New ‘Fraud Arms Race’ Underway
Getty
It’s a seriously compelling offer—of that there can be no doubt. The Best Fortune Explorer app on Google’s Play Store promises a test that will “help you to find out the answer” to a number of critical life questions. “Do you want to know when your true love will come? Do you want to know if you will be given a promotion and an increase in salary in the future?” Of course you do, who wouldn’t. Better still, the app is free—all of this wisdom is available without charge. Unfortunately, for the near 200,000 Android users that have taken the plunge, a new report claims the only thing that’s certain in their future is malware and a plague of fraudulent ads.
Google Play Store / 20 December 2019
The app is just one of many disclosed by the research team at White Ops Threat Intelligence on December 19. The “100+ malicious apps, with more than 4.6 million downloads” all threaten the same fraudulent outcome, each using a common code module that the research team has named “Soraka.” Worse, though, this strain of adware actively hides, making itself harder to detect and delete. “Those hiding behaviors are significant,” White Ops’ John Laycock told me. “The fraudsters are getting smarter—they know this is now an arms race, they’re trying to slow down analysis with these tactics. We’re seeing these types of behaviours more and more.”
Many of the disclosed apps are relatively recent additions. Leveraging these latest, more sophisticated tools and techniques. Despite report after report, the prevalence of Play Store adware seems to show no signs of abating—there have now been hundreds of apps removed and millions of downloads impacted. And while such malware is usually just a nuisance, we have seen subscription and call fraud masquerading in the same way, and—as ever—the real warning is that any malware on your device is very much a bad thing to be avoided. Adware can—and does—lead to worse outcomes.
Right at the heart of this issue is free, often nonsensical apps. As I’ve written many times, free is free for a reason. If you’re not paying for an app in an obvious way, then you’re paying for it in some other way. The ability to sneak countless ad displaying machines onto your device makes millions for the fraudsters—there is often common code, developers, operators sitting behind numerous bad apps. The concept is simple, develop something flippant and catchy, offer it for nothing, wait.
The store reviews often give the issue away, this despite the efforts of many operators to obfuscate by promoting their apps with fake reviews to pump their popularity. But the fortune telling app has not gone to such lengths. “The main problem,” one reviewer warns, “is that you will get non stop ads—it’s like a virus.” Another complains that “this app doesn't work,” I’m assuming that’s a technical issue and not a complaint that it failed to accurately predict the future—but you never know.
The developers of this particular malicious code module have focused on avoiding detection from antivirus software and security researchers. The apps will only display ads if the install follows a promotional push, in essence a user responding to a click, an invite to install. The app seeks to avoid detection from organic installs—meaning automated systems that find and install the app and then check it for any unwanted threats. This is part of a framework that can flex the numbers of ads delivered over time windows, all based on the behaviours and status of the infected device.
The fraudsters had “several methods to maintain what we call persistence,” Laycock explained. “The other was obfuscation—we’ve seen that before, but it was interesting to us that they were using characters from the Udmurt language.” A Cyrillic character was used within the code execution “to make analysis more difficult.” Udmurt is a local dialect from the Volga region of Russia. Whether this was selected at random for its obscurity or because there are Russian origins to the code has not been disclosed.
Other apps disclosed by White Ops and found to be hiding the same malicious code are listed below. They include a bedtime reminder, a “cute” love test, a lie detector and even a days counter. They’re all free and, according to White Ops, they should all be removed immediately. As to why Android seems to be plagued by such issues—Laycock puts it down to scale, the use of open source code and side loading from third party stores. More simply, “it’s like the Willie Sutton quote,” he told me. “‘Why do you rob banks? Because that’s where the money is’.”
Both the developer behind the Best Fortune Explorer app and Google were asked for comments before this story was published. Nothing has been received as yet. Google was also given the full list of apps, many of which remain on the Play Store, available for download—including, at the time of publishing, the Best Fortune Explorer itself.
As always in such reports, the advice remains to take care on what you allow onto your phone. When it’s free, trivial and from an unknown developer, it’s best avoided. And if you do download such apps, be mindful of the permissions you are granting. Once you allow a malicious app access to your data, phone, camera and microphone, contacts, then you are inviting much more serious trouble than adware.
The App Packages that White Ops says contain the Soraka module or derivatives are below. It is worth quickly checking your installed apps against the list.
- com.cute.love.test.android
- com.daily.wonderfull.moment
- com.dailycostmaster.android
- com.dangerous.writing.note
- com.data.securite.data
- com.days.daysmatter365.android
- com.days.remind.calendar
- com.detector.noise.tool
- com.dodge.emoji.game
- com.dog.bark.picture.puzzle
- com.drink.water.remind.you
- com.ezzz.fan.sleep.noise
- com.fake.call.girlfriend.prank2019
- com.fakecaller.android
- com.fake.caller.plus
- com.false.location
- com.fancy.lovetest.android
- com.fast.code.scanner.nmd
- com.filemanagerkilopro.android
- com.filemanagerupro.android
- com.filemanageryo.android
- com.filemanagerzeropro.android
- com.find.difference.detective.little
- com.find.you.lover.test
- com.frame.easy.phone
- com.frank.video.call.lite
- com.free.code.scanner.nmd
- com.free.lucky.prediction.test
- com.funny.lie.truth.detector
- com.funny.word.game.english
- com.game.color.hunter
- com.ice.survival.berg
- com.idays.dayscounter.android
- com.important.days.matter
- com.instanomo.android
- com.isleep.cycleclock.android
- com.led.color.light.rolling
- com.lite.fake.gps.location
- com.lovetest.plus.android
- com.love.yourself.women
- com.lucky.charm.text
- com.lucky.destiny.teller
- com.magnifying.glass.tool
- com.math.braingame.puzzle.riddle
- com.math.iq.puzzle.riddle.braingame
- com.math.puzzles.riddle.braingame
- com.multiple.scanner.plus.nmd
- com.my.big.days.counter
- com.my.constellation.love.work
- com.my.pocker.mobile.mirror
- com.nanny.tool.data
- com.nice.mobile.mirror.hd
- com.nomophotoeditor.android
- com.non.stop.writing
- com.phone.lite.frame
- com.phone.mirror.pro
- com.pocker.pro.mobile.mirror
- com.prank.call.fake.ring
- com.phonecallmaker.android
- com.pro.test.noise
- com.puzzle.cute.dog.android
- com.scan.code.tool
- com.simple.days.counter
- com.sleep.comfortable.sounds
- com.sleep.in.rain
- com.sleepassistantool.android
- com.sleeptimer.android
- com.smart.scanner.master.nmd
- com.test.find.your.love
- com.test.fortune.tester
- com.test.lover.match
- com.tiny.scanner.tool.nmd
- com.wmmaster.android
- com.word.fun.level.english
- good.lucky.is.coming.hh
- mobi.clock.android
- my.lucky.goddness.today.test
- newest.android.fake.location.changer
- nmd.andriod.better.calculator.plus
- nmd.andriod.mobile.calculator.master
- nmd.android.best.fortune.explorer
- nmd.android.better.fortune.signs
- nmd.android.clam.white.noise
- nmd.android.fake.incoming.call
- nmd.android.good.luck.everyday
- nmd.android.location.faker.master
- nmd.android.multiple.fortune.test
- nmd.android.scanner.master.plus
- nmd.android.test.what.suitable
- photo.editor.pro.magic
- pic.art.photo.studio.picture
- relax.ezzz.sleep.cradle
- super.lucky.magican.newest
- test.you.romantic.quize
- well.sleep.guard.relax
- your.best.lucky.master.test.new
- com.ssdk.test
- bedtime.reminder.lite.sleep
- com.frank.video.call.lite.pro.prank
- com.personal.fortune.text
- com.daily.best.suit.you
- com.false.call.trick
- magicball.funnyapp.useful.crystal
- yourdestinypredict.yourlifetest.amazingma gic
">
Getty
It’s a seriously compelling offer—of that there can be no doubt. The Best Fortune Explorer app on Google’s Play Store promises a test that will “help you to find out the answer” to a number of critical life questions. “Do you want to know when your true love will come? Do you want to know if you will be given a promotion and an increase in salary in the future?” Of course you do, who wouldn’t. Better still, the app is free—all of this wisdom is available without charge. Unfortunately, for the near 200,000 Android users that have taken the plunge, a new report claims the only thing that’s certain in their future is malware and a plague of fraudulent ads.
Google Play Store / 20 December 2019
The app is just one of many disclosed by the research team at White Ops Threat Intelligence on December 19. The “100+ malicious apps, with more than 4.6 million downloads” all threaten the same fraudulent outcome, each using a common code module that the research team has named “Soraka.” Worse, though, this strain of adware actively hides, making itself harder to detect and delete. “Those hiding behaviors are significant,” White Ops’ John Laycock told me. “The fraudsters are getting smarter—they know this is now an arms race, they’re trying to slow down analysis with these tactics. We’re seeing these types of behaviours more and more.”
Many of the disclosed apps are relatively recent additions. Leveraging these latest, more sophisticated tools and techniques. Despite report after report, the prevalence of Play Store adware seems to show no signs of abating—there have now been hundreds of apps removed and millions of downloads impacted. And while such malware is usually just a nuisance, we have seen subscription and call fraud masquerading in the same way, and—as ever—the real warning is that any malware on your device is very much a bad thing to be avoided. Adware can—and does—lead to worse outcomes.
Right at the heart of this issue is free, often nonsensical apps. As I’ve written many times, free is free for a reason. If you’re not paying for an app in an obvious way, then you’re paying for it in some other way. The ability to sneak countless ad displaying machines onto your device makes millions for the fraudsters—there is often common code, developers, operators sitting behind numerous bad apps. The concept is simple, develop something flippant and catchy, offer it for nothing, wait.
The store reviews often give the issue away, this despite the efforts of many operators to obfuscate by promoting their apps with fake reviews to pump their popularity. But the fortune telling app has not gone to such lengths. “The main problem,” one reviewer warns, “is that you will get non stop ads—it’s like a virus.” Another complains that “this app doesn't work,” I’m assuming that’s a technical issue and not a complaint that it failed to accurately predict the future—but you never know.
The developers of this particular malicious code module have focused on avoiding detection from antivirus software and security researchers. The apps will only display ads if the install follows a promotional push, in essence a user responding to a click, an invite to install. The app seeks to avoid detection from organic installs—meaning automated systems that find and install the app and then check it for any unwanted threats. This is part of a framework that can flex the numbers of ads delivered over time windows, all based on the behaviours and status of the infected device.
The fraudsters had “several methods to maintain what we call persistence,” Laycock explained. “The other was obfuscation—we’ve seen that before, but it was interesting to us that they were using characters from the Udmurt language.” A Cyrillic character was used within the code execution “to make analysis more difficult.” Udmurt is a local dialect from the Volga region of Russia. Whether this was selected at random for its obscurity or because there are Russian origins to the code has not been disclosed.
Other apps disclosed by White Ops and found to be hiding the same malicious code are listed below. They include a bedtime reminder, a “cute” love test, a lie detector and even a days counter. They’re all free and, according to White Ops, they should all be removed immediately. As to why Android seems to be plagued by such issues—Laycock puts it down to scale, the use of open source code and side loading from third party stores. More simply, “it’s like the Willie Sutton quote,” he told me. “‘Why do you rob banks? Because that’s where the money is’.”
Both the developer behind the Best Fortune Explorer app and Google were asked for comments before this story was published. Nothing has been received as yet. Google was also given the full list of apps, many of which remain on the Play Store, available for download—including, at the time of publishing, the Best Fortune Explorer itself.
As always in such reports, the advice remains to take care on what you allow onto your phone. When it’s free, trivial and from an unknown developer, it’s best avoided. And if you do download such apps, be mindful of the permissions you are granting. Once you allow a malicious app access to your data, phone, camera and microphone, contacts, then you are inviting much more serious trouble than adware.
The App Packages that White Ops says contain the Soraka module or derivatives are below. It is worth quickly checking your installed apps against the list.
- com.cute.love.test.android
- com.daily.wonderfull.moment
- com.dailycostmaster.android
- com.dangerous.writing.note
- com.data.securite.data
- com.days.daysmatter365.android
- com.days.remind.calendar
- com.detector.noise.tool
- com.dodge.emoji.game
- com.dog.bark.picture.puzzle
- com.drink.water.remind.you
- com.ezzz.fan.sleep.noise
- com.fake.call.girlfriend.prank2019
- com.fakecaller.android
- com.fake.caller.plus
- com.false.location
- com.fancy.lovetest.android
- com.fast.code.scanner.nmd
- com.filemanagerkilopro.android
- com.filemanagerupro.android
- com.filemanageryo.android
- com.filemanagerzeropro.android
- com.find.difference.detective.little
- com.find.you.lover.test
- com.frame.easy.phone
- com.frank.video.call.lite
- com.free.code.scanner.nmd
- com.free.lucky.prediction.test
- com.funny.lie.truth.detector
- com.funny.word.game.english
- com.game.color.hunter
- com.ice.survival.berg
- com.idays.dayscounter.android
- com.important.days.matter
- com.instanomo.android
- com.isleep.cycleclock.android
- com.led.color.light.rolling
- com.lite.fake.gps.location
- com.lovetest.plus.android
- com.love.yourself.women
- com.lucky.charm.text
- com.lucky.destiny.teller
- com.magnifying.glass.tool
- com.math.braingame.puzzle.riddle
- com.math.iq.puzzle.riddle.braingame
- com.math.puzzles.riddle.braingame
- com.multiple.scanner.plus.nmd
- com.my.big.days.counter
- com.my.constellation.love.work
- com.my.pocker.mobile.mirror
- com.nanny.tool.data
- com.nice.mobile.mirror.hd
- com.nomophotoeditor.android
- com.non.stop.writing
- com.phone.lite.frame
- com.phone.mirror.pro
- com.pocker.pro.mobile.mirror
- com.prank.call.fake.ring
- com.phonecallmaker.android
- com.pro.test.noise
- com.puzzle.cute.dog.android
- com.scan.code.tool
- com.simple.days.counter
- com.sleep.comfortable.sounds
- com.sleep.in.rain
- com.sleepassistantool.android
- com.sleeptimer.android
- com.smart.scanner.master.nmd
- com.test.find.your.love
- com.test.fortune.tester
- com.test.lover.match
- com.tiny.scanner.tool.nmd
- com.wmmaster.android
- com.word.fun.level.english
- good.lucky.is.coming.hh
- mobi.clock.android
- my.lucky.goddness.today.test
- newest.android.fake.location.changer
- nmd.andriod.better.calculator.plus
- nmd.andriod.mobile.calculator.master
- nmd.android.best.fortune.explorer
- nmd.android.better.fortune.signs
- nmd.android.clam.white.noise
- nmd.android.fake.incoming.call
- nmd.android.good.luck.everyday
- nmd.android.location.faker.master
- nmd.android.multiple.fortune.test
- nmd.android.scanner.master.plus
- nmd.android.test.what.suitable
- photo.editor.pro.magic
- pic.art.photo.studio.picture
- relax.ezzz.sleep.cradle
- super.lucky.magican.newest
- test.you.romantic.quize
- well.sleep.guard.relax
- your.best.lucky.master.test.new
- com.ssdk.test
- bedtime.reminder.lite.sleep
- com.frank.video.call.lite.pro.prank
- com.personal.fortune.text
- com.daily.best.suit.you
- com.false.call.trick
- magicball.funnyapp.useful.crystal
- yourdestinypredict.yourlifetest.amazingma gic
Gloss