted in:Mobile
  • Author:
    Trend Micro

We recently found 49 new adware apps on Google Play, disguised as games and stylized cameras. Before they were taken down by Google, the total number of downloads for these apps was more than 3 million. This recent incident continues an ongoing trend of mobile adware surges

Read More
Tags: appsgoogle playmobile adware

Fake Photo Beautification Apps on Google Play can Read SMS Verification Code to Trigger Wireless Application Protocol (WAP)/Carrier Billing

  • Posted on:October 18, 2019 at 5:05 am
  • Posted in:Mobile, Social
  • Author:
    Mobile Threat Response Team

We found an app on Google Play named “Yellow Camera”, which poses as a camera and photo beautification or editing app embedded with a routine of reading SMS verification codes from the System Notifications, and, in turn, activate a Wireless Application Protocol (WAP) billing. We disclosed our findings to Google, and the app, along with related ones we saw, are no longer in the Play store.

Based on the name of the file downloaded by the app, it appears it is mostly targeting users in Southeast Asia (e.g., Thailand, Malaysia). However, we’ve also seen the app targeting Chinese-speaking users, so it won’t be a surprise if the app gradually shifts or expands targets. While the app has already been taken down in the Play store, we found that the fraudsters uploaded similar apps to the app store.

Read More
Tags: androidCarrier Billinggoogle playWAP Billing