{"id":374826,"date":"2021-11-30T17:31:03","date_gmt":"2021-11-30T14:31:03","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/how-android-banking-trojans-are-slipping-past-google-plays-defenses\/"},"modified":"2021-11-30T17:31:03","modified_gmt":"2021-11-30T14:31:03","slug":"how-android-banking-trojans-are-slipping-past-google-plays-defenses","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/how-android-banking-trojans-are-slipping-past-google-plays-defenses\/","title":{"rendered":"#How Android Banking Trojans Are Slipping Past Google Play\u2019s Defenses"},"content":{"rendered":"

“#How Android Banking Trojans Are Slipping Past Google Play\u2019s Defenses”<\/strong><\/p>\n

\n
\"Malware
Suttipun\/Shutterstock.com<\/a><\/span><\/figcaption><\/figure>\n

In what is a grim reminder to be careful what you install, a new bunch of Android apps have been download<\/a>ed more than 300,000 times and are stealing bank account information and draining accounts.<\/p>\n

As reported to Ars Technica<\/a>, a group of researchers from\u00a0ThreatFabric<\/a> discovered the string of applications that steal bank account credentials and funds from said accounts.<\/p>\n

\u201cWhat makes these Google Play distribution campaigns very difficult to detect from an automation (sandbox) and machine learning perspective is that dropper apps all have a very small malicious footprint,\u201d researchers from mobile security company ThreatFabric wrote in a blog post. \u201cThis small footprint is a (direct) consequence of the permission restrictions enforced by Google Play.\u201d<\/p>\n

That means the apps start as something non-malicious. For example, they could be QR scanners, PDF scanners, or cryptocurrency wallets. Once installed, the apps will request that users download updates through\u00a0third-party sources, which means you\u2019re sideloading the updates onto your device, thus going around Google Play\u2019s protections.<\/p>\n

Working this way also means the apps aren\u2019t detected by virus scanners when installed since they are entirely harmless when first downloaded from Google Play. It\u2019s not until they\u2019ve earned the user\u2019s trust and they can convince them to download the third-party updates do they do their work.<\/p>\n

\u201cThis incredible attention dedicated to evading unwanted attention renders automated malware detection less reliable,\u201d the ThreatFabric post said. \u201cThis consideration is confirmed by the very low overall VirusTotal score of the 9 number of droppers we have investigated in this blog post.\u201d<\/p>\n

The specific malware family is called\u00a0Anatsa, and it\u2019s a Trojan\u00a0targeting banks on Android. It has\u00a0remote access and automatic fund transfer systems that can drain a user\u2019s bank account once they have access. It comes with the ability to steal passwords and two-factor authentication codes. It can also log keystrokes and take screenshots.<\/p>\n

So what can you do to avoid apps that slip through Google\u2019s defenses? Don\u2019t sideload updates for an app downloaded on Google Play. If the app needs a regular update, there should be no reason for the update to be sideloaded, as Google Play has its own update process for apps. The only reason a developer would need to have you sideload an update is if it\u2019s trying to get around Google\u2019s protections for some reason.<\/p>\n

Additionally, try to download apps from reputable companies if possible. You can also keep yourself safe by deleting apps you\u2019re not using anymore.<\/p>\n<\/div>\n