{"id":84616,"date":"2017-08-02T18:52:06","date_gmt":"2017-08-02T13:22:06","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=84616"},"modified":"2017-08-03T12:05:05","modified_gmt":"2017-08-03T06:35:05","slug":"beware-fake-flash-player-apps-google-play","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/beware-fake-flash-player-apps-google-play\/","title":{"rendered":"Beware of Fake Flash Player apps on Google Play"},"content":{"rendered":"

Quick Heal Security Labs has found 2 fraudulent apps pretending to be Adobe Flash Player on the Google Play Store. Presently, no official apps of Adobe Flash Player are available on the Play Store. The rest of the post will tell you more.<\/p>\n

Fake App #1. Plugin for Video Flash Player<\/strong><\/p>\n

\"fakeadobe1\"
Fig 1<\/figcaption><\/figure>\n
\"fakeadobe2\"
Fig 1 (a)<\/figcaption><\/figure>\n

 <\/p>\n

\"fakeadobe3\"
Fig 1 (b)<\/figcaption><\/figure>\n
\"fakeadobe4\"
Fig 1 (c)<\/figcaption><\/figure>\n

About the app
\n<\/strong>Once installed, the Plugin for Video Flash Player <\/strong>app asks the user to change its setting depending on the Android version of the phone {fig 1 (a)}. If the settings are changed as asked, a link is shown to download the Adobe Flash player {fig 1 (b)}. The link redirects the user to a web page that contains instructions on how to download the app. The web page also asks the user to pay 18 Euros<\/strong> (Rs. 1353.64\/-) via PayPal to be able to download the flash player {fig 1 (c)}.<\/p>\n

Our analysis
\n<\/strong>The app is fake and has been designed to steal money from unsuspecting users.<\/p>\n

\u00a0Current status
\n<\/strong>The app has been removed from the Play Store.<\/p>\n

Fake App #2. Flash Player for Android<\/strong><\/p>\n

\"Fig
Fig 2<\/figcaption><\/figure>\n

About the app
\n<\/strong>The Flash Player for Android<\/strong> app claims to help users download an Adobe Flash Player plugin for Android mobile phones. The app has also mentioned in its description that it runs on an experimental technology and some resource may not work<\/p>\n

Our analysis
\n<\/strong>The app is fake and does not download any plugin but throws a pop-up on the screen for downloading and installing a plugin. Hence, it only serves advertisements to the user to make money for the app developer.<\/p>\n

Current Status
\n<\/strong>The app is present on the Play Store and it has been downloaded between 1,000,000 – 5,000,000 times.<\/p>\n

\"fakeadobe6\"
Fig 2 (a)<\/figcaption><\/figure>\n
\"fakeadobe7\"
Fig 2 (b)<\/figcaption><\/figure>\n

 <\/p>\n

\"fakeadobe8\"
Fig 2 (c)<\/figcaption><\/figure>\n
\"fakeadobe9\"
Fig 2 (d)<\/figcaption><\/figure>\n

 <\/p>\n

 <\/p>\n

\"fakeadobe10\"
Fig 2 (e)<\/figcaption><\/figure>\n

Third-party Fake App
\n<\/strong>Quick Heal Security Labs has found a similar app on a third-party app store that steals user\u2019s private information by pretending to be a Flash Player app.<\/p>\n

\"Fig
Fig 3<\/figcaption><\/figure>\n

About the app
\n<\/strong>As shown in Fig 3, this app looks genuine. Such apps are commonly hosted on third party app stores or distributed on video streaming websites where the user gets a prompt to download an updated version of Flash Player.<\/p>\n

\"Fig
Fig 3 (a)<\/figcaption><\/figure>\n

 <\/p>\n

Our analysis<\/strong><\/p>\n

1. When the app is downloaded, the user receives an \u201cActivate Device Administrator\u201d pop-up {Fig 3 (a)}. Selecting Cancel<\/strong> does not help as the message keeps popping up until the user selects Activate<\/strong>.<\/p>\n

2. If the user selects Activate<\/strong>, the window disappears but the app keeps running in the background carrying out malicious tasks.<\/p>\n

– It checks for new apps that have been installed or deleted from the device and specifically targets social and banking apps {fig 3(b)}<\/p>\n

\"Fig<\/a>
Fig 3 (b)<\/figcaption><\/figure>\n

– It steals the user\u2019s personal information and share it \u00a0to \u00a0C&C server controlled by the attacker {(Fig 3 (c) & 3 (d)}<\/p>\n

\"fakeadobe14\"<\/a>
Fig 3 (c)<\/figcaption><\/figure>\n

 <\/p>\n

\"fakeadobe15\"<\/a>
Fig 3 (d)<\/figcaption><\/figure>\n

– When a targeted app is opened by the user, the malware displays a fake online banking login page that looks genuine but is a phishing attack in reality {3 (e)}. Any information given on this page goes to the attacker.<\/p>\n

\"
Fig 3 (e)<\/figcaption><\/figure>\n

Download the Technical Analysis Report from the PDF below<\/strong><\/p>\n

\"PDF<\/a><\/p>\n

 <\/p>\n

Steps to stay away from fake and malicious apps<\/strong><\/p>\n

    \n
  1. Before downloading any app, verify its source. For example, in this case, visit Adobe\u2019s official website (adobe.com<\/a>) and check the official Flash Player App to download according to your Android OS version. However, all versions after Android 4.1 are already equipped with the Flash Player and there is no need to download it.<\/li>\n<\/ol>\n
      \n
    1. Never trust third-party app stores for downloading apps, particularly banking apps. Always go for official stores such as Google Play Store. While fake and sometimes, malicious apps land up on the Play Store, if possible check reviews before installing apps from playstore, it is still safer than elsewhere.<\/li>\n<\/ol>\n
        \n
      1. Always keep \u201cUnknown Sources\u201d disabled. Enabling this option allows installation of apps from unknown sources.<\/li>\n<\/ol>\n
          \n
        1. Install a reliable mobile security<\/a> app that prevents harmful apps getting on your device.<\/li>\n<\/ol>\n

           <\/p>\n

          ACKNOWLEDGMENT<\/strong><\/p>\n

          – Subject Matter Expert
          \nAnand Singh | Quick Heal Security Labs<\/p>\n","protected":false},"excerpt":{"rendered":"

          Quick Heal Security Labs has found 2 fraudulent apps pretending to be Adobe Flash Player on the Google Play Store. Presently, no official apps of Adobe Flash Player are available on the Play Store. The rest of the post will tell you more. Fake App #1. Plugin for Video Flash Player   About the app […]<\/p>\n","protected":false},"author":29,"featured_media":84638,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[70,24,303,5],"tags":[1481,1482],"class_list":["post-84616","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-adobe","category-malware","category-phishing","category-security","tag-fake-flash-player-apps","tag-fake-google-play-apps"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84616"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=84616"}],"version-history":[{"count":7,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84616\/revisions"}],"predecessor-version":[{"id":84642,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84616\/revisions\/84642"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/84638"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=84616"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=84616"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=84616"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}