Android apk malware

Question

I was browsing some website last night and that website suddenly sent me an apk called 'browser_update_install.apk', DrWeb light detect it and was able to delete it.

My question here is about the apk itself, was there any incidents where apks are able to self execute and override permissions of 'install from unknown source'?

I've googled this topic but found nothing but speculations and guides about best practices.

Here is a picture of what was detected (DrWeb detection)

Thanks

Edit: forgot to say that the malware I'm talking about is at the bottom in case it wasn't obvious.

Answer 1

I've seen an Android 2 Gingerbread PoC game app in which you were supposed to tap moving objects. The trick was that after tapping a few objects, the app would call the settings page where the "unknown sources" is. The next object to be tapped was right where the check box appeared so it would trick the user into tapping it. Then the game would focus on itself so the trick was barely noticeable.

Android 4 still allows apps to pop settings pages (the Maps app pops up the GPS settings screen) but it added a confirmation message for when you allow unknown sources. This confirmation message would still be vulnerable to the same trick but it would be more noticeable.

The name of the APK above suggests a social engineering trick to get the user to install the APK on a phone that hopefully has "Allow installation of non-Market apps" (aka "Unknown sources") setting checked. But a legitimate Play store app could trick a user into allowing unknown sources and then it could direct to a site similar to the one mentioned in this question.

This kind of blended attacks are real but don't cause large scale compromises worthy of media attention .... until they steal 36 million euros.