Beware of Fake Flash Player apps on Google Play
Credit to Author: Quick Heal Security Labs| Date: Wed, 02 Aug 2017 13:22:06 +0000
Quick Heal Security Labs has found 2 fraudulent apps pretending to be Adobe Flash Player on the Google Play Store. Presently, no official apps of Adobe Flash Player are available on the Play Store. The rest of the post will tell you more. Fake App #1. Plugin for Video Flash Player Fig 1 Fig 1 (a) Fig 1 (b) Fig 1 (c) About the app Once installed, the Plugin for Video Flash Player app asks the user to change its setting depending on the Android version of the phone {fig 1 (a)}. If the settings are changed as asked, a link is shown to download the Adobe Flash player {fig 1 (b)}. The link redirects the user to a web page that contains instructions on how to download the app. The web page also asks the user to pay 18 Euros (Rs. 1353.64/-) via PayPal to be able to download the flash player {fig 1 (c)}. Our analysis The app is fake and has been designed to steal money from unsuspecting users. Current status The app has been removed from the Play Store. Fake App #2. Flash Player for Android Fig 2 About the app The Flash Player for Android app claims to help users download an Adobe Flash Player plugin for Android mobile phones. The app has also mentioned in its description that it runs on an experimental technology and some resource may not work Our analysis The app is fake and does not download any plugin but throws a pop-up on the screen for downloading and installing a plugin. Hence, it only serves advertisements to the user to make money for the app developer. Current Status The app is present on the Play Store and it has been downloaded between 1,000,000 – 5,000,000 times. Fig 2 (a) Fig 2 (b) Fig 2 (c) Fig 2 (d) Fig 2 (e) Third-party Fake App Quick Heal Security Labs has found a similar app on a third-party app store that steals user’s private information by pretending to be a Flash Player app. Fig 4 About the app As shown in Fig 4, this app looks genuine. Such apps are commonly hosted on third party app stores or distributed on video streaming websites where the user gets a prompt to download an updated version of Flash Player. Fig 4 (a) Our analysis 1. When the app is downloaded, the user receives an “Activate Device Administrator” pop-up {Fig 4 (a)}. Selecting Cancel does not help as the message keeps popping up until the user selects Activate. 2. If the user selects Activate, the window disappears but the app keeps running in the background carrying out malicious tasks. – It checks for new apps that have been installed or deleted from the device and specifically targets social and banking apps {fig 4(b)} Fig 4 (b) – It steals the user’s personal information and share it to C&C server controlled by the attacker {(Fig 4 (c) & 4(d)} Fig 4 (c) Fig 4 (d) – When a targeted app is opened by the user, the malware displays a fake online banking login page that looks genuine but is a phishing attack in reality {4 (e)}. Any information given on this page goes to the attacker. Fig 4 (e) Download the Technical Analysis Report from the PDF below Steps to stay away from fake and malicious apps Before downloading any app, verify its source. For example, in this case, visit Adobe’s official website (adobe.com) and check the official Flash Player App to download according to your Android OS version. However, all versions after Android 4.1 are already equipped with the Flash Player and there is no need to download it. Never trust third-party app stores for downloading apps, particularly banking apps. Always go for official stores such as Google Play…
http://blogs.quickheal.com/feed/