Researchers have detected an Android trojan that abuses the web push technology. In its benign use, web push is used by legitimate websites — such as news sites — to send out new event notifications. The less benign use is to employ the technology to send out what amounts to phishing notifications.
Android.FakeApp.174 was discovered by Doctor Web researchers in two apps on Google Play. These have since been removed. The malware pretends to be the official app of a major brand. However, when the app is launched, it opens a series of websites in Chrome. Each website asks the user to allow notifications — sometimes openly, and sometimes disguised as verification proof that the user is human and not a robot.
If notifications are allowed by the user, those websites start sending out dubious content. The notifications are received and displayed in the Android status bar even if the browser is closed, and even if the app has been removed. The contact is now between the website and the device — and the user has given permission for the website to contact it.
The content delivered is dubious to say the least, “from false notifications about cash bonuses or transfers or new messages on social media to advertisements of horoscopes, casinos, goods and services, even various ‘news’.” Since the attacker has control over the notifications, it could be anything. Examples found by Doctor Web include links to casino sites, adult sites, phishing sites, and snake oil medicines.
“Many of these resources,” warn the researchers, “are involved in well-known fraudulent schemes for stealing funds, but attackers can also launch an attack to steal confidential data at any time. For example, by sending an ‘important’ notification via the browser on behalf of a bank or a social network. Potential victims can think the fake notification is real and tap it only to be redirected to a phishing site, where they will be prompted to indicate their name, credentials, email addresses, bank card numbers, and other confidential information.”
Abuse of web push technology is not new and not limited to mobile applications. Malwarebytes published a separate report yesterday warning that attackers are using the same approach with browser extensions for Chrome and Firefox. “These threats pose as useful plugins then haggle users with notifications.”
Malwarebytes classifies this category of extension as PUP.Optional.extension_name. PUP stands for ‘potentially unwanted program’. Optional indicates that some genuine functionality is usually offered, and the user chooses to install it.
Two examples are discussed: StreamAll for Chrome, and a family of Firefox extensions that Malwarebytes calls Trojan.FBSpammer. The primary purpose of StreamAll is to get the user to accept notifications — and therefore unrequested adverts — while promoting itself as a movie search and stream extension.
The second family of push PUPs is downloaded from sites that try to convince users they need a Flash player update. Like StreamAll, they ask for notifications to be allowed, and then push out adverts from an ad provider. But this family goes further. If the user is logged into Facebook, the extension will join the user to some Facebook groups, and then spam the members — giving, says Malwarebytes, “your Facebook reputation a quick shove into the cellar.”
The solution to abused push technology is to be very careful where it is allowed. There are some genuinely valuable uses of the technology, so it would be counterproductive to simply deny all — but care needs to be taken. This goes for both browser extensions and mobile apps.
Related: The Battle With “Potentially Unwanted” Programs in the Enterprise
Related: Malwarebytes Scores Legal Win Over Enigma Software
Related: Behind the Scenes in the Deceptive App Wars
Related: Researchers Expose Huge Ad Scam Operation
Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.
More from Kevin Townsend
- Threat Actor Abuses SuperMailer for Large-scale Phishing Campaign
- Quantum Decryption Brought Closer by Topological Qubits
- IBM Delivers Roadmap for Transition to Quantum-safe Cryptography
- CISO Conversations: HP and Dell CISOs Discuss the Role of the Multi-National Security Chief
- Court Rules in Favor of Merck in $1.4 Billion Insurance Claim Over NotPetya Cyberattack
- Open Banking: A Perfect Storm for Security and Privacy?
- Apiiro Launches Application Attack Surface Exploration Tool
- Phylum Adds Open Policy Agent to Open Source Analysis Engine
Latest News
- Chrome 114 Released With 18 Security Fixes
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Breaking Enterprise Silos and Improving Protection
- Spyware Found in Google Play Apps With Over 420 Million Downloads
- Millions of WordPress Sites Patched Against Critical Jetpack Vulnerability
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
- PyPI Enforcing 2FA for All Project Maintainers to Boost Security
- Personal Information of 9 Million Individuals Stolen in MCNA Ransomware Attack
