Adware Apps- First of all, if you have any of the below-listed apps installed on your Android device, you are advised to uninstall it immediately.
Cybersecurity researchers have identified 42 apps on the Google Play Store with a total of more than 8 million downloads, which were initially distributed as legitimate applications but later updated to maliciously display full-screen advertisements to their users.
Discovered by ESET security researcher Lukas Stefanko, these adware Android applications were developed by a Vietnamese university student, who easily got tracked likely because he never bothered to hide his identity.
The publicly available registration details of a domain associated with the adware apps helped find the identity of the rogue developer, including his real name, address, and phone number, which eventually led the researcher to his personal accounts on Facebook, GitHub, and YouTube.
“Seeing that the developer did not take any measures to protect his identity, it seems likely that his intentions weren’t dishonest at first,” Stefanko said in a blog post published today.
“At some point in his Google Play career, he apparently decided to increase his ad revenue by implementing adware functionality in his apps’ code.”
Since all 42 adware apps provide original functionalities they promised, like Radio FM, video downloader, or games, it is quite difficult for most users to spot rogue apps or find anything suspicious.
Adware Tricks for Stealth and Resilience
Dubbed “Ashas” adware family, the malicious component connects to a remote command-and-control server operated by the developer and automatically sends basic information about the Android device with one of the adware apps installed.
The app then receives configuration data from the C&C server responsible for displaying ads as per the attacker’s choice and applying a number of tricks for stealth and resilience, some of which are mentioned below.
In order to hide its malicious functionality from the Google Play security mechanism, the apps first check for the IP address of the infected device, and if it falls within the range of known IP addresses for Google servers, the app will not trigger the adware payload.