Dear Visitor,

Our system has found that you are using an ad-blocking browser add-on.

We just wanted to let you know that our site content is, of course, available to you absolutely free of charge.

Our ads are the only way we have to be able to bring you the latest high-quality content, which is written by professional journalists, with the help of editors, graphic designers, and our site production and I.T. staff, as well as many other talented people who work around the clock for this site.

So, we ask you to add this site to your Ad Blocker’s "white list" or to simply disable your Ad Blocker while visiting this site.

Continue on this site freely
  HOME     MENU     SEARCH     NEWSLETTER    
THE ENTERPRISE SECURITY SUPERSITE. UPDATED 2 MINUTES AGO.
You are here: Home / Viruses & Malware / 'Judy' Malware Hits Android Devices
'Judy' Malware Potentially Hits Up to 36.5M Android Devices
'Judy' Malware Potentially Hits Up to 36.5M Android Devices
By Chloe Albanesius Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
MAY
30
2017
Up to 36.5 million Android devices may have been infected by malware that produced fake ad clicks and lined the pockets of its developers. As outlined by security firm Check Point, 41 apps developed by Korea-based Kiniwini and published under the moniker ENISTUDIO Corp., "infected devices to generate large amounts of fraudulent clicks on advertisements, generating revenues for the perpetrators behind it."

It's "possibly the largest malware campaign found on Google Play," according to Check Point.

Google "swiftly" removed the apps from Google Play after being alerted to their existence, Check Point says, but not before they "reached an astonishing spread between 4.5 million and 18.5 million downloads." Some were available on the store for several years and all were recently updated.

"It is unclear how long the malicious code existed inside the apps, hence the actual spread of the malware remains unknown," Check Point says, but those download numbers mean "the total spread of the malware may have reached between 8.5 and 36.5 million users."

The malware was dubbed Judy by Check Point after the title character in Kiniwini's apps. Chef Judy: Picnic Lunch Maker, for example, encourages players to "create delicious food with Judy." But Judy-themed games ran the gamut, from "Animal Judy" and "Fashion Judy."

How does Judy infect your device? Hackers create an innocuous app that can get around Google's Bouncer security screening and is added to an app store.

"Once a user downloads a malicious app, it silently registers receivers which establish a connection with the [Command and Control] server," Check Point says. "The server replies with the actual malicious payload, which includes JavaScript code, a user-agent string and URLs controlled by the malware author. The malware opens the URLs using the user agent that imitates a PC browser in a hidden webpage and receives a redirection to another website. Once the targeted website is launched, the malware uses the JavaScript code to locate and click on banners from the Google ads infrastructure."

Check Point likens Judy to two previous exploits: FalseGuide and Skinner. And like another bug, DressCode, Judy hid behind good reviews. "Hackers can hide their apps' real intentions or even manipulate users into leaving positive ratings, in some cases unknowingly. Users cannot rely on the official app stores for their safety, and should implement advanced security protections capable of detecting and blocking zero-day mobile malware," Check Point says.

Kiniwini develops apps for iOS and Android, Check Point says, but it did not mention any problems with the iOS apps. As of Sunday afternoon, 45 ENISTUDIO Corp. Judy apps are available in the App Store, most of which appear to have last been updated on March 31.

© 2017 Post & Courier under contract with NewsEdge/Acquire Media. All rights reserved.
Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
MORE IN VIRUSES & MALWARE
ENTERPRISE SECURITY TODAY
NEWSFACTOR NETWORK SITES
NEWSFACTOR SERVICES
© Copyright 2017 NewsFactor Network. All rights reserved. Member of Accuserve Ad Network.