Q2 2018 Mobile Threat Landscape Report: Blacklisted Apps on the Rise as Scams Get Mobile

The mobile threat landscape is big, complex, and always changing. The number of mobile apps, both legitimate and malicious, and the stores that host them fluctuate from quarter to quarter—as do the tactics used by attackers to target brands and end-users.

For the second year in a row, there was a sharp increase in blacklisted apps between May and June. Although this spike was less dramatic in 2018 than in 2017—an increase of nearly 30,000 apps in 2017 versus 12,000 in 2018—it continues a trend of accelerated Q2 blacklistings following lows in January and February.

RiskIQ’s Mobile Threat Landscape Q2 2018 Report, which analyzes 120 mobile app stores and more than two billion daily resources scanned by our web-crawling infrastructure, detailed this spike in blacklisted apps. In total, RiskIQ observed 52,885 Blacklisted apps in Q2, which was 4% of all apps seen by the company and a 2% increase over Q1, with Trojans and Adware being most common dangers for users.

The Google Play store made up a large chunk of this number, hosting 28,533 blacklisted apps, which is over 20,000 more blacklisted apps than Q1 2018 and 10,000 more than what RiskIQ observed in any quarter since Q1 2017. RiskIQ also saw 11,288 blacklisted Feral apps (apps seen outside of any app store), 4,750 blacklistings in the 9Apps third-party store, and 2,985 blacklistings in the AndroidAPKDescargar third-party store.

Q2 marked a shift in tactics for threat actors using the mobile vector:

Attacks on myetherwallet.net: By copying the MyEtherWallet website and adding malicious scripts, threat actors spun up a phishing page that looked and acted like the official MyEtherWallet site, but sent authentication data to C2 servers when the victim enters their password to access/decrypt their wallet. This attack highlighted the trend of threat actors targeting the cryptocurrency landscape.

Run for your (Battery) life: RiskIQ spotted a mobile scam page claiming to detect and resolve battery life issues that directed the victim to a malicious “battery life” app hosted in the Google Play store under the name ‘Advanced Battery Saver.’ The app claimed very excessive permissions including the ability to read sensitive log data, receive text messages (SMS), receive data from Internet, and modify system settings. It also stole IMEI data, phone numbers, location data, and included an ad-clicker as a revenue generator for the app author.

All Your Firebase Are Belong To Us: Firebase, a cloud-based database service Google provides to mobile developers, was discovered by Appthority to have left a large number of its databases unsecured by either firewalls or authentication controls. This oversight exposed hundreds of gigs of data, including personally identifiable information, to anyone.

For specific metrics and more on mobile vulnerabilities and attacker tactics, download the RiskIQ Mobile Threat Landscape Q1 2018 Report here: https://www.riskiq.com/research/2018-q2-mobile-threat-landscape-report/