Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

A New Trend in Android Adware: Abusing Android Plugin Frameworks

Summary: Unit 42 researchers found adware in Google Play abusing the third-party DroidPlugin and VirtualApp frameworks, which let a host app launch other apps as plugins without installing them; 32 apps used DroidPlugin and 21 used VirtualApp, mostly PUPs or adware removed from Google Play. The 'Clean Doctor' app (com.nianclub.cleandoctor) fetched tasks from the C2 server familysdk[.]com, downloaded promoted apps, and launched them via home-screen shortcuts or automatically on system events, while 'bloodpressure' (com.blood.pressure.bost) used VirtualApp to display multiple ads on one screen and was removed in early February 2017 with 10,000 to 50,000 installs.

What you should know: These plugin frameworks cannot separate permissions or isolate data between plugin instances, so a promoted app runs with the host app's permissions - typically all Android permissions - and can read the host's data or other plugin apps' data, breaking the Android Application Sandbox that legitimate apps assume protects them.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related