sb-as logo
Story image

Unit 42 discovers apps compromised by iFrames on Google Play

07 Mar 2017

A number of apps appearing on Google Play contained IFrames infections that link to malicious domains in their HTML pages, a new blog post from Palo Alto Networks and Unit 42 warns.

Unit 42 detected 132 apps that contained the IFrames, many of them popular.  The IFrame infections were caused by malware that looks for HTML pages and then puts its own malicious content at the end.

Unit 42 says this is not the work of the developers at all, in fact they are very unlikely to be the cause. The infections likely occurred without the developers even knowing.

The apps all used Android WebView to display static web pages, commonly used to store pictures and text. However the malware contains a ‘tiny’ IFrame that links to the domains. Unit 42 says the fact that so many apps were infected is ‘notable’.

In one case, the malware attempts to download a Windows executable, but Android devices are incompatible. 

Unit 42 says it reported its findings to Google. Google has removed all infected apps from Google Play.

Infected apps of this type will not cause direct damage to users, however it does show that platforms can be malware carriers. 

“It’s easy to envision a more focused and successful attack: an attacker could easily replace the current malicious domains with advertising URLs to generate revenue. This not only steals revenue from app developers, but also can damages the developers’ reputation,” the blog says.

Attackers could then use maliciouss scripts on the remote server and then use an interface to access the app’s native functionality, effectively controlling the app.

This paves the way for rooting, adding additional permissions, dropping malicious APK files and escalating capabilities.

Link image
Veeam launches ransomware prevention kit
Through a simple-by-design management console, users can easily achieve fast, flexible and reliable backup, recovery and replication for all your applications and data.More
Story image
Exabeam and Code42 partner up to launch insider threat solution
The solution will give customers a fuller picture of their environment, and will leverage automated incident response to obstruct insider threat before data loss occurs.More
Link image
Webinar: Best practices for keeping your video chats secure
Video collaboration providers nowadays operate exclusively on a multi-tenant, public cloud - and security and privacy concerns have come into the spotlight. Here's how to secure your communications.More
Story image
Global attack volume down, but fraud and cyber threats still going strong
“The move to digital, for both businesses and consumers, has been significant. Yet with this change comes opportunity for exploitation. Fraudsters look for easy targets: whether government support packages, new lines of credit or media companies with fewer barriers to entry."More
Story image
Sophos named mobile security Leader in IDC MarketScape
Sophos Intercept X for Mobile has capabilities in protecting Android, iOS and Chrome OS users from known and never before seen mobile threats.More
Download image
Network functions virtualisation: What is is, how to use it, and why it matters
Network functions virtualisation (NFV) is fast becoming the go-to method of simplifying corporate networks from planning, through deployment and management.More