Androids are one of the major platforms for the hackers to capitalize on, with the recent increase in virus threats, attackers have capitalized on the opportunity and played on people’s fears by offering them Android anti-virus apps that are, in reality, another malware.
Malicious ‘Antivirus’ Apps are Everywhere
Leveraging the threat of malware infections to drive downloads of potentially unwanted programs, worthless mobile apps, and even malware isn’t limited to the WannaCry theme. Using RiskIQ’s mobile database, hundreds of examples of apps that claimed to help defend mobile phones were found, instead, to be preying on unsuspecting users by pushing adware, trojans, and other malware:
Fig-1: “Androids Antivirus” an antivirus app discovered in the Mobiles24 store with its associated VirusTotal hits on the right
Using a title search for “Antivirus” resulted in 6,295 total apps, past and present, claiming to either be an antivirus solution, review antivirus solutions or be associated with antivirus software in some way. More than 700 of these apps triggered blacklist detections from the aggregated antivirus vendors in VirusTotal. Trimming the dataset to compare apps only coming from the Google Play store showed 655 results. Of those, 131 had triggered blacklist detections.
Fig -2 “Mobile Antivirus Security Info” was a mobile antivirus review app that the Google Play store removed. VirusTotal hits on the right
We then refined the data to only apps still labeled as being active. More than 4,290 antivirus apps were still being active, with 525 of those having blacklist hits. The Google Play store has 508, with 55 blacklisted. Comparing the numbers, it shows that historically, the Google Play store has had a greater percentage of blacklisted antivirus apps, at 20% versus the overall 11%. However, the current amount of blacklisted antivirus apps in the Google Play store is at 10.8%, versus the overall of 12.2%.
Using a Title Search for “antivirus” Resulted In:
General tips on what to look out for also apply to mobile antivirus solutions:
- Try to only download from official stores. Google, for example, seems to be diligently removing malicious apps at a greater rate than third-party stores.
- Review the permissions requested, make sure the developer email address is not a free email service like Gmail or Hotmail.
- Look over the app description to see if it is riddled with grammatical errors.
- Finally, when possible, check the app against known blacklists; VirusTotal provides an excellent starting point.