#BlackHat: Researchers upload dangerous app to Google Play store

Powered by SC Magazine
 

Google's Bouncer beat by legit JavaScript trick.

View larger image View larger image View larger image

See all pictures here »

Two researchers demonstrated how they were able to push a malicious information-stealing app onto Google Play, even while Google's Bouncer custom malware scanner is watching.

They circumvented the Bouncer automated scanner with a JavaScript trick that transformed a benign Android app into a malicious one on Google Play.

Black Hat 2012 coverage

Nicholas Percoco and Sean Schulte of Trustwave Spider Labs developed a benevolent app called “SMS Bloxer,” which looked like other SMS blocker apps on the market.

In order to ensure regular users didn't accidentally download the app, Trustwave also priced it at $49.95, in stark contrast to similar apps, which were usually $2 or less, or free.

SMS Bloxer lived on Google Play for two weeks and didn't get flagged by Bouncer for that entire period of time. At its worst, the app was capable of  stealing contacts, SMS messages, and photos.

It could harvest information about the device or force a web page to load, the researchers said. It could also launch a denial-of-service attack.

“Google never flagged it,” Percoco said.

The internet giant, recognising that malicious applications were becoming a growing problem, introduced Bouncer in February.

Google must have realized reacting was a losing battle and some kind of app review was needed, hence Bouncer, Schulte said. There wasn't a lot of information available publicly about the technology or how it worked, which piqued Trustwave's curiosity, Percoco said.

“We wanted to test the bounds of what it's capable of," Percoco said.

The team created a benign app that just reported back to Trustwave whenever it was executed, and made it past Bouncer and onto Google Play. The team had determined Bouncer's IP address by this time, and modified the test app to act maliciously only if it was executed outside Bouncer. 

To avoid detection, the team used  the JavaScript bridge, a “legitimate” workaround supported by Android, Percoco said.

The bridge lets developers remotely add new  features to a program using JavaScript, or changing the look and feel of an app by modifying the HTML, without having to go back through the entire app approval or update process. Facebook and LinkedIn use this method for their apps, Percoco said.

Trustwave used the JavaScript bridge to add increasingly malicious capabilities to the app. Bouncer scanned the app repeatedly, but never noticed the new malicious features. Only when the team tweaked the app to execute every second did Bouncer notice it and suspend the developer account, Percoco said.

Trustwave shared its findings with Google, and Percoco said the company was a “great organization to work with." A Google spokesperson could not be reached for comment by SCMagazine.com.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


 
 
 
Top Stories
NewSat defaults on $26m in overdue Lockheed payments
Jabiru-1 satellite build hits further hurdles.
 
IBM denies plans to cut 112k jobs
But admits to further restructuring.
 
ATO investigates 25 tech giants in tax hunt
Prepared to take tax evaders to court.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Franchisees, here's something you should know about
Jan 23, 2015
You need to know the Code if you are a franchisee or franchisor as the penalties are significant.
Xero users rejoice! Quoting has finally arrived
Jan 23, 2015
It has taken years, but Xero has at last added integrated quoting to its online accounting software.
You can now get a no-contract wi-fi tablet from Telstra
Jan 17, 2015
Telstra has began selling wi-fi tablets out of contract without paying extra for cellular ...
Get your business ready for 2015: mobile payments
Jan 2, 2015
These handy apps from MYOB, Xero and others can reduce your administrative load and improve ...
Xero prepares for key feature coming in 2015
Dec 19, 2014
Xero users will be able to track how their business is comparing to other Xero users.
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  36%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 3055

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 971

Vote