Story image

Unit 42 discovers apps compromised by iFrames on Google Play

07 Mar 17

A number of apps appearing on Google Play contained IFrames infections that link to malicious domains in their HTML pages, a new blog post from Palo Alto Networks and Unit 42 warns.

Unit 42 detected 132 apps that contained the IFrames, many of them popular.  The IFrame infections were caused by malware that looks for HTML pages and then puts its own malicious content at the end.

Unit 42 says this is not the work of the developers at all, in fact they are very unlikely to be the cause. The infections likely occurred without the developers even knowing.

The apps all used Android WebView to display static web pages, commonly used to store pictures and text. However the malware contains a ‘tiny’ IFrame that links to the domains. Unit 42 says the fact that so many apps were infected is ‘notable’.

In one case, the malware attempts to download a Windows executable, but Android devices are incompatible. 

Unit 42 says it reported its findings to Google. Google has removed all infected apps from Google Play.

Infected apps of this type will not cause direct damage to users, however it does show that platforms can be malware carriers. 

“It’s easy to envision a more focused and successful attack: an attacker could easily replace the current malicious domains with advertising URLs to generate revenue. This not only steals revenue from app developers, but also can damages the developers’ reputation,” the blog says.

Attackers could then use maliciouss scripts on the remote server and then use an interface to access the app’s native functionality, effectively controlling the app.

This paves the way for rooting, adding additional permissions, dropping malicious APK files and escalating capabilities.

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.