Key Findings:
- Mirroring 2017, blacklisted apps were on the rise in Q2
- Trojans and adware were the most common blacklisted app
- Attacks on cryptocurrency continue
- Malicious battery-saving scams breach the app ecosystem
SAN FRANCISCO, Sept. 18, 2018 (GLOBE NEWSWIRE) -- RiskIQ, the global leader in digital risk management, today released its Mobile Threat Landscape Q2 2018 Report, which analyzed 120 mobile app stores and more than two billion daily scanned resources. The findings show a spike in blacklisted apps headlined by Trojans and Adware, as well as a fascinating shift in tactics by mobile threat actors.
For the second year in a row, RiskIQ observed a sharp increase in blacklisted apps between May and June. Although this spike was less dramatic in 2018 than in 2017—an increase of nearly 30,000 apps in 2017 versus 12,000 in 2018—it continues a trend of accelerated Q2 blacklistings following lows in January and February.
In total, RiskIQ observed 52,885 Blacklisted apps in Q2, which was 4% of all apps seen by the company and a 2% increase over Q1. The Google Play store made up a large chunk of this number, hosting 28,533 blacklisted apps, which is over 20,000 more blacklisted apps than Q1 2018 and 10,000 more than what RiskIQ observed in any quarter since Q1 2017.
RiskIQ also observed 11,288 blacklisted Feral apps (apps seen outside of any app store), 4,750 blacklistings in the 9Apps third-party store, and 2,985 blacklistings in the AndroidAPKDescargar third-party store.
Q2 marked a shift in tactics for threat actors using the mobile vector including:
Attacks on myetherwallet.net: By copying the MyEtherWallet website and adding malicious scripts, threat actors spun up a phishing page that looked and acted like the official MyEtherWallet site, but sent authentication data to C2 servers when the victim enters their password to access/decrypt their wallet. This attack highlighted the trend of threat actors targeting the cryptocurrency landscape.
Run for your (Battery) life: RiskIQ spotted a mobile scam page claiming to detect and resolve battery life issues that directed the victim to a malicious “battery life” app hosted in the Google Play store under the name 'Advanced Battery Saver.' The app claimed very excessive permissions including the ability to read sensitive log data, receive text messages (SMS), receive data from Internet, and modify system settings. It also stole IMEI data, phone numbers, location data, and included an ad-clicker as a revenue generator for the app author.
For specific metrics and more on mobile vulnerabilities and attacker tactics, download the RiskIQ Mobile Threat Landscape Q1 2018 Report here: https://www.riskiq.com/research/2018-q2-mobile-threat-landscape-report/
About RiskIQ
RiskIQ is the leader in digital risk management, providing the most comprehensive discovery, intelligence and mitigation of threats associated with an organization’s digital presence. With more than 75 percent of attacks originating outside the firewall, RiskIQ allows enterprises to gain unified insight and control over web, social and mobile exposures. Trusted by thousands of security analysts, RiskIQ’s platform combines advanced internet data reconnaissance and analytics to expedite investigations, understand digital attack surfaces, assess risk and take action to protect the business, brand and customers. Based in San Francisco, the company is backed by Summit Partners, Battery Ventures, Georgian Partners and MassMutual Ventures. Visit https://www.riskiq.com or follow us on Twitter. Try RiskIQ Community Edition for free by visiting https://www.riskiq.com/community/.
© 2018 RiskIQ, Inc. All rights reserved. RiskIQ is a registered trademark of RiskIQ, Inc. in the United States and other countries. All other trademarks contained herein are the property of their respective owners.
Contact
Holly Hitchcock
Front Lines Media
805-801-9798
Holly@FrontLines.io