Pierluigi Paganini
November 04, 2017
Once again crooks exploited the official Google’s Play Store as a repository for malicious apps. This time a fake WhatsApp version was used to infect over a million users that downloaded it.
The fake WhatsApp version program first reported by Reddit users, it appears very similar to the original one.
The following image shows on the left the fake WhatsApp, while the legit one is on the right.
The Reddit user DexterGenius has decompiled the fake WhatsApp version and discovered it is an ad-loaded wrapper which included the code to download a second apk.
“Yep, also confirmed by long-pressing the link in a browser. I’ve also installed the app and decompiled it,” reported DexterGenius.
“The app itself has minimal permissions (internet access) but it’s basically an ad-loaded wrapper which has some code to download a second apk, also called ‘whatsapp.apk.’ The app also tries to hide itself by not having a title and having a blank icon.”
The malicious app has no title and is associated with a transparent icon.
The fake app appeared to be developed by legit WhatsApp Inc, but a close look at the developer’s name revealed that authors added a hidden space at end of the name. The developer used a trick, it added two bytes, 0xC2 0xA0, at the end forming an invisible space.
It is incredible, crooks that developed this app were able to bypass the Google security controls infecting more than a million devices.
The fake WhatsApp app was removed from the official Play Store and its author is going to be banned.
Experts believe that the automated checks implemented by Google for the apps to deploy in the Play Store are still ineffective, despite the efforts of Big G.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Mobile Pwn2Own 2017, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
