Barcode Reader Apps on Google Play Found Using New Ad Fraud Technique

By Jessie Huang (Mobile Threats Analyst)

We recently saw two barcode reader apps in Google Play, together downloaded more than a million times, that started showing unusual behavior (Trend Micro detects these as AndroidOS_HiddenAd.HRXJA). This includes behavior that can be seen even when the user is not actively using the phones; the video below shows an example:

Video 1. Flashing Adware Page (click to enlarge)

What happened here? What caused the screen to flash? Let’s find the answer by examining the code.

As we noted earlier, the app pretends to be a barcode reader. This part of the app actually works as advertised. However, when run, the app also starts a background service and uses a received notification to keep the service running in the background. This service is disguised using the package name “com.facebook” even though it has nothing to do with Facebook.

Figure 1. Malicious code disguised using Facebook’s name

The service uses a timer to show ads every 15 minutes. It uses what appears to be random data to both control this behavior and hide it from unsuspecting eyes.

Figure 2. Timer to show ads

Figures 3 and 4. Adware configuration traffic

The “random data” is received from the command-and-control server and contains configuration information, ad IDs, and other commands from the said server. It may open specified content in the phone’s browser or start an activity with the FLAG_ACTIVITY_NEW_TASK intent. If any activity is started this way, the user won’t know which app opened the new activity.

Figure 5. Start activity with intent

Figure 6. Code to close advertisement

The app requests ads at 15-minute intervals, and it also added listeners to monitor the ad’s status. When the ad is opened, the page is closed right away, so the user would not see the ad at all. Instead, it causes a visible “flash,” as seen in the first video.

We have listed ad fraud tactics and techniques in our mobile threat landscape report. This particular method falls under the Fake Impressions category: the ad was indeed opened and the view recorded, but closed immediately. The ad is not seen with human eyes.

Figure 7. Evolving ad fraud techniques

This process still occurs when the user is not actively using the device — and even when the screen is off. The captured network traffic shows that there was still ad-related traffic with the same ad ID as in Figure 4.

Figure 8. Ad-related network traffic

In addition, this app used an interesting method to disguise itself and put the blame on other apps installed on the phone. This is so if the user got suspicious of any activity, it could evade being uninstalled. In the list of recent tasks on the phone, the malicious app uses the name and icon of other apps installed on the phone, as seen in the video below:

Video 2. App with copied name and icon (Click to enlarge)

Figure 9. App using icon from other apps

We can find the real culprit app using the Android debug bridge (adb) via the command “adb shell dumpsys activity”, as shown in the figure below.

Figure 10. Display of dumped activity

This adware is distributed via two apps on the Google Play store from the same developer. We first detected these apps as adware in 2019, but at the time, they did not have the behavior we documented in this post. (We contacted Google before publishing this post, and the apps have since been removed from Google Play.) Users also noted that the app had malicious behavior as far back as 2018.

Figure 11 and 12. App information from Google Play

Figure 13. User reviews indicating malicious behavior

We identified a total of 51 distinct apps (as differentiated by their package name) that showed identical adware behavior that were part of this campaign. A total of 95 samples of these apps were found. However, these apps were either removed by Google before the publication of this post or distributed by other means.

It should be noted that in general, downloading a separate barcode reader is not necessary. Most versions of Android already contain a barcode reader, rendering a separate app superfluous.

Trend Micro solutions

Users can install security solutions, such as Trend Micro Mobile Security for iOS and Trend Micro Mobile Security for Android (also available on Google Play), that can block malicious apps. End users can also benefit from their multilayered security capabilities that secure the device owner’s data and privacy, and features that protect them from ransomware, fraudulent websites, spyware, and identity theft.

For organizations, the Trend Micro Mobile Security for Enterprise suite provides device, compliance and application management, data protection, and configuration provisioning. The suite also protects devices from attacks that exploit vulnerabilities, prevents unauthorized access to apps, and detects and blocks malware. Trend Micro’s Mobile App Reputation Service (MARS) covers Android and iOS threats using leading sandbox and machine learning technologies to protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerability.

MITRE ATT&CK techniques

Indicators of Compromise

The post Barcode Reader Apps on Google Play Found Using New Ad Fraud Technique appeared first on .