Advertising hijacking made by Invisible rogue mobile apps are wasting petabytes of data a day

Mobile Malware is growing and crooks are targeting the advertising industry to redirect users to ad pages in a sort of Advertising hijacking.

Mobile Malware is growing and crooks are targeting the advertising industry with malicious codes able to redirect users to ad pages, this practice is known as Advertising hijacking. These “rogue mobile apps” are wasting petabytes of data a day, and some researchers estimated that the phenomena are inflicting US$1 billion in damages this year.

It has been estimated that 5000 malicious mobile applications (IOS + Android) are presenting ads, with the scheme of hiding the ad and reload it without the user’s knowledge, even if the users is not using the mobile application, generating revenues for fraudsters. This scheme is effective mainly because it simulates the human interaction.

Mike Andrews, Antoni Kolev, David Sendroff, and Matt Vella, researchers from New York outfit Forensiq explained that the “rogue mobile apps” are generating 20 ads per minute (700 per hour), a legitimate app that serves some ads generates one ad every 1 minute.

So many ads are generating much traffic per day in mobile devices, and it’s affecting around 15% of the apps in the market.

 “Fraudulent apps were observed selling traffic through most major ad exchanges and networks. These apps would establish on average 1100 connections per minute and communicate with 320 ad networks, ad servers, exchanges and data providers in the course of an hour,” states the report published by the researchers.

 “Based on the traffic we observed, we estimate that mobile device hijacking will cost advertisers more than $857 million in 2015 … we project that the annual impact of in-app fraud will surpass the $1 billion mark globally in 2015.”

The financial impact to advertisers is huge, instead of advertising their product the rogue applications, they are hijacking the mobile devices causing losses in the business. The experts estimate that advertisers in iOS will lose $363 million, for Android losses are $480 million, and for Windows Mobile $14 million.

The study revealed that antivirus solutions are unable to detect this advertising hijacking technique.

“Forensiq analyzed ad traffic from thousands of apps available on Google Play, Apple’s App Store as well as third party app marketplaces. We observed fraudulent apps operating on both Android and iOS platforms.”

Based on the results of the analysis, they concluded that 13.3% of mobile app inventory and 14.6% of mobile apps exhibiting high levels of risk.

Let’s close the post with a note, it is expected that within 2016 the number of these type of applications will continue to grow, and the mobile advertising will overtake the desktop advertising.

Enjoy the report.

About the Author Elsio Pinto

Pierluigi Paganini

(Security Affairs – Advertising hijacking, cybercrime)