Wednesday, October 2, 2013

Ad more instead of AdBlock Plus

This is one of those scenarios in which the user seeks protection but only discovered problems. Sergio de los Santos, a friend of mine, has shared with me a link to a fake App that pretends to be AdBlock Plus, the well known and useful application that many users have in their web browser. At the time of downloading, the application has been active in the game Google and all those which are downloaded instead of the application of blocking unwanted on their web browser, received more accurate opposite ads and more problems related to the confidentiality of the data.

I say this because its code analysis, could point out that it is actually an adware. Kaspersky Anti-virus detects as Hour: AdWare.AndroidOS.Starsys.b

But what exactly does this do malicious application, once installed on the victim s device? The answer is that he made many things, among which are:


android.permission.READ_LOGS (read archive of your device logs, which include sensitive personal data of the user)
android.permission.BLUETOOTH (interacts with the bluetooth configuration to be able to edit it and allow incoming connections from other devices that are in the s Protocol reach)
android.permission.INTERNET (provides applications need access to Internet)
android.permission.RECEIVE_SMS (interacts with SMS messages, reads them and can even remove them without the consent of the victim s)
android.permission.READ_CONTACTS (has access to all contacts in your diary)


Adware is monetized by RevMob https://www.revmobmobileadnetwork.com
The same RevMob page explains how it works:


A simple and effective ad unit prompts the user to download a free application. You get paid for clicks and installs. ?


It comes from the use, that Adblock Plus creators have reserved this fake App. Fortunately, of that writing this post, the $ $ malicious app had already been removed.

No comments:

Post a Comment

Popular Posts