Experts at Wandera’s threat research team discovered two adware apps on the Google Play Store that were downloaded 1.5M+ times.

Researchers at Wandera discovered two adware selfie filter camera apps on the Google Play that were pushing ads and that can record audio. The bad news is that the two apps were downloaded 1.5M+ times.

The two apps are Sun Pro Beauty Camera (1M+ installs) and Funny Sweet Beauty Selfie Camera (500K installs).

The researchers discovered that both APKs are packed with a Chinese packer, Ijiami, to prevent their analysis.

The adware pushed by the two malicious app covered the entire display of the Android device. The analysis of the two apps revealed that they required additional permissions such as access to the camera.

The two apps request RECORD_AUDIO permission that allows the app to record audio with the microphone at any moment without the user’s confirmation.

Both apps request the SYSTEM_ALERT_WINDOW permission that allows the app to overlay some information and trick the user into clicking something he did not want or typing sensitive data.

Once the apps are launched, they created a shortcut and then removed itself from the app drawer. This trick attempt to ensure persistence, even after uninstalling the shortcut, the app remains active and runs g in the background.

One of the main differences between the two apps is that SunPro Beauty Camera did not even need to be launched to push the ads, while the Funny Sweet Beauty Camera starts displaying the ads only when the app is used to download filtered photos on the device.

The experts reported the apps to Google on September 11 and the tech giant immediately removed them from Google Play.

Below recommendations published by the experts:

Check your app inventory for installations of these apps (Wandera customers can see this in the Security Threat View where the apps will be flagged as adware)Remove instances of the apps if they have been installedAlways vet the security of apps, even if they are downloaded from official stores (Wandera customers can do this using App Insights)

window._mNHandle = window._mNHandle || {};
window._mNHandle.queue = window._mNHandle.queue || [];
medianet_versionId = “3121199”;

try {
window._mNHandle.queue.push(function () {
window._mNDetails.loadTag(“762221962”, “300×250”, “762221962”);
});
}
catch (error) {}

Pierluigi Paganini

(SecurityAffairs – Android, Adware)

The post Two selfie Android adware apps with 1.5M+ downloads removed from Play Store appeared first on Security Affairs.