The google play store is the official pre-installed app on Android devices which provides access to the Google Play store. It allows users to browse and download music, books, magazines, movies,television programs, and applications from Google Play. The Devices segment of Google Play is not accessible through the Play Store. With the introduction of Google Play on March 6, 2012, the Android Market app on old devices was upgraded to the Google Play Store app.
Another Malware has been discovered in Google Playstore despite the facts that it is the most secured store to download apps for Androids. We don’t know how this malware creeped into Google Playstore but it has infected more than 40 applications on Google playstore and more than 400 applications on unofficial app store. It is called DressCode.
WHAT DOES IT DO?
What this specific type of malwaredoes is, it creates a so-called botnet. The attackers are able to use infected devices to route traffic through them. In the case of DressCode, Check Point says, the hackers only used it to generate false ad clicks and traffic, thus collecting ad revenue. However, a botnet can be used for much more serious attacks, such as gaining access to company servers and files. Even though the malware is used to route traffic for invalid clicks of ad revenue, you still have the responsibility of making sure such kind of malware doesn’t run in the background of your device, otherwise it will affect your device performance.
HOW IT WORKS?
Researchers from Check Point discovered malware they’re calling DressCode in 40 Google Play store apps and more than 400 apps listed in third-party app stores.The company says that the oldest DressCode-infected apps in the Google Play store date back to April 2016, with some of them reaching anywhere from 100,000 to 500,000 downloads. According to the researchers, anywhere from 500,000 to 2,000,000 users might be at risk after downloading the apps. DressCode apps were used to create a botnet that was behind various actions that occurred on deviceswithout users’ knowledge or consent, including generating ad clicks and false traffic to some websites.
“Once installed on the device, DressCode initiates communication with its command and control server,” the researchers wrote. “Currently, after the initial connection is established, the C&C server orders the malware to “sleep,” to keep it dormant until there’s a use for the infected device. When the attacker wants to activate the malware, he can turn the device into a socks proxy, rerouting traffic through it.”
WHAT CAN YOU DO?
Always make sure that your Android device have the latest security patch installed and always be careful of what you download in apps store.
Google has removed the affected apps, but Check Point has a full list of apps that were infected, so be sure to check it out and ensure that you weren’t exposed.