Google Plays malware attack infects 1.7 million additional devices

google play, the company’s official repository for Android apps, was again caught hosting fraudulent and potentially malicious apps, with the discovery of over 56 apps, many of them for children, that were installed on nearly 1.7 million devices.

Tekya is a family of malware that generates fraudulent clicks on advertisements and banners disseminated by agencies such as Googles AdMob, AppLovin, Facebook and Unity. To make clicks look authentic, the well-obscured code forces infected devices to use the Androids MotionEvent mechanism to mimic legitimate user actions. When researchers at the security company Check Point discovered them, the applications were not detected by VirusTotal and Google Play Protect. Twenty-four of the applications containing Tekya have been marketed to children. Google deleted the 56 apps after Check Point reported them.

The discovery highlights once again that the Google Play Store can still host malicious applications, wrote Check Point researchers Israel Wernik, Danil Golubenko and Aviran Hazum in a publication published Tuesday. There are nearly 3 million apps available in the store, with hundreds of new apps downloaded daily, it’s hard to verify that each app is safe. Thus, users cannot rely solely on Google Plays security measures to ensure the protection of their devices.

Become native

To make malicious behavior more difficult to detect, applications have been written in native Android code in the C and C ++ programming languages. Android applications generally use Java to implement logic. The interface of this language offers developers easy access to several layers of abstraction. Native code, on the other hand, is implemented at a much lower level. While Java can easily be decompiled, a process that converts binaries back to human readable source code is much more difficult to do with native code.

Once installed, Tekya applications record a broadcast receiver which performs several actions, in particular:

• BOOT_COMPLETED to authorize the execution of the code when the device starts (cold start)
• USER_PRESENT to detect when the user is actively using the device
• QUICKBOOT_POWERON to authorize the execution of the code after restarting the device

The only purpose of the receiver is to load the native libtekya.so library into the libraries folder inside the .apk file of each application. The Check Point publication provides much more technical details on how the code works. Google officials have confirmed that the apps have been removed from Play.

But wait . . . There is more

In addition, antivirus provider Dr.Web reported on Tuesday the undisclosed number of Google Play apps discovered, downloaded over 700,000 times, which contained malware nicknamed Android.Circle.1. The malware used code based on the BeanShell scripting language, and combined both advertising and click fraud. The malware, which had 18 modifications, could be used to carry out phishing attacks.

The Dr.Web publication did not name all of the applications that contained Android.Circle.1. The few applications identified were: BlackDark Background Wallpaper, Horoscope 2020Zodiac Horoscope, Sweet Meet, Cartoon Camera and Bubble Shooter. Google has removed all applications reported by Dr.Web. The 56 applications discovered by Check Point, meanwhile, are in Tuesday’s Check Point post, which is again here.

Android devices often uninstall apps after being deemed malicious, but the mechanism doesn’t always work as expected. Readers may want to check their devices to see if they have been infected. As always, readers must be very selective in the applications they install. Undoubtedly, Google scans detect a large percentage of malicious apps submitted to Play, but a significant number of users continue to be infected with malware that bypass these checks.