[FireEye]Preying on Insecurity: Placebo Applications With No Functionality on Google Play and Amazon.com

[igor51]

Preying on Insecurity: Placebo Applications With No Functionality on
Google Play and Amazon.com

FireEye mobile security researchers recently uncovered, and notified
  Google and Amazon to take down, a series of anti-virus and security
  configuration apps that were nothing more than scams. Written easily
  by a thieving developer with just a few hundred lines of code then
  covered with a facade of images and progress bars, the seemingly
  useful apps for Android’s operating environment charge for
  installation and upgrade but do nothing. In other words, placebo
  applications. Fortunately all the applications have been removed from
  the Google Play store due to our discovery.

Up to 50,000 downloads in some cases, these fake apps highlight how
  cybercriminals are exploiting the security concerns consumers have
  about the Android platform. In this case, we found five (!) fake
  antivirus apps that do nothing other than take a security-conscious
  user’s money, leaves them unprotected from mobile threats, and earns a
  criminal thousands of dollars for little work.

Uploaded by a developer named Mina Adib, the paid versions of the
  apps were available for Google Play customers outside the US and UK,
  while users in the UK and US could choose the free versions with
  in-app upgrade options. Also available in third party markets such as
  appbrain.com[1] and amazon.com[2], the fraudulent apps ranged in price
  from free to $3.99. The applications included:

 

Anti-Hacker PLUS (com.minaadib.antihackerplus) Price $3.99

JU AntiVirus Pro (com.minaadib.juantiviruspro) Price $2.99

Anti-Hacker (com.minaadib.antihacker) Free

Me Web Secure (com.minaadib.mewebsecurefree) Free

Me Web Secure Pro (com.minaadib.mewebsecure) Price $1.99

Taking full advantage of the legacy, signature-based approach mobile
  antivirus apps have adopted, that makes it hard for a user to tell if
  it really is working, total charges for these “security” apps ran into
  the thousands of US dollars in the Google Play store alone. This old
  security model puts users relying on such applications at risk, either
  because it incites them to download apps that simply don’t have
  functionality – as we see in this case – or they don’t provide
  adequate protection against today’s threats. Ultimately, users simply
  cannot tell when they are protected.

1. Anti-Hacker (com.minaadib.antihacker) Free

[caption id="attachment_5567" align="aligncenter"
    width="600"]      href="/content/dam/legacy/blog/2014/06/antihacker1.png">      class=" wp-image-5567 landscape-med"
      alt="Free Version of Anti-Hacker app in Google Play store. "
      src="/content/dam/legacy/blog/2014/06/antihacker1.png" width="600"
  height="125" /> Fig. 1. Free Version of Anti-Hacker app in Google
  Play store.[/caption]

This application claims to protect mobile devices from hackers. But,
  as with all of these apps, it’s a scam not capable of scanning the
  phone at all. Although there is a “Scan Now” button in the middle of
  the layout, it only shows a superficial progress bar when the user
  presses the button, which, after a few seconds of running, a toast
  message of "Your Android is clean" is shown.

The picture below shows the main interface of the application.

[caption id="attachment_5570" align="aligncenter"
    width="302"]      href="/content/dam/legacy/blog/2014/06/antihackerscreen1.png">      class=" wp-image-5570 portrait-sm"
      alt="Fig. 2. The UI of the Anti-Hacker app. "
      src="/content/dam/legacy/blog/2014/06/antihackerscreen1.png"
      width="302" height="502" /> Fig. 2. The UI of the Anti-Hacker app.[/caption]

The following code is executed when the user clicks the “Scan Now” button.

        class=" wp-image-5572 landscape-med"
      src="/content/dam/legacy/blog/2014/06/antihackercode1.png"
      width="600" height="520" />

As shown in the code, nothing happens when the button is clicked.
  Then the toast message of “You Android is clean” is shown as in the
  onDismiss() method.

[caption id="attachment_5575" align="aligncenter"
    width="307"]      href="/content/dam/legacy/blog/2014/06/antihackerscreen2.png">      class=" wp-image-5575 portrait-sm"
      alt="The toast message of the Anti-Hacker screen. "
      src="/content/dam/legacy/blog/2014/06/antihackerscreen2.png"
      width="307" height="510" /> Fig. 3. The toast message of the
  Anti-Hacker screen.[/caption]

The same trick is used when software is being updated which does
  nothing. When the Update button is clicked, a progress bar appears
  with text “Updating the Database...”. Later it’s changed to “ Database
  updated Successfully”.

2. Anti-Hacker PLUS (com.minaadib.antihackerplus) Price $3.99

Fig. 4 and 5 show the paid version of the application
  com.minaadib.antihacker. The source code of the application is almost
  the same as the free version, meaning the application doesn’t perform
  scanning either. When the user presses the Scan button, the
  application displays the progress bar for some time and then shows the
  same notification stating the device is “clean.”

[caption id="attachment_5577" align="aligncenter"
    width="549"]      href="/content/dam/legacy/blog/2014/06/antihacker2.png">      class=" wp-image-5577 landscape-med"
      alt="The Anti-Hacker Plus app in Google Play"
      src="/content/dam/legacy/blog/2014/06/antihacker2.png" width="549"
  height="131" /> Fig. 4. The Anti-Hacker Plus app in Google Play[/caption]

[caption id="attachment_5600" align="aligncenter"
    width="552"]      href="/content/dam/legacy/blog/2014/06/antihackerplusAmazon.png">      class=" wp-image-5600 landscape-med"
      alt="Anti-Hacker Plus app in Amazon.com"
      src="/content/dam/legacy/blog/2014/06/antihackerplusAmazon.png"
      width="552" height="257" /> Fig. 5. Anti-Hacker Plus app in Amazon.com[/caption]

The paid version does add one “feature,” however. It offers the
  ability to kill running apps and tasks, which, in reality, is just a
  line of code that waits one second after being activated before
  popping up a toast notification saying it has killed all tasks. You
  can see this lack of useful functionality in the code below:

        class="wp-image-5579 aligncenter landscape-med"
      alt="BatteryFragment"
      src="/content/dam/legacy/blog/2014/06/BatteryFragment.png"
      width="696" height="376" />

3.JU AntiVirus Pro (com.minaadib.juantiviruspro) Price $2.99

This application claims to be an antivirus application that detects
  malware, however, it actually follow the same patterns as the two scam
  apps above. It simply shows a progress bar for period of time as
  though it is doing something and then displays “Device is clean.” The
  source code of the “scan” button is similar to the applications above.

[caption id="attachment_5580" align="alignnone"
    width="599"]      href="/content/dam/legacy/blog/2014/06/JUAVPro.png">      class=" wp-image-5580 landscape-med"
      alt="Fig. 5. JU Anit-Virus Pro in Google Play store."
      src="/content/dam/legacy/blog/2014/06/JUAVPro.png" width="599"
  height="141" /> Fig. 6. JU Anit-Virus Pro in Google Play store.[/caption]

The image and the source code below show that the Scan button is a fake.

[caption id="attachment_5581" align="aligncenter"
    width="429"]      href="/content/dam/legacy/blog/2014/06/JUAVProScan.png">      class=" wp-image-5581 landscape-sm"
      alt="Fig. 6. The Scan button in JU Anti-Virus Pro app. "
      src="/content/dam/legacy/blog/2014/06/JUAVProScan.png" width="429"
  height="252" /> Fig. 7. The Scan button in JU Anti-Virus Pro app.[/caption]

        class="wp-image-5582 aligncenter landscape-med" alt="JUAVProCode"
      src="/content/dam/legacy/blog/2014/06/JUAVProCode.png" width="597" height="441" />

4. Me Web Secure  (com.minaadib.mewebsecurefree) Free

This application is a slightly different security tool, offering
  configuration settings for things like browsing and cookies. Just as
  the apps above, these are no more than superficial layouts on empty
  code. Cleverly, the developer disabled some of the options in the free
  version so users feel compelled to pay to enable them.

[caption id="attachment_5584" align="aligncenter"
    width="586"]      href="/content/dam/legacy/blog/2014/06/mewebsecuregoogle1.png">      class=" wp-image-5584 landscape-med"
      alt="Me Web Secure app in Google Play store."
      src="/content/dam/legacy/blog/2014/06/mewebsecuregoogle1.png"
      width="586" height="138" /> Fig. 8. Me Web Secure app in
  Google Play store.[/caption]

[caption id="attachment_5585" align="aligncenter"
    width="401"]      href="/content/dam/legacy/blog/2014/06/mewebsecurescreen1.png">      class=" wp-image-5585 landscape-sm"
      alt="Fig. 8. Me Web Secure app UI."
      src="/content/dam/legacy/blog/2014/06/mewebsecurescreen1.png"
      width="401" height="236" /> Fig. 9. Me Web Secure app UI.[/caption]

5. Me Web Secure Pro (com.minaadib.mewebsecure) Price $1.99

Similar to its free version counterpart –
  com.minaadib.mewebsecurefree – this application shows security and
  network configuration screens that are simply UI layouts. As stated
  above, the disabled options in the free version are enabled in the
  paid version of the application, but no fake source code was even
  written to fake the existence of those features being implemented.

[caption id="attachment_5589" align="aligncenter"
    width="600"]      href="/content/dam/legacy/blog/2014/06/mewebsecureprogoogle.png">      class=" wp-image-5589 landscape-med"
      alt="The Me Web Secure Pro app in Google Play Store. "
      src="/content/dam/legacy/blog/2014/06/mewebsecureprogoogle.png"
      width="600" height="149" /> Fig. 10. The Me Web Secure Pro app
  in Google Play Store.[/caption]

In the image below, the app shows it’s performing configurations when
  the “ON” button is pressed.

[caption id="attachment_5590" align="aligncenter"
    width="401"]      href="/content/dam/legacy/blog/2014/06/mewebsecureproscreen1.png">      class=" wp-image-5590 landscape-sm"
      alt="Scan button in the Me Web Secure Pro app. "
      src="/content/dam/legacy/blog/2014/06/mewebsecureproscreen1.png"
      width="401" height="235" /> Fig. 11. Scan button in the Me Web
  Secure Pro app.[/caption]

The image below is the code path when the ON button is clicked. It is
  a progress bar of 5 seconds only for visual purposes. No configuration
  is performed by the application.

        class="alignnone  wp-image-5592 landscape-med"
      alt="mewebsecureprocode"
      src="/content/dam/legacy/blog/2014/06/mewebsecureprocode.png"
      width="619" height="367" />

REFERENCE:

[1]. http://www.appbrain.com/app/anti-hacker/com.minaadib.antihacker

[2]. http://www.amazon.com/Mina-Adib-Anti-Hacker-Plus/dp/B00HT99DXA

Source: Preying on Insecurity: Placebo Applications With No Functionality on
Google Play and Amazon.com