{"id":84540,"date":"2017-07-24T18:23:52","date_gmt":"2017-07-24T12:53:52","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=84540"},"modified":"2017-07-28T15:56:19","modified_gmt":"2017-07-28T10:26:19","slug":"beware-fake-apps-uses-jiojeo-names","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/beware-fake-apps-uses-jiojeo-names\/","title":{"rendered":"Beware of these fake apps on Google Play Store that use \u2018Jio\/Jeo\u2019 in their names"},"content":{"rendered":"

Jio took the Indian telecom market by storm when it made its entry with free unlimited calls and data offers. People went into a kind of frenzy for acquiring this service. And with its \u2018truly unbelievable\u2019 offers, Jio also launched an array of apps on Google Play Store such as Jio4GVoice, JioChat, JioMusic, etc. And unsurprisingly, these apps also became popular with many. And this is where cybercriminals came into action. Recently, Quick Heal Security Labs found 3 fake apps in the Play Store that go by the names \u2018Jio Speed Booster\u2019, \u2018JEO Validity Extender& Checker\u2019, and \u2018JWO Validity Extender& Checker\u2019 and these have already been downloaded over 5,00,000 times. Let\u2019s take a look at each of these apps in detail.<\/p>\n

\u00a0<\/strong><\/p>\n

1. Jio Speed Booster<\/h2>\n
\"Fig
Fig 1<\/figcaption><\/figure>\n

About the app
\n<\/strong>The app claims that it helps you configure your device to get the best possible network from Jio. The app\u2019s graphical user interface looks like what\u2019s shown in the below figures.<\/p>\n

 <\/p>\n

\"Fig
Fig 1 (a)<\/figcaption><\/figure>\n

 <\/p>\n

\"Fig
Fig 1 (b)<\/figcaption><\/figure>\n

 <\/p>\n

\"Fig
Fig 1 (c)<\/figcaption><\/figure>\n

Our Analysis<\/strong><\/p>\n

    \n
  1. The app asked us to accept its \u2018Terms and Conditions\u2019, but we could not find them anywhere.<\/li>\n
  2. The app pretended to \u2018search for bands\u2019 by displaying a fake progress bar and displayed a message as shown in fig 1 (c). In the background, however, the app started loading advertisements.<\/li>\n<\/ol>\n

    Verdict
    \n<\/strong>The Jio Speed Booster App does nothing to boost your Jio network but consumes a large amount of data to display unwanted advertisements.<\/p>\n

    Status
    \n<\/strong>The app has been removed from Google Play Store after Quick Heal Security Labs reported it.<\/p>\n

     <\/p>\n

    2. JEO Validity Extender&Checker<\/h2>\n
    \"Fig
    Fig 2<\/figcaption><\/figure>\n

    About the app
    \n<\/strong>The app claims to help Jio users to check their plan\u2019s validity and extend it. The below figures show how the app looks like.<\/p>\n

    \"Fig
    Fig 2 (a)<\/figcaption><\/figure>\n

     <\/p>\n

    \"Fig
    Fig 2 (b)<\/figcaption><\/figure>\n

     <\/p>\n

    \"Fig
    Fig 2 (c)<\/figcaption><\/figure>\n

    Our Analysis<\/strong><\/p>\n

      \n
    1. After selecting \u2018JEO VALIDITY CHECK\u2019 it asked for a Jio SIM number. When we entered one, we found that the app did not really verify when the number is registered with Jio or if it belongs to a different service provider. It only validated whether it is a 10 digit number.<\/li>\n
    2. In the next step, the app asked for details including Jio mobile number, name, email ID, city, and state.<\/li>\n
    3. The provided details were sent to a third party website exposing them to an untrusted source.<\/li>\n<\/ol>\n

      Verdict
      \n<\/strong>The JEO Validity Extender&Checker app does not do what it says but tricks the user into revealing their personal information.<\/p>\n

      Status
      \n<\/strong>The app has been removed from Google Play Store after Quick Heal Security Labs reported it.<\/p>\n

      3. JWO Validity Extender&Checker<\/h2>\n
      \"Fig
      Fig 3<\/figcaption><\/figure>\n

      About the app
      \n<\/strong>The app works in the same way as JEO Validity Extender&Checker does but only differs in its user interface (fig 3)<\/p>\n

      Status
      \n<\/strong>The app has been removed from Google Play Store after Quick Heal Security Labs reported it.<\/p>\n

      \u00a0<\/strong><\/p>\n

      Third-party fake apps<\/h2>\n

      We found apps similar to the above three on third-party app stores. One of these is the The JIO Upgrade APP<\/strong> that claims to offer a free upgrade to Jio services. Fig 4 represents a web page where it asks the user to download the app and enjoy 25 GB of Internet per day for lifetime.<\/p>\n

      \"Fig
      Fig 4<\/figcaption><\/figure>\n

      Our Analysis
      \n<\/strong>Scammers are spreading the link of this web page through WhatsApp so that they can attract a large number of users.<\/p>\n

      Verdict
      \n<\/strong>Jio hasn\u2019t declared any such offers officially and these offers are clearly fake.<\/p>\n

      \"Fig
      Fig 5. WhatsApp message claiming extra benefits for Jio users<\/figcaption><\/figure>\n

      How do attackers benefit from these fake apps<\/strong><\/p>\n

      These fake apps were created to either steal user\u2019s personal information (as seen in the case of the JEO Validity Extender&Checker) or serve the user with a large amount of ads (Jio Speed Booster). Both these activities generate revenue for the attacker.<\/p>\n

      As verified by VirusTotal, Quick Heal Mobile Security Apps<\/a> were the first to detect all these fake apps under the Android.FakeJeo<\/strong> family and report them to Google, post which these apps were removed from the Play Store.<\/p>\n

      VirusTotal<\/a> Results:<\/strong><\/p>\n

      #Tip:<\/span> How to read these results?<\/span>
      \nThe left column shows the name of the antivirus software and the right column shows the detection. If the detection column has a green tick mark, this means that the antivirus has not detected the app as unsafe or fake. During the time when this post was written, no other antivirus detected these fake apps except Quick Heal<\/em>.<\/span><\/p>\n

      JIO Speed Booster<\/span>
      \n      https:\/\/www.virustotal.com\/en\/file\/3f0de67198c23cc959dc209bc0bbe27ca771edd09bb6d1a59a3b6be0702b51c2\/analysis\/1500889476\/<\/a><\/p>\n

      JEO Validity Extender&Checker<\/span>
      \n      https:\/\/www.virustotal.com\/en\/file\/76406562de2f9a3ad632692fe1f13802c50ea43615f78f81665cd957bce2a81e\/analysis\/1500889476\/<\/a><\/p>\n

      JWO Validity Extender&Checker<\/span>
      \n      https:\/\/www.virustotal.com\/en\/file\/6f17efd2e5f01b1dc61ecf38f91af848fabb1594633c8b3b638c1a2e27c91616\/analysis\/1500889476\/<\/a><\/p>\n

      For a technical analysis on these apps, please download the PDF report given below:<\/strong><\/p>\n

      \"PDF<\/a><\/p>\n

      Also read: How to Identify Fake Apps in the Google Play Store<\/a><\/strong><\/p>\n

      Important Update<\/span>
      \nApparently, the Jio Speed Booster app has been added again to the Play Store and this time it’s been named ‘Jio Speed Booster for 4G Prank’ (fig 6). Despite the name change, the link to this app remains the same.<\/p>\n

      \"Fig
      Fig 6<\/figcaption><\/figure>\n

       <\/p>\n

       <\/p>\n

      Acknowledgment<\/strong><\/p>\n

      Subject Matter Expert
      \n– Omkar Gurav, Rohit Bhange | Quick Heal Security Labs<\/p>\n

       <\/p>\n

      This post was last updated on 25.07.2017<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

      Jio took the Indian telecom market by storm when it made its entry with free unlimited calls and data offers. People went into a kind of frenzy for acquiring this service. And with its \u2018truly unbelievable\u2019 offers, Jio also launched an array of apps on Google Play Store such as Jio4GVoice, JioChat, JioMusic, etc. And […]<\/p>\n","protected":false},"author":29,"featured_media":84553,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55,24,354,4],"tags":[],"class_list":["post-84540","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","category-malware","category-mobile-security-2","category-news"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84540"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=84540"}],"version-history":[{"count":27,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84540\/revisions"}],"predecessor-version":[{"id":84608,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84540\/revisions\/84608"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/84553"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=84540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=84540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=84540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}