These "Royal Apps" create a Royal Pain

       Google Play still allows the most annoying of ad-ware to be distributed to Android devices.  Airpush and Leadbolt are still very popular and are becoming even more aggressive then ever before in pushing ads for money.  Examples like these "Royal Apps" from small unknown developers with no websites show up everyday.  These apps and ones like it are extremely flawed and most don't even have content other then the ads. Of the few that actually have content, it is even more rare to get one that gives the end user value.

Luckily for us though it isn't hard to spot an abusive Leadbolt or Airpush app. The ones on Google play will display a warning like the one to the left with an opt-out method.  Do not try to hit cancel then use the app it will still display the ads.  The Terms of Service (ToS) agreement has in the small print that activating that just starting the app is an agreement to display ads. Using the "opt-out" link will not help either as the push ads will start again after the app updates.  Please note that not all of the Leadbolt and Airpush apps follow the prescribed practice of using this ToS agreement and display ads anyway. It is ALWAYS a good idea to check app permissions and other user reviews BEFORE installing.  Upon reading the reviews below (and 100 more like them), it should be clear not to install this app.

If installed, prepare to be bombarded with thousands of these little icons that will appear every time the app starts and every time the device is reset. They will fill up the screens until there is no room left for more and keep coming back, even after deletion.

Clicking on any of them will bring up a webpage with even more advertising apps to download that will run even more apps for more ads.  Also be prepared to have random pop-ups for even more "shady" aps.  Like the one to the left for "Armour or Android", which purposely advertises on apps that it detects to make it look like the device is infected with something more threatening then just annoying ad-ware.

Examples of more pop-up ads below:

Stay safe out there
-R`/4N

Android BadNews

      After checking out an Android malware sample listed by Lookout as Trojan:Android/BadNews, I found a lot of contention in the security community as to whether this is a Trojan or just adware gone bad.  The supposed command and control server at hxxp://androways.com is linked to the Russian Android adware company hxxp://mobidisplay.net. It looks like this ad company sends downloads to the installed Android device and one of them happened to be linked to some Android spyware. Check out the Virus Total link below to see that some Anti Virus list this as adware while others list this as a Trojan.  Either way these where on the Google Play store and could have been downloaded without the need to go to alternate markets.  The sample I studied specifically can be found here: hxxp://files2.freesoft.ru/rep/711324/live.photo.sharonstone.apk.

This is a good example for why it is necessary to have some sort of Anti Virus or analysis software on your Android device.

The original Post by Lookout here:
https://blog.lookout.com/blog/2013/04/19/the-bearer-of-badnews-malware-google-play/

Two Samples can be found here:
http://contagiominidump.blogspot.com/2013/04/badnews-android-adwaremalware-network.html

More samples can still be found in the wild here:
hxxp://freesoft.ru/?author=18604  (Russian Alternate market -- Malware Links)

Virus Total:
https://www.virustotal.com/en/file/9134ba9ce3e2a343de5abb986f04fa925a7032b5a842757d562afe3de0644a40/analysis/1366644359/


Stay safe out there
-R`/4N

Shop Amazon Software - New Norton 2013 - Get the Latest Protection 

Shop Amazon Gold Box - New Deals. Everyday 

Shop Amazon - Best Selling Products - Updated Every Hour

Leadbolt Adware in Fraudulent "Cracked" apps.

A good article from GFI Labs shows the danger in downloading Android apps that advertise as being Cracked. Another review by Threatpost gives more information as well. The samples that can be found at getwapi[dot]com is just one of many apps that advertise cracks for paid software. You have to be very careful downloading stuff off alternate markets as  lot of "cracked" software can lead to stuff much more dangerous then just adware.  PJAPPS, which are valid software with malicious code added, can cost money and cause significant data loss.




After searching the site myself for a sample of the "cracked" software, I found that they where hosting apps on 4shared and it looks like they removed all of the fraudulent apps from the above GFI article.

"'MB Notifications for Facebook.apk' is unavailable. This file is no longer available because it's identical to file banned because of claim."

Luckily for me I managed to snag a copy before they where all removed. You can download the copy here. If you take a look at its Virus Total results you can see that it is LeadBolt adware. Leadbot, like most adware programs leaks data and can cause a massive drain on the battery of a device at the same time as hijacking ads and pushing new ads. Getting multiple copies of these apps running at the same time can cause a lot of confusion and be very annoying. Too many copies of this type of advertising and the android device will crash or become corrupt.

 I don't think that we will see the last of apps like this as already a sister site called runamux[dot]net has already been created and is hosting similar apps.  The best way is to not become infected with malware is to refrain from downloading potentially stolen apps from alternate sources. However, if you are going to "play" outside the confines of official markets like Google Play or Amazon, remember to download and protect your device with an antivirus mobile suite. Check out my blog post here for a few ideas or scroll to the bottom of the site for a list of free ones from Amazon.


Stay safe out there
-R`/4N

Free GTA 3 is just adware

In the Google Play Store a very misleading app is just aggressive advertising. Let's first check out the description straight out of the store:

EDIT: It looks like this was removed from the Google Play Store after complaints. This still can be side-loaded from alternate markets like 1mobile that don't police.

Description

The ultimate Grand Theft Auto fan app! If you love GTA 3 like we do, then this app is for you. We love this game and so do millions of others around the world, and we created an app for all of you fans out there like us who are addicted to the game. Please note this is not the actual Grand Theft Auto game.

- Grand Theft Auto Walkthrough
- Grand Theft Auto User Tips and Reviews
- Grand Theft Auto Images
- Grand Theft Auto Videos
and more!

It's apparent from the description that this is not the actual game but just a free walkthrough: "Please note that this is not the actual Grand Theft Auto game". But the misleading part is that this is not even a proper walkthrough. After running this game all you get is this loaded webpage at appsmenow.com. That's just a big advertisement to purchase a valid copy of GTA 3 with a walkthrough tab that has a pretty pathetic excuse for a walkthrough on it.  

So it's just a little advertising from an affiliate trying to make a sale of a web based advertisement, everything is good right? Wrong; within minutes of installing your getting those dreaded ads pushed your notification bar from our friends over at Airpush, not to mention all the data about you they just collect from your phone. Check here and here for more information about Airpush and reated samples. 

If you look at the Virus Total results for the sample I collected, you can clearly see that this is just a junk app.  Remember to always stay safe when downloading apps from the Google Play Store by first checking out the permissions and second taking a quick look at what others have said about the app, like the comments below for this one. Also, it doesn't hurt to download a free virus scanner, check here for some good free ones.

"Please don't download this game when I opened all was blank and suddenly a app came and told pay 2.99$; for this app"

"Costs money"

"It just an advertisement for u to buy the games false advertising bad:("

------------------------------------------------------------------------------------------------------------

Download Captured Sample here: http://www.fileden.com/files/2012/10/26/3360856/fake_gta.zip

Sellaring

RESEARCH:

• http://news.softpedia.com/news/Security-Experts-Warn-About-Android-Apps-Bundled-with-sellAring-Ads-303067.shtml
• http://www.gfi.com/blog/sellaring-you-wont-like-the-sound-of-this-2/

MD5:

• 2F20F23F21751E4F3C2FC640C7801116
• E2AF3C3A05F2E23DB2913091CCAEEAEC
• D1C250F9D452C8FBAF4E5885451BBE00
• 48176B640FCF0EA21A3F3D5DAACA9318

VIRUS TOTAL:

• https://www.virustotal.com/file/58fcf52a5c145c2b688f347ef5a82a0eb52900dfc0d0eba5e8ad29f6f7cb09e2/analysis/1351697673/
• https://www.virustotal.com/file/adb95bb84367d55a3990849ae86a92057a3660d5c1c89e53c844f0ef67403f15/analysis/1351697757/
• https://www.virustotal.com/file/d5277118100f5f0b7e281278eaabecb4017a4a3a204f91b282227f7eed1f51c4/analysis/1351697793/
• https://www.virustotal.com/file/267a3129200ffd64870515ec4a628cdb3df8ec7e3cacc87804009d1078a1aea7/analysis/1351697822/

CAPTURED SAMPLES:

• http://www.fileden.com/files/2012/10/26/3360856/Sellaring.zip

MY OPINION:

• While they only currently play one add a day at current time, the potential for this to be annoying is huge.  They only way to get more advertisers or developers is to play more ads, so look for them to either disappear or open it up in the future to every call.

MORE RESEARCH:

• http://www.sellaring.com/
• http://phandroid.com/2012/05/13/developers-please-dont-ever-use-sellaring-to-monetize-your-app/
• http://androidcommunity.com/sellaring-in-call-advertising-has-users-seeing-red-20120514/

Airpush Adware.

RESEARCH: http://blog.trendmicro.com/trendlabs-security-intelligence/how-mobile-ads-abuse-permissions/

MD5: ccc7c75311a5b5738d375374c02b4151

VIRUS TOTAL: https://www.virustotal.com/file/577969bafcac59d27a322d16d670cf35ac5869049a8adebdb208eb8743a22d10/analysis/1351528638/

CAPTURED SAMPLES: http://www.fileden.com/files/2012/10/26/3360856/FLV_Player.zip

MY OPINION:
This type of Ad-Ware is known as AirPush. It can be highly annoying as it adds desktop shortcuts of advertising and pushing ad notifications to your phone even when not-in-use. More research About Airpush and other samples can be found:

• http://contagiominidump.blogspot.com/2012/09/plankton-samples.html
• http://www.pcworld.com/article/245305/sneaky_mobile_ads_invade_android_phones.html
• http://adjackal.com/listings/view/Airpush