Some Clarification…

by Blog Staff | Aug 9, 2012 | Industry Intel, Threat Lab

Recently Webroot posted a blog about an app called “London Olympics Widget” which was found in a third party market that may need further clarification.  This app is what we consider a Potentially Unwanted Application (PUA).  PUAs are apps are not considered to be good, nor are they considered malware either.  They are apps that walk a thin line and thus are in a grey area.  The app in question was classified as a PUA because the of the advertisement SDK add-ons it contains.  There are a lot of free apps out there that contain these advertisement SDK add-ons in order to create revenue, and that’s okay.  It’s when these advertisement SDK add-ons are overly aggressive and display behaviors such as creating ad related home screen icons and bookmarks, accessing the contact list, and displaying ads in your notification bar that we call these PUAs.  We detect these annoying apps in order to inform the user of its presence.  Google has recently taken the same stance against these aggressive advertisements and has updated their Ad Policies to warn developers that this type of aggressive advertising will no longer be allowed in the market: Google Play Developer Program Policies

In the case of “London Olympics Widget”, it is a simple app that displays what events are going on in the Olympics on which days.  Nothing wrong with that at all.  The reason we have classified this as a Potentially Unwanted Application is because it is using the Olympics to draw people into installing their apps so they can make money on multiple aggressive advertisement SDK add-ons.  It is the aggressive advertisement SDK add-ons that are requesting permissions to read contacts, look up device ids, and read SMS messages. Why do they want to read your SMS, collect your contacts and blast you with ads?  Probably not to make your mobile experience better.  Permissions are a scary thing, but just because an app has a permission to do something doesn’t necessarily mean it’s malicious.  It’s the code within the app that uses these permissions that makes the determination of good or bad.  Can “London Olympics Widget” read your contacts and read your SMS?  Yes, but that doesn’t mean they are using the data collected in a malicious way.  They are using the data to for advertisement reasons which isn’t considered blatantly malicious, but is considered something you may not want on your device which is why we detect it as a PUA.

As always, make sure you install apps from safe markets, and if it has more permissions than what you think it should, be cautious.  Scanning with Webroot SecureAnywhere Mobile will detect PUAs and malware to make sure users stay ad annoyance free, and safe while using a mobile device.

London Olympic Widget with shortcuts added by aggressive advertisement SDK

Screen shot of app showing Olympic event on August 11th

Ads that popped up in notification bar

Ongoing spam campaign impersonates LinkedIn, serves exploits and malware

by Blog Staff | Aug 8, 2012 | Industry Intel, Threat Lab

Remember the LinkedIn exploits and malware serving campaigns which I profiled in March, and May?

Over the past 24 hours, cybercriminals launched the most recent spam campaign impersonating LinkedIn, in an attempt to trick LinkedIn’s users into clicking on the client-side exploits and malware serving links found in the emails.

More details:

(more…)

Spamvertised ‘PayPal has sent you a bank transfer’ themed emails lead to Black Hole exploit kit

by Blog Staff | Aug 2, 2012 | Industry Intel, Threat Lab

Sticking to their well proven social engineering tactics consisting of systematic rotation of the abused brands, cybercriminals are currently spamvertising millions of emails impersonating PayPal, in an attempt to trick end and corporate users into interacting with the malicious campaign.

Once the interaction takes place, users are exposed to the client-side exploits served by the Black Hole exploit kit, currently the market share leader within the cybercrime ecosystem.

More details:

(more…)

Spamvertised AICPA themed emails lead to Black Hole exploit kit

by Blog Staff | Aug 1, 2012 | Industry Intel, Threat Lab

Certified public accountants, beware what you click on!

Cybercriminals are currently spamvertising millions of emails impersonating AICPA (American Institute of Certified Public Accountants) in an attempt to trick users into clicking on the client-side exploits and malware serving links found in the emails.

More details:

(more…)