0

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online.

I have seen many ads in many apps I use in my android phone and never thought it could compromise my privacy. I wish to know what could be the possible exploits for this adware vulnerability apart from the classic social engineering attacks. If there are exploits other than social engineering I wish to know whether It can be prevented from the developer side or not. The fact is, a developer can't do anything to avoid social engineering attacks right?

1

If Android's safety features are intact (and nothing in the article suggests that they would be compromised), the adware can do only two things:

  • use the permissions the "mother app" was equipped with
  • trick the user into installing other apps, in order to deliver new payload and/or gain new permissions

Then the malicious software in the "mother app" or the newly installed app can abuse permissions it has. These abusable permissions include:

  • Dialing phone numbers and sending SMS directly. The attacker can have your device call or message their paid service without your consent, pulling money out of your account.
  • Reading contact details. They can get all your contacts' e-mail addresses and put them into a spam database.
  • Reading/writing the filesystem, gaining access to confidential things you store there. I don't know if it exists yet, but a CryptoLocker for Android could also be possible.

My personal view is that this report has no real information value, it's just some antivirus software marketing or empty content to keep that blog running. I would not even call this a vulnerability, at least not an Android one. It is a human vulnerability. I mean, this kind of thing has been going on for ages. It's the "Don't believe the flashing You're the 1000000th visitor, click here to claim your prize!, Quick painless penis enlargement and/or Viagra for cheap and Install our registry cleaner and speed up your PC" thing all over again. It's maybe meant to be a warning for people who install any seemingly interesting app that crosses their way without even checking the permissions.

From the Android system developers' view there can't be really much done to prevent this. They already really went out of their way to produce a platform that prevents accidental app installs and permission abuse, but there will always be a lot of gullible people who believe flashing ads so much that they disable security measures when they're asked to.

From the app developers' view: don't use ad providers you don't trust. Ad providers often provide obfuscated code for you to include in your app in order to prevent you from tampering with it to trick them. This also prevents you from understanding what the code does, and it could do exactly this kind of thing.

  • I was also thinking in the same way. I had a few doubts and that's why posted this question here. One is whether it is possible to incorporate this with android webview vulnerability and the other whether there is any possibility of xss? – Anandu M Das Feb 5 '15 at 11:55
  • In the WebView vulnerability, the attacker is a webpage, and the vulnerability grants access to the rights the app providing the vulnerable WebView has. So it grants the malicious ad provider (which hosts the WebView) no additional rights. XSS would also not be possible in the traditional sense, because the system browser and WebViews are isolated. It would be possible to get the user to use their rogue browser and get their credentials and do evil stuff XSS was invented for - but a) that's still not XSS and b) I seriously hope no one's gullible enough to log into their bank acc in a popup. – matega Feb 5 '15 at 12:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.