Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Endpoint Security

Photo-Stealing Android App Uses Time-Delay Attack

A malicious mobile application targeting Android users managed to trick the Google Bouncer protection system and slip into the Google Play marketplace by employing a time-delay attack technique, Symantec researchers warn.

A malicious mobile application targeting Android users managed to trick the Google Bouncer protection system and slip into the Google Play marketplace by employing a time-delay attack technique, Symantec researchers warn.

The malicious application, called Beaver Gang Counter but detected as Android.Vibleaker, was mainly designed to steal photos and videos from the popular social media app Viber. The program claims to be a score keeping app for a popular card game, but instead it searches the devices it has been installed on for media files related to Viber, after which it sends them to a remote server.

Since Viber is a highly popular social media service, its mobile applications are highly praised too. The Android version has seen more than 500 million installs on Google Play alone, and it’s no wonder that criminals decided to target it.

By integrating their program with code that enables it to search directories used by the Viber app to store images and videos, the attackers could locate and steal user’s media. According to a blog post from the Symantec Security Response team, the stolen data could be used for various nefarious purposes, including identity theft, blackmail, fraud, or pornography.

The malicious application didn’t include only the data stealing capabilities, but was also leveraging a technique that security researchers have been seeing increasingly often in the wild: time-delayed attacks. This means that the program did not engage in its malicious activity right from the start, which allowed it to bypass Google’s security features.

Instead, “the command and control (C&C) server is queried to check if the media files should be collected,” Symantec researchers explain. This also means that the threat actor could enable and disable the application’s malicious behavior at will, thus circumventing any security mechanism in use, including Google Play’s app-vetting service.

Cybercriminals have been long engaged into stealing photos or videos from user’s devices and online accounts, but they have been mainly focused on celebrity accounts so far. However, the presence of this malicious application in Google Play shows that having photos stolen from a mobile device is a risk that all Android users need to be aware of.

“As more and more of our work and personal lives move onto our smartphones, we’re seeing the emergence of new and greater risks to consumers. With increasing sophistication malware authors are taking advantage of the wealth of personal information travelling around in our pockets,” Symantec says. The security company alerted Google on this application’s nefarious behavior and the Internet giant has already removed it from Google Play.

Advertisement. Scroll to continue reading.

To stay protected from similar threats, users are advised to pay extra attention to the permissions an application asks for. They should also install a mobile security program on their devices, should keep data backed up at all times, should keep all applications updated at all times, and should avoid downloading and installing programs from untrusted sources.

Related: ‘Godless’ Android Malware Uses Multiple Rooting Exploits

Related: Banking Trojans Abuse API to Evade Android Security

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Endpoint Security

Today, on January 10, 2023, Windows 7 Extended Security Updates (ESU) and Windows 8.1 have reached their end of support dates.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Endpoint Security

Gigabyte has announced BIOS updates that remove a recently identified backdoor feature in hundreds of its motherboards.

Endpoint Security

Several major companies have published advisories in response to the Downfall vulnerability affecting Intel CPUs.

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...

CISO Strategy

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Endpoint Security

The Zero Day Dilemma

Endpoint Security

When establishing visibility and security controls across endpoints, security professionals need to understand that each endpoint bears some or all responsibility for its own...