Apps with 5.8 million downloads on Google Play stole users’ Facebook passwords

[ad_1]

Mateusz Slodkowski / SOPA Images / LightRocket via Getty Images

Google has given the boot to nine Android apps that have been downloaded more than 5.8 million times from the company’s Play Store after researchers said those apps used a deceptive method to steal users’ Facebook login credentials.

In an effort to gain users’ trust and reduce their caution, the apps have offered fully functional photo editing and framing services, rehearsal and training, horoscopes, and junk file removal from Android devices, according to security firm Dr. web. All selected apps provided users with an option to disable in-app ads by logging into their Facebook account. Users who chose this option saw an original Facebook login form with fields for entering usernames and passwords.

Then researchers wrote Dr. Web:

Trojans use a special mechanism to deceive their victims. After receiving the necessary settings from one of the command and control servers when running, they loaded the legitimate Facebook webpage https://www.facebook.com/login.php into the WebView. Then, they load the JavaScript received from the command and control server into the same WebView. This script was used directly to hijack the entered login credentials. Then, this JavaScript, using methods provided through the JavascriptInterface annotation, passes the stolen login and password to the Trojan applications, which then pass the data to the attackers’ command and control server. After the victim logs into their account, the Trojans also steal cookies from the current authorization session. These cookies are also sent to cybercriminals.

Analysis of the malware showed that they all received settings to steal logins and passwords of Facebook accounts. However, the attackers could have easily changed the settings of the Trojans and instructed them to load the web page of another legitimate service. They could have used a completely fake login form found on a phishing site. Thus, it was possible to use Trojans to steal logins and passwords from any service.

Dr. the web

Researchers have identified five different types of malware hidden within applications. Three of them were native Android apps, and the other two used Google’s Flutter framework, designed for cross-platform compatibility. Dr. Webb said he classifies them all as the same Trojan because they use identical config file formats and identical JavaScript code to steal user data.

Ads

Dr. Webb defined the variables as:

The majority of downloads were for an app called PIP Photo, which has been accessed over 5.8 million times. The app that achieved the most reach was image processing, with over 500,000 downloads. The remaining applications were:

A Google Play search shows that all apps have been removed from Play. A Google spokesperson said the company has also banned developers of all nine apps from the Store, which means they won’t be allowed to submit new apps. This is the right thing for Google to do, but it nevertheless presents only minimal barriers for developers because they can simply sign up for a new developer account under a different name for a one-time fee of $25.

Anyone who has downloaded one of the above-mentioned apps should thoroughly scan their devices and their Facebook accounts for any signs of hacking. Downloading a free Android antivirus app from a well-known security company and searching for additional malicious apps is not a bad idea either. The offering from Malwarebytes is my favourite.

[ad_2]