Google Play apps with as many as 2.6m downloads added devices to botnet

Enlarge (credit: portal gda)

Google has booted eight Android apps from its Play marketplace, even though the apps have been downloaded as many as 2.6 million times. The industry giant did so after researchers found that the apps add devices to a botnet and can perform denial-of-service attacks or other malicious actions.

The stated purpose of the apps is to provide a skin that can modify the look of characters in the popular Minecraft: Pocket Edition game. Under the hood, the apps contain highly camouflaged malware known as Android.Sockbot, which connects infected devices to developer-controlled servers. This is according to a blog post published Wednesday by researchers from Symantec. The malware mostly targets users in the US, but it also has a presence in Russia, Ukraine, Brazil, and Germany.

When the researchers ran an infected app in their laboratory, they found it establishing a persistent connection based on the Socket Secure (SOCKS) protocol to a server that delivers ads. The SOCKS proxy mechanism then directs the infected device to an ad server and causes it to request certain ads be displayed.

Read 3 remaining paragraphs | Comments

Ars Technica

Post Author: martin

Martin is an enthusiastic programmer, a webdeveloper and a young entrepreneur. He is intereted into computers for a long time. In the age of 10 he has programmed his first website and since then he has been working on web technologies until now. He is the Founder and Editor-in-Chief of BriefNews.eu and PCHealthBoost.info Online Magazines. His colleagues appreciate him as a passionate workhorse, a fan of new technologies, an eternal optimist and a dreamer, but especially the soul of the team for whom he can do anything in the world.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.