Nine apps that steal Facebook login credentials pulled from Google Play

[ad_1]

Google LLC has removed nine Android apps from the Play Store, including one with millions of users, after it was discovered that they were stealing users’ login credentials on Facebook Inc.

Discovered and detailed on July 1st by malware analysts at Dr. Web, which has been described as “stealing Trojans”, has been described as harmless software and has been installed nearly 6 million times. Unlike some previous cases where malicious Android apps were detected, the apps in this case all provided legitimate services like photo editing, framing, workout, training, horoscopes, and junk file removal.

Apps included PIP Photo with up to 5 million installs; Image processing with up to 500,000 installs; Garbage Cleaner, Horoscope Daily and Inwell Fitness with up to 100,000 installs; and App Lock Keep with up to 50,000 installs. Lockit Master, Horoscope Pi, and App Lock Manager rounded out the list.

Commonly among apps, users were offered the ability to disable in-app ads by logging into their Facebook accounts. Analysts noted that “advertisements within some applications were already present and the aim of this maneuver was to further encourage Android device owners to perform the required actions.”

App users who had selected the option were then presented with a standard Facebook login but with a difference: the original Facebook login page was shown in a WebView with JavaScript also loaded to hijack the entered login credentials.

When users enter their Facebook login details, JavaScript sends the credentials to the attacker’s command and control server, while users won’t be wiser, after successfully logging in to Facebook. After victims log into their accounts, the Trojan also stole cookies from their existing authorization sessions.

Although those behind the apps targeted Facebook accounts, they targeted accounts on other services. “The attackers could have easily changed the settings of the Trojans and instructed them to load the web page for another legitimate service,” the analysts explained. “They could have used a completely fake login form found on a phishing site. Thus, Trojans could have been used to steal logins and passwords from any service.”

Google hasn’t made a public statement regarding the apps yet. Ars Technica reported on Friday that the apps have been removed from the Store. A Google spokesperson told Ars Technica that app developers have also been blocked.

Photo: Dr. Web Show your support for our mission by joining the Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and soon-to-be Amazon.com CEO Andy Gacy, Dell Technologies Founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more prominent personalities and experts. Join our community

We are holding the 2nd Cloud Startup Fair on June 16th. Click here to join the free and open Startup Showcase event.

“TheCUBE is part of re:Invent, you guys are really part of the action and we really appreciate coming here and I know people appreciate the content you create too” – Andy Jassy

We really wanted to hear from you. Thanks for taking the time to read this article. We look forward to seeing you at the event and at the CUBE Club.

.

[ad_2]