Search This Blog

Showing posts with label Google Play Store. Show all posts

Is A Cheap Phone Worth The Cost Of Your Privacy?


There is absolutely no room for doubt that Chinese manufacturers offer an excess of affordable gadgets with extraordinary specs to boot, in fact,  Xiaomi would most likely be among the brands that you would consider when searching for a decent deal.

However, a few recent revelations put its privacy practices into question.

Security researchers Gabriel Cirlig and Andrew Tierney while speaking to Forbes guaranteed that Xiaomi's web browsers gather an 'over the top' amount of information even in incognito mode. This purportedly incorporated all URLs and search queries made in the stock MIUI browser, just as Mi Browser Pro and Mint Browser.

When combined, these programs have in excess of 15 million downloads on the Google Play Store. As per Forbes, “The device was also recording what folders had been opened and to which screens the user swiped, including the status bar and the settings page.”

Tierney later following up on Xiaomi's blog post with a Twitter thread defending the primary findings with additional evidence. In a said blog post, the Chinese manufacture guaranteed every single data gathered is anonymized and that its practices are the same as the industry standard.

Notwithstanding, not long subsequent to issuing the statement, Xiaomi pushed an update to its browsers, permitting users to 'toggle off’ data collection in incognito mode.

Xiaomi guarantees that all information it gathers is anonymized, in spite of the fact that this has been questioned by the discoveries of the security researchers.

However, regardless of whether Xiaomi's side is thought about in this contention, there has been proof that some anonymized information can still be traced back to the users. The New York Times proved this with anonymous location data.

While browser data may be a bit harder to link to a user than location data, it could be conceivable depending upon how the information is gathered and stored. In the Xiaomi situation, the expansion of the 'toggle off' option is likewise disappointing on the grounds that this implies the default hasn't changed.

The Chinese company will continue gathering incognito browser data unless users are aware of the 'toggle and explicitly opt-out'.

Given the fact that Xiaomi is the fourth-largest smartphone manufacturer by market share, this implies for the average user that is not in particular 'tech-savvy' as the status quo remains the same.


Rise of a Mobile Banking Malware Which Steals Personal Financial Information



The federal cybersecurity agency cautions about the rise of a new mobile banking malware called "EventBot", which purportedly steal personal financial information and says it might influence Android phone users in India, in a most recent advisory.

The Trojan infection may "masquerade as a legitimate application such as Microsoft Word, Adobe flash and others using third-party application downloading sites to infiltrate into victim device” as per an alert issued by the (CERT-In) Computer Emergency Response Team of India, the national technology arm to combat cyber-attacks and guard the Indian cyberspace.

“It has been observed that a new Android mobile malware named EventBot is spreading. It is a mobile-banking Trojan and info-stealer that abuses Android's in-built accessibility feature to steal user data from financial applications, read user SMS messages and intercept SMS messages, allowing malware to bypass two-factor authentication," said the CERT-In warning.

As indicated by the CERT-In the virus "to a great extent target financial apps like PayPal Business, Revolut, Barclays, UniCredit, CapitalOne UK, HSBC UK, TransferWise, Coinbase, paysafecard and so on"

The agency said while "EventBot" has not been "seen" on Google Playstore till now, it can "masquerade" as a certified mobile phone application.

The virus further prompts the users to offer access to their device accessibility services. The advisory claimed that the virus is equipped for recovering notifications about other installed applications and read the contents of various applications.

Over time, it can also read Lock Screen and in-app PIN that can give the attacker more privileged access over victim device,"

The cybersecurity agency has proposed certain counter-measures to check the virus infection within the Android phones: "Do not download and install applications from untrusted sources like unknown websites and links on unscrupulous messages; install updated anti-virus solution; prior to downloading or installing apps even from Google Playstore), always review the app details, number of downloads, user reviews, comments and the 'additional information' section”

Lastly, it requested that users abstain from utilizing unsecured, unknown Wi-Fi systems, and for prior affirming of a banking/financial application from the source organization.

Attention! Fake Extensions on the Chrome Web Store Again!


Reportedly, Google was in the news about having removed 49 Chrome extensions from its browser’s store for robbing crypto-wallet credentials. What’s more, after that, there surfaced an additional set of password-swiping “extensions” aka “add-ons”, which are up for download even now.

Per sources, the allegedly corrupt add-ons exist on the browser store disguised as authentic crypto-wallet extensions. These absolutely uncertified add-ons invite people to fill in their credentials so as to make siphoning off them easy and the digital money accessible.

Reports mention that the security researchers have affirmative information as to 8 of the 11 fake add-ons impersonating legitimate crypto-wallet software being removed including "Jaxx Ledger, KeyKeep, and MetaMask." A list of “extension identifiers” which was reported to Google was also provided.

Per researchers, there was a lack of vigilance by the Google Web Store because it apparently sanctions phisher-made extensions without giving the issue the attention it demands. Another thing that is disturbing for the researchers is that these extensions had premium ad space and are the first thing a user sees while searching.

According to sources, much like the Google Play Store with malicious apps, the Google Web Store had been facing difficulty in guarding itself against mal-actors. There also hadn’t been much of a response from their team about the issue.

One solution that was most talked about was that Google should at the least put into effect mechanisms in the Chrome Web Store that automatically impose trademark restrictions for the store and the ad platforms in it.

Per sources, Google’s Chrome Web Store “developer agreement” bars developers from violating intellectual property rights and also clearly mentions “Google is not obligated to monitor the products or their content”. Reports mention that as per the ad policy of Google, it could review trademarks complaints from trademarks holders only when it has received a complaint.

Google heeding all the hue and cry about the extensions did herald more restrictions with the motive of wiping away traces of any fake extensions and spammers creating bad quality extensions that were causing people trouble.

The alterations in the policy will block the spammers and developers from swarming the store with similar extensions and elements with questionable behavior. Word has it that because of hateful comments the Chrome Web Store was “locked down” in January.

But, as promising as it may be, allegedly Google has been making such promises about the Chrome Web Store security strengthening for more than half a decade. So no one can blame researchers for their skepticism.

All you need to know about the new threat "Fleeceware" and how to protect yourself!


SophosLabs, a cybersecurity firm has discovered a range of apps on Google Play Store and Apple's iOS App Store whose sole purpose is to charge huge subscriptions and other fees to clients for the features and services they could avail for free.

These apps though tricks the user they however neither steal your data nor do they run any malicious code hence fundamentally they are not malwares. Sophos calls them fleecewear, malicious apps hiding in sheep's clothing. "Because these apps exist in a categorical grey area that isn’t overtly malware, and isn’t a potentially unwanted app (PUA), we’ve coined the term fleeceware, because their defining characteristic is that they overcharge users for functionality that’s widely available in free or low-cost apps." writes Sophos Labs.

They found 25 such Android apps on Google Play store in January and 30 apps on the iOS App Store that could be fleeceware.

 "In our capitalistic society, you can look at fleeceware apps and say if somebody wants to waste $500 per year on a flashlight app that’s up to them," says John Shier, Sophos senior security adviser. "But it’s just the exorbitant price that you’re being charged, and it's not done aboveboard. That, to me, is not ethical." 

You have to be careful while paying for in-app purchases and especially subscription. These apps will offer a trial period but will demand payment the first time you open the app. Or they could ask high payment for simple basic features like photo filter for 9$ per week or 30$ per month.

Fleeceware apps exploit the marketing model of play store and App Store, finding loopholes to charge their skyrocketing prices. But Google is tightening the leash. It announced last week that developers will be required to make details of subscriptions, free trials, and introductory offers more precise and clear by June 16.

 "Part of improving the subscription user experience comes from fostering a trustworthy platform for subscribers; making sure they feel fully informed when they purchase in-app subscriptions," Angela Ying, Google product manager wrote in a blog. 

 How to avoid fleeceware? 

Through some simple steps you can avoid falling into the traps set by this fleeceware:


  1.  Install apps developed by prominent developers. Big companies and their apps offer features like emojis, selfie filters, and QR code scanners for free. 
  2.  If you found something exclusive that the app is providing, it's better to compare prices by doing a quick search. 
  3.  If you think, you're subscriptions are getting a bit out of hand and want to check which apps you have subscribed to and the ones you'd like to cancel - Play Store and iOS App Store both offer the option where you can see all your subscriptions. 


"On iOS, open Settings, tap your name, and then Subscriptions to view and manage everything. Or you can open the App Store, insert your initials in the upper right corner, and tap Subscriptions. On Android, open the Play Store, tap the hamburger menu icon in the upper right, and choose Subscriptions to view and manage your signups."

Google Doubling Down On Efforts to Protect Android Users


With the rise in the in-application subscription scams on Android, Google subsequently announced the introduction of new Play Store policies intended to forestall such scams in the near future.

The American multinational technology additionally pledged to provide Android users with direct assistance in the form of notifications when a trial is going to turn into a paid subscription, or a subscription is going to renew consequently.

The new policies announced that demand application developers offer clear info about the obligations associated with subscription models and free trials, and provide a simple and easy way through which users can cancel subscriptions. These latest policies are a small part of a more extensive Google campaign, aimed especially at ensuring the privacy and security of Android users.

The newly announced policies focus mostly on fleeceware, a form of application that 'manipulates' trial periods and membership models to defraud victims. This kind of application usually burdens the user with complex terms and conditions, further enshrouding unjustifiable subscription commitments.
As a component of the new prerequisites, developers must distinguish with enough clarity between features accessible free of cost and those accessible only to paying subscribers. Thus, Google will convey an admonition to users when a free trial is set to end or when a subscription longer than three months is because of turn over.

The firm will likewise give warnings if a user endeavors to uninstall an application attached to an on-going subscription.

The new policies are said to take effect on June 16, so users should take particular consideration whenever handling of in-application subscriptions on Android in the meantime.

Apart from this, the company took the initiative to remind developers that its new assessment procedure will produce results in August, which will require developers to gain approval from Google before requesting location data from the end-user.

Further Play Store 'tweaks' are likewise in the pipeline, which will reportedly address issues related to illusive content and applications.

100 Million Android Users Warned Against Using this "Very Dangerous" VPN App


Millions of Android users are being cautioned against using a popular Android VPN that was removed by Google from its Play store. The action was taken by Google after Researchers found vulnerabilities in 'SuperVPN' that could leave devices open to malware attacks and allow attackers to redirect victims onto malicious servers.

As of now, the app has around 100 million downloads, however, in the year 2016 when the risks associated with the app surfaced for the first time ever in related research, it only had a total of 10,000 downloads.

While testing, security researchers identified three main issues with the app:

1. Unencrypted HTTP traffic: The communications can be intercepted by the attackers, it has been said that transferring highly sensitive information over HTTP is not secure at all.

2. Hardcoded encryption keys: The app has inbuilt decryption keys that can easily decrypt the information in an encrypted format.

3. Payload including EAP credentials: EAP credentials are being used by the VPNs therefore users outside the app can not connect to the same server. Hence, EAP credentials sent in the unencrypted payload in a way defeats the purpose.

Notably, SuperVPN was also listed as one of the top 5 VPN in Google Play Store's search results before it was taken down by the authorities. As per the findings by researchers, it contained vulnerabilities that allowed attackers to carry out man-in-the-middle attacks, also known as MITM attacks. It could expose communication that took place between the user and provider letting hackers have access to everything the user is doing online, be it browsing tabs in Chrome, making video calls or loading up apps – all of that sensitive data including passwords, private texts, and voice messages is being made available to the attackers.

Other occasions where SuperVPN drew negative remarks include the app being ranked third by the Australian researchers in an examination of the most malware-rigged VPN apps. The researchers pointed out that the app had been posing risks since it appeared on the Play Store.

While explaining more about the issues, Jan Youngren, Security Researcher at VPNPro told, "SuperVPN used a wide range of shady techniques to help it rank highly in Google, as well as to hide who actually owns the app, where it’s located, and the other apps from the same developer that may have similar issues."

"But lastly, and most importantly, it seems that the entire time the app was on the Play store, it had critical vulnerabilities in one way or another, either by being a vehicle for malware in 2016 or allowing for MITM attacks just before being removed."

"The only thing unclear now is whether these vulnerabilities are due to mistake, or intention. Nonetheless, there are millions of users right now with a dangerous app on their phone. If you’re one of those users, we implore you to delete SuperVPN immediately." He further added.

Check Point: 56 apps from the Google Play Store hide a new dangerous malware


Check Point experts have identified a new family of malware in the Google Play Store. It was installed in 56 Google Play Store apps that have been downloaded almost a million times by users worldwide. 24 apps among the damaged 56 are children's games, as well as utilities such as calculators, translators, cooking apps and others. As it is specified, applications emulate the behavior of a real user.

Tekya malware uses the MotionEvent mechanism in Android that simulates a click on an ad banner (first discovered in 2019) to simulate user actions and generate clicks.

Imitating the actions of a real person does not allow the program or a third-party observer to understand the presence of fraud. This helps hackers to attack online stores, make fraudulent ads, promote advertising, promote sites in search engine results, and also serve to carry out banking operations and other illegal actions.

During the research, Tekya went unnoticed by the VirusTotal and Google Play Protect programs.
Hackers created copies of official popular apps to attract an audience, mostly children since most apps with Tekya malware are children's games.

However, the good news is that all infected apps have already been removed from the Google Play.
This case shows that malicious app features can still be found in Google Play. Users have access to almost 3 million apps in the Google Play Store, and hundreds of new ones are downloaded daily, making it difficult to check the security of each individual app.

Although Google is taking steps to ensure security and prevent malicious activity on the Google Play Store, hackers are finding ways to access users' devices through the app store. So, in February, the Haken family of malware was installed on more than 50 thousand Android devices through various applications that initially seemed safe.

Stay Wary of Third-Party Apps: Malware App 'CovidLock' Locks User Out of their Phone


In an attempt to block misinformation from being spread by developers taking advantage of the COVID-19 charged environment, Google started prevention by blocking any search made for terms "COVID-19" and "coronavirus" on Google Play Store. It identified certain developers' malicious intent of exploiting user's concerns regarding the new coronavirus. As of now, Google's attempt to block searches has yielded positive results with the search for the aforementioned keywords returns no results at all on the Play Store.

Once you are out of the Play Store searching for the same, considering the installation of third-party apps, it becomes a matter of great concern as developers are embedding ransomware in apps named after the new coronavirus to delude uninformed users.

Recently, DomainTools, a Threat Intelligence company found an app known as "CovidLock" that is ransomware in the facade of 'coronavirus tracking app'. The app will appear to be a real-time tracker for the coronavirus but it will function as a malware that will lock the user out of his phone and ask for a ransom of $100 in bitcoin within a time period of 48 hours. If the affected user fails to provide the demanded ransom in the given time, he receives threats of his social media accounts being exposed online and the data stored onto his device being permanently deleted. It further notifies that his device is constantly monitored and in case he attempts to do anything stupid, everything will be automatically deleted.

However, a piece of good news is that the new mobile devices are secured against such attacks as Google has added defense against it. But in cases of users running versions older than Android Nougat, there are chances of their device being infected by this malware. To stay on a safer side, users are being advised to stick to the Google Play Store when downloading apps. Turning to unauthorized third-party sources invites great danger to user security especially at a time when our concerns and fears can be exploited and used against us. 

Over 600 Million Users Download 25 'Fleeceware' Apps from the Play Store


Researchers at security firm Sophos has discovered a new set of Android apps present on the Google Play Store that contain fleeceware. Notably, these apps have been downloaded and installed by over 600 million unsuspecting Android users.

The term 'Fleeceware' was first coined in September 2019 by cybersecurity firm Sophos in aftermath of an investigation that led to a new kind of financial fraud on the authentic Google Play Store.

Fleeceware is a new addition to the cybersecurity ecosystem, referring to the exploitation of the trial period mechanism in Android apps which generally is provided before one is charged for the full version from his signed up account.

Normally, users who register for an Android app's trial period are required to cancel the same manually in order to avoid being charged. However, it's common among users to simply stop using the app by uninstalling it in case they don't like it. The action of uninstalling is read by the developers as trial period being canceled and hence it doesn't result in the due amount being charged from the user account.

The UK based, a cybersecurity company, Sophos told that it identified over two-dozen android apps containing fleeceware, these apps were charging somewhere around $100 and $240 per year for apps as basic and mainstream as barcode readers, calculators, and QR scanners.

Suspecting the unusually high number of downloads on these apps, analyst Jagadeesh Chandraiah says, it's likely that these apps have resorted to third-party pay-per-install services to raise up the download counts. He also suspects the five-star reviews being fake and bought in order to better the apps ranking on the Play store and hence lure a large number of users.

Warning the users in their report, Sophos told, "If you have an Android device and use the Google Play Store for apps, you should rigorously avoid installing these types of “free trial” apps that offer subscription-based charges after a short trial."

"If you do happen to have a free trial, make sure you understand that merely uninstalling the app does not cancel the trial period. Some publishers require you to send a specific email or follow other complicated instructions to end the free trial before you are charged, though you might just need to log into your Google Pay to cancel. Keep copies of all correspondence with the publisher, and be prepared to share that with Google if you end up disputing the charges." the report further read.

Sneaky Android adware hides its own icon to avoid removal – find out how to get rid of it!



Security researchers at SophosLabs have discovered 15 apps in the Play Store that contain a manipulative strain of adware that hides its own icon in the launcher to avoid being uninstalled by making the process unusually difficult for the users, it disguises itself as a harmless system app. There is a possibility of more such apps being present on the Play Store beside these 15 discovered ones. Some apps of similar nature have gone a step further and were found upon opening the phone’s App Settings page, hidden beneath names and icons that make them appear as legitimate system apps.

Some people tend to download an app, without giving its requirement much of a thought or consideration, the habit may have led you into inadvertently downloading these malicious apps such as QR code reading, free calls and messaging, phone finder, backup utilities and image editor apps which have adware embedded in them and serve no purpose at all other than to generate revenues for the developers by displaying intrusive advertisements. To exemplify, Flash on Calls & Messages – aka Free Calls & Messages is one such app, which shows a fake error message when the user launches it, telling the user that it is incompatible with his device. Then the user is directed to the Google Play Store entry for Google Maps, to mislead the user into believing that the Maps app is the reason for the crash, which is not at all true.

On Google Play Store, most of these camouflaged apps receive negative ratings and reviews which highlight the disappointments and the issues faced by users while using the app. More than 13 lakh phones were populated by these malicious apps, according to SophosLabs.

Quoting Andrew Brandt, principal researcher at SophosLabs, "To stay safe when downloading apps from the Google Play Store, users are advised to read reviews and sort them by most recent and filter out the positive four and five-star reviews with no written text,"

"App developers have, for years, embedded ad-code into their apps as a way to help defray the costs of development, but some developers simply use their apps as a borderline-abusive platform solely to launch ads on mobile devices," he added.

How to get rid of adware apps? 

Referencing from the advise given by Andrew Brandt, "If you suspect that an app you recently installed is hiding its icon in the app tray, tap Settings (the gear menu) and then Apps & Notifications. The most recently opened apps appear in a list at the top of this page."

"If any of those apps use the generic Android icon (which looks like a little greenish-blue Android silhouette) and have generic-sounding names (‘Back Up,’ ‘Update,’ ‘Time Zone Service’) tap the generic icon and then tap ‘Force Stop’ followed by ‘Uninstall.’ A real system app will have a button named ‘Disable’ instead of ‘Uninstall’ and you don’t need to bother disabling it."

"To stay safe when downloading apps from the Google Play Store, users are advised to read reviews and sort them by most recent and filter out the positive four and five-star reviews with no written text,"

"If several reviews mention specific undesirable behavior, it's likely best to avoid that particular app," he says. 

Criticism against Google Play Store on the Rise about Malware-Laced Apps




Google Play Store has come in for a serious criticism as of late, with various alerts about malware-laced apps which have frequently been on the store for quite a long time, or even years, and which have been installed by a huge number of users.

This most recent cautioning concerns four VPNs and two selfie apps, with in excess of 500 million installs between them, all of which contain harmful adware and which look for hazardous system permissions that can exact serious harm.

Regardless of significant efforts to clean house the issue stays pervasive and users stay in danger.

Google Play Protect is therefore one storefront intended to make preparations against application vulnerabilities and, in 2018, Google “detected and removed malicious developers faster, and stopped more malicious apps from entering the Google Play Store than ever before. The number of rejected app submissions increased by more than 55%, and we increased app suspensions by more than 66%."
However, once more the warnings still remain that dangerous applications are as yet accessible for install on Google's official store.

First was a notice from security researcher Andy Michael around four Android VPNs that are 'bombarding devices' with false ads—creating income for their operators to the detriment of the organizations setting the advertisements.

Second, was a notice from security researchers at Wandera that two camera filter apps with more than 1.5 million installs between them have been tainting devices with adware.

In any case Google's Android (and Apple's iOS) is making it progressively simple for users to track permissions granted and application misuse now and every user has been informed to take advantage of every one of the protections set up, clicking with caution and keeping their smartphones protected from the would-be-intruders to every extent they can.

This is all in light of the fact that the clever malware attacks still exist out there—and they can be very difficult to detect.

ATTENTION ANDROID USERS: REMOVE THESE APPS IMMEDIATELY!




A minimum of 24 extremely popular android applications were found to be infested with malware. They were tested positively with Trojan which is known by the name of “Joker”.

Per sources, this Trojan provokes the interaction of the device with advertisement websites. It could steal SMS messages and private data.

As per the sources following are the names of the applications that are being said to be infested with the Trojan:
  • Beach Camera 4.2
  • Mini Camera 1.0.2
  • Soby Camera 1.0.1
  • Declare Message 10.02
  • Rapid Face Scanner 10.02
  • Leaf Face Scanner 1.0.3
  • Spark Wallpaper 1.1.11
  • Humour Camera 1.1.5
  • Rudy SMS Mod
  • Antivirus Security – Security Scan, App Lock 1.1.2
  • Collate Face Scanner 1.1.2
  • Ignite Clean 7.3
  • Advocate Wallpaper 1.1.9
  • Print Plan scan 1.03
  • Great VPN 2.0
  • Climate SMS 3.5
  • Dazzle Wallpaper 1.0.1
  • Cute Camera 1.04
  • Board Picture editing 1.1.2
  • Altar Message 1.5
  • Age Face 1.1.2
  • Reward Clean 1.1.6
  • Certain Wallpaper 1.02
  • Mini Camera 1.0.2

Security researchers strictly advise every user to uninstall any of these applications if found in their devices.

CamScanner Returns After Being Removed by Google for Having Malware



Researchers at multinational cybersecurity company, Kaspersky Labs, discovered a malicious module in the widely used mobile scanning app, CamScanner. As a result of the discovery, the app was taken down by Google from its play store last week. Seemingly, the iOS version of the app remained unaffected by the malware.

On 5th September 2019, the developers of the popular PDF creator app, announced its comeback on their official Twitter handle. Reportedly, they have removed all advertising SDKs in the latest version of CamScanner, i.e., version 5.12.5, which can be downloaded by the users from Google Play Store.

There were issues in the previous version of the app, however, the app, CamScanner in itself is a completely authentic and widely used application.



According to the researchers at Kaspersky Labs, “Recent versions of the app shipped with an advertising library containing a malicious module,”

“The module is a Trojan-Dropper that means the module extracts and runs another malicious module from an encrypted file included in the app’s resources. This “dropped” malware, in turn, is a Trojan-Downloader that downloads more malicious modules depending on what its creators are up to at the moment,” they added.

The Trojan-Dropper module which is called as “Trojan-Dropper.AndroidOS.Necro.n”  is configured to befool users into signing up for paid subscriptions by showing them intrusive advertisements.

Google now pays more for disclosing vulnerabilities in Chrome OS and some Play Store apps

One of the hardest aspects of maintaining a cross-platform product is ensuring its security. Vulnerabilities can be exploited on various platforms in various scenarios, and it’s almost impossible for literally any company’s security department to fix all of them on their own. That’s why companies often use vulnerability disclosure rewards programs, which basically means giving money to someone who finds an issue in your product. Google has several programs of this kind. One of them is the Chrome Vulnerability Rewards Program, which awards security researchers for exploiting vulnerabilities in Chromium, Chrome, and Chrome OS. As you already know, there are a lot of Chromium-based browsers on the market, so the security of this product is crucial.

Today, Google is increasing the minimum rewarding amount for this program. Currently, security researchers receive a maximum amount of $5,000 on baseline reports. These exploits are mostly around escaping the sandboxing. Google is tripling the amount of reward for high severity baseline reward, bringing it up to $15,000. The price of high-quality reports with functional exploits of the same category got doubled. Previously it was $15,000, but after today Google will pay $30,000 for these kinds of exploits. Google is also increasing the bonus from $500 to $1,000 for exploits found via Chrome Fuzzer, which lets security researchers use Google’s hardware and scale to replicate the exploits.

The Google Play Security Reward Program got an update, too. This program only covers apps that have specifically opted-in.

- The reward for remote code execution bug went from $5,000 to $20,000
- The reward for theft of insecure private data went from $1,000 to $3,000
- The reward for accessing protected app components went from $1,000 to $3,000

To put it in short, Google decided to show more appreciation for all the security researchers that help ensure the security of their product. The changes will go into action today. You can start looking for vulnerabilities if you are competent enough. Maybe you’ll get some reward from Google.

Fake “Samsung UPDATES” App Deceives Millions!





Millions of Samsung users were massively misled by an “updates” app which actually has nothing to do with Samsung.  The app tried to harvest money in exchange for security updates.


The app was spotted by a group of researchers on the Google Play Store which was targeting Android users and the ones with Samsung phones in particular.

The app which has now been taken down would take the users to ad-filled pages and ask them for money in return for security updates and firmware.

Per the report shared by the malware analyst who discovered the application, the malware app was named “Updates for Samsung” and was installed by more than 10 million users.


The fake application lured the users in by claiming to make available free and paid Samsung updates whereas Samsung never actually charges for its legitimate firmware updates.

In addition the report cites that the app suggested the users a free download for a limited speed of 56KBps and took around 4 hours to get the 500MB download done with it, only to time-out at the end and fail.

Then of course the other option would be a premium annual subscription to download the updates with fast speed for around $34.99 (Rs. 2,400.76). Also, the app would pop a lot of ads and ask for payment to remove them.

In the list of all the “amazing provisions” of the aforementioned app, another was SIM card unlocking for nay network operator with the starting price of $19.99. (Rs. 1,371.73)

The name of the fake app which was maliciously designed to target the users of Samsung pretty well kept up to the expectations of the cyber-cons and got millions of installations.

The report additionally alluded to the fact that app doesn’t include any malicious code in itself and is simply a tactic which could be used by cyber-cons to fool people.

Gamers’ Google and Facebook Credentials Unsafe; Android’s “Scary Granny ZOMBYE Mod: The Horror Game” To Blame!






A horror game from Android which has more than 50,000 downloads to its name. The Scary Granny ZOMBYE Mod: The Horror Game showed malicious behavior and is allegedly stealing users’ credentials after they log into their accounts.

The game is specifically designed to hoard downloads from the success of another Android game dubbed “Granny” with 100 million installs as of now.

After the researchers informed Google about the game’s phishing and siphoning abilities, the fully functional game was taken down from the Google Play Store.

A prominent research team realized that the game wouldn’t exhibit any malicious activity up to 2 days to steer clear of security checks.

It would turn in its data-stealing modules lest it were being used on older Android versions with users with new devices which run up to date.

Quite obviously it starts asking for permissions to launch itself on the smartphone or tablet and tries to gain the trust of the users.

Even after the Android users reboot their systems the game still shows full-screen phishing overlays.

Firstly it shows “a notification telling the user to update Google Security Services” and the moment they hit ‘update’ a fake Google Login page appears which looks almost legitimate except for the incorrectly spelled “Sign in”.


Scary Granny, after stealing the users’ credentials it will go on to try to harvest account information like recovery emails, phone numbers, verification codes, DOBs and cookies.

Obfuscated packages are other ways of mimicking official components of the Android apps. For example, com.googles.android.gmspackage attempts to pass itself as the original com.google.android.gms

The Scary Granny would also display some really legitimate looking ads from other prominent applications like Messenger, Pinterest, SnapChat, Zalo or TikTok.

The malicious horror game would make it appear that apps like Facebook and Amazon were actually open when actually they are only ads pretending to be actual applications.

In one of the cases the researchers tried out, the ad directed the user to a page which Google blocked flagging it as being deceptive which clearly implies that it hosts malware or a phishing attack.

After connecting with an ad network by way of com.coread.adsdkandroid2019 package, the ads would get distributed to the compromised Android devices.

At the end, to maximize the profit for its creators, the Scary Granny would try to wrest money form the users by asking them to pay for their playing privileges via a “pre-populated PayPal payment page”.

Over 2,000 malicious apps exists on Play Store

If you thought that the quality control issues plaguing the Google Play Store for Android were finally being ironed out, it couldn't be further from the truth. A two-year-study by the University of Sydney and CSIRO’s Data61 has come to the conclusion that there are at least 2,040 counterfeit apps on Google Play Store. Over 2,000 of those apps impersonated popular games and had malware. The paper, a Multi-modal Neural Embedding Approach for Detecting Mobile Counterfeit Apps, was presented at the World Wide Web Conference in California in May documenting the results.

The study shows that there is a massive number of impersonated popular gaming apps available on Play store. They include fake versions of popular games such as Temple Run, Free Flow and Hill Climb Racing. The study investigated around 1.2 million apps on Google Play Store, available in Android, and identified a set of potential counterfeits for the top 10,000 apps.

Counterfeit apps impersonate popular apps and try to misguide users`. “Many counterfeit apps can be identified once installed. However, even a tech-savvy user may struggle to detect them before installation,” the study says.

It also points out that fake apps are often used by hackers to steal user data or infect a device with malware. “Installing counterfeit apps can lead to a hacker accessing personal data and can have serious consequences like financial losses or identity theft,” reads a blog post by the university.

The study also found that 1,565 asked for at least five dangerous permissions and 1407 had at least five embedded third-party ad libraries.

To investigate these applications on Google Play store the researchers used neural networks.

Google has acknowledged the problem of “malicious apps and developers” in a blog post by Google Play product manager Andrew Ahn on February 13, 2019.

According to Google, the company now removes malicious developers from Play store much faster when compared to previous years. The company says that in 2018 it stopped more malicious apps from entering the store than ever before.

A Google spokesperson, in response to a TOI email, said, “When we find that an app has violated our policies, we remove it from Google Play.”

Pre-installed Android Apps Invade Privacy; Situation Still Out Of Control



Recent studies have provided evidence as to the role the pre-installed android application play in the breach of privacy of users.


Google doesn't seem to be paying enough attention on the issue which concerns security.

Heavy security checks are required of them as similar to the checks done for play store versions of the applications.

According to an independent study led by a group in Spain, personal information could be harvested by these pre-installed applications.

A well-known institute of Madrid IMDEA Institute and Stony Brook University checked out the pre-installed apps on the android devices from over 2700 users, over 1700 devices from around 200 vendors all across 130 countries.

The study didn't go deeper about the EU's General Data Protection Regulation laws and the difference they would make.




Android is a highly customized operating system despite its being owned by Google. This includes the packaging of other applications with the operating system before they are delivered to other users.

As per the aforementioned study, a potential threat to users' privacy prevails by the hands of  the infamous pre-installed apps which never undergo the security checks that the other downloaded apps do.

As usually is the case, pre-installed applications could never be uninstalled and aren't even subject to the severe security checks which are a must to keep the users safe.

It was implied by the co-author of the study that apparently no one keeps track of what the pre-installed applications do. There is a major lack of transparency and regulation.

In reply to all of this, Google said that it provides tools to equipment manufacturers which ensures that Google's  privacy and security standards aren't hampered. 

One of Google's spokespersons also mentioned that clear policies regarding the pre-installed applications are given to their partners also that information related with potential hazards is regularly disseminated to them.

The issue of the pre-installed apps has caught fire quite heavily now. A US department of Justice dug into Facebook. Partnerships are also being looked into.

Google to shut down Google+ and Inbox on April 2





After its social media website Google+, the company has announced that they are now shutting down its Inbox app.

Google will start notifying all its users about the closure of its Inbox from March 18th through a pop-up screen that will pop up every time users will be on the app.

The notification will also include a link to the Gmail app to ensure that it does not disappoint its users. Gmail has recently updated its app with new eye-catching features like Smart Reply, Smart Compose, and Follow-ups.

Now, it is really difficult to find Inbox by Gmail on the Google Play Stores.

The notification released by Google reads:
“This app will be going away in 13 days,” the alert reads. “You can find your favorite inbox features in the Google app. Your messages are already waiting for you.”

While on their official website Google said:

“Inbox is signing off. Find your favorite features in the new Gmail. We are saying goodbye to Inbox at the end of March 2019. While we were here, we found a new way to email with ideas like snooze, nudges, Smart Reply and more. That’s why we’ve brought your favorite features to Gmail to help you get more done. All your conversations are already waiting for you. See you there.”

Malicious Android Adware Infects Approximately 200 Apps on Play Store



 A monstrous adware campaign nicknamed "SimBad" was found to be in around 206 applications on Google Play Store, known to have been downloaded roughly 150 million times. Since most of them are simulation type games, thus the term 'SimBad' has been coined.

The designers of the applications may not be entitled totally to the blame as they also may have been baited by false promises. They may have not understood that they were utilizing a promotion related software development kit or SDK whose reason for existing is to install adware on devices.

Once an application infected by SimBad gets downloaded, the adware registers itself on the system with the goal that it can keep running on boot and from that point onwards, it can perform activities like opening a browser page to phish user information, open an application store including Google Play Store (to be specific) potentially malicious application, or even download and install an application in the background.

As per Security outfit Check Point, the applications perform different malicious behavior that the user's need to be wary of, including:
  1. Showing ads outside of the application, for when the user unlocks their phone or uses other apps.
  2. Constantly opening Google Play or 9Apps Store and redirecting to another particular application, so the developer can profit from additional installations.
  3. Hiding its icon from the launcher in order to prevent uninstallation.
  4. Opening a web browser with links provided by the app developer.
  5. Downloading APK files and asking the user to install it.
  6. Searching a word provided by the app in Google Play.

As a matter of fact, SimBad is less appalling than other malware that got away from Google's notice however it does as of now can possibly accomplish more harm as, according to Checkpoint, "SimBad' has abilities that can be divided into three groups namely - Show Ads, Phishing, and Exposure to other applications.

Keeping in mind the user privacy, Google has officially brought down the infected applications and will doubtlessly add the adware strain to Google Protect’s AI.