{"id":14187,"date":"2012-03-01T09:54:33","date_gmt":"2012-03-01T17:54:33","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=14187"},"modified":"2025-06-02T00:43:56","modified_gmt":"2025-06-02T07:43:56","slug":"google-code-projects-host-android-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/","title":{"rendered":"Google Code Projects Host Android Malware"},"content":{"rendered":"<p>[March 1: See update at end]<\/p>\n<p>Google Code is a well-known platform that provides a collaborative environment for developers working on open source projects. It&#8217;s also a target for malware developers. Contrary to what you may think, this is not the first time that Google Code has been used to spread or store malware. (You can find examples in the discovery of uploaded images that led to fake codecs in 2009 and in Windows Trojans\/backdoors\/password-stealing keyloggers found <a href=\"http:\/\/research.zscaler.com\/2010\/09\/google-code-hosting-website-used-to.html\">in 2010.)<\/a> Further, we have recently found an Android malware that uses Google Code as a distribution platform for both potentially unwanted programs (pay-per-install campaigns or adware) and malicious applications (downloaders).<\/p>\n<h2>The First Variant of the Malware<\/h2>\n<p>The\u00a0first\u00a0variant of the current malware\u00a0in Google Code was found in a third-party Android market repacked in a Chinese version of a legitimate memory-optimization application. Every time the application executes or the boot process finishes (device rebooted or turned on), the payload starts as a service running in the background. The service checks a remote server (with the URL encoded in a file inside the \u201cassets\u201d folder) for applications to download\u00a0that store information in a database created inside the device. (Click the image to enlarge it.)<\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=14201\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-14201\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/database1.png\" alt=\"\" width=\"872\" height=\"157\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/03\/database1.png 1090w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/03\/database1-300x53.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/03\/database1-1024x184.png 1024w\" sizes=\"auto, (max-width: 872px) 100vw, 872px\" \/><\/a><\/p>\n<p>The data obtained from the web server includes the name of the package, the name of the apk file, and the path used to download the application&#8211;which points to a Google Code project:<\/p>\n<p style=\"text-align: left;\" align=\"center\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=14193\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-14193\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/google-project.png\" alt=\"\" width=\"369\" height=\"448\" \/><\/a><\/p>\n<p style=\"text-align: left;\" align=\"center\">The database records whether a specific application was downloaded, installed, or opened. Once the data is stored, an execution thread downloads, without user\u2019s consent, the first application in the database. This app is stored under the folder download in the SD card:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=14194\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-14194\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/downloaded.png\" alt=\"\" width=\"432\" height=\"175\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/03\/downloaded.png 432w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/03\/downloaded-300x121.png 300w\" sizes=\"auto, (max-width: 432px) 100vw, 432px\" \/><\/a><\/p>\n<p style=\"text-align: left;\" align=\"center\">As soon as the download finishes, the malicious application tries to install the application by displaying a notification that tricks the user into believing it is a system update. (Translation from Chinese: \u7cfb\u7edf\u66f4\u65b0 = &#8220;System update&#8221; and \u60a8\u597d, \u5df2\u7ecf\u83b7\u53d6\u2026 = &#8220;Hello, the latest patch has been downloaded, please click here to install&#8221;):<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=14195\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-14195\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/fake_update-.png\" alt=\"\" width=\"331\" height=\"179\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/03\/fake_update-.png 331w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/03\/fake_update--300x162.png 300w\" sizes=\"auto, (max-width: 331px) 100vw, 331px\" \/><\/a><\/p>\n<p style=\"text-align: left;\" align=\"center\">When the user taps that notification, the downloaded application starts to install using the normal Android procedure. Suspicious applications stored in several Google Code projects have been analyzed; some of them have been classified as PUPs because they have unwanted behavior such as sending private data (IMEI, phone number) to remote servers. Researchers have found a new variant of the malware that, instead of being packed in a legitimate application, is pure malicious code which does not show any icon in the main menu. However, it can be seen installed in the Downloaded section of Manage Applications using a deceptive honeycomb icon and the title Android 3.0 Patch:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=14199\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/installed.png\" alt=\"\" width=\"331\" height=\"164\" \/><\/a><\/p>\n<p>Although none of the analyzed samples contains root exploits, this variant has code to check if the device is already rooted. If so, it will proceed with a silent install of the downloaded application with the command \u201cpm install \u2013r.\u201d Another difference with the variant in the Google Code project is that the malicious behavior starts only if the screen of the device is turned off, probably to make the system update appear normal.<\/p>\n<p>Despite the fact that most of the applications available in Google Code projects are neither malicious nor PUPs, the links stored in the remote server, along with the text of the notification, can change at any time. Thus virtually any application can be installed on the device without the user\u2019s consent. McAfee Mobile Security detects all these variants as Android\/FakeUpdates.<\/p>\n<p>Update: The affected projects have been removed by Google.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[March 1: See update at end] Google Code is a well-known platform that provides a collaborative environment for developers working&#8230;<\/p>\n","protected":false},"author":462,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[37,180],"coauthors":[1104],"class_list":["post-14187","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-android","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Google Code Projects Host Android Malware | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Google Code is a well-known platform that provides a collaborative environment for developers working on open source projects. It&#039;s also a target for\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Google Code Projects Host Android Malware | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Google Code is a well-known platform that provides a collaborative environment for developers working on open source projects. It&#039;s also a target for\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2012-03-01T17:54:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-02T07:43:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/03\/database1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1090\" \/>\n\t<meta property=\"og:image:height\" content=\"196\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Carlos Castillo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@carlosacastillo\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Carlos Castillo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/\"},\"author\":{\"name\":\"Carlos Castillo\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe\"},\"headline\":\"Google Code Projects Host Android Malware\",\"datePublished\":\"2012-03-01T17:54:33+00:00\",\"dateModified\":\"2025-06-02T07:43:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/\"},\"wordCount\":584,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/database1.png\",\"keywords\":[\"android\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/\",\"name\":\"Google Code Projects Host Android Malware | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/database1.png\",\"datePublished\":\"2012-03-01T17:54:33+00:00\",\"dateModified\":\"2025-06-02T07:43:56+00:00\",\"description\":\"Google Code is a well-known platform that provides a collaborative environment for developers working on open source projects. It's also a target for\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/database1.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/database1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Google Code Projects Host Android Malware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe\",\"name\":\"Carlos Castillo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/729f5b9d2761341175762c5f10652607\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg\",\"caption\":\"Carlos Castillo\"},\"description\":\"Carlos Castillo specializes in the analysis of mobile threats and Android malware. Castillo performs static and dynamic analysis of suspicious applications to support McAfee\u2019s Mobile Security for Android product. He is the author of the McAfee-published white paper, \\\"Android Malware Past, Present, and Future,\u201d and wrote the \u201cHacking Android\\\" section of the book, \\\"Hacking Exposed 7: Network Security Secrets &amp; Solutions.\u201d As a recognized mobile malware researcher, Castillo has presented at several security industry events, including 8.8 Computer Security Conference and Segurinfo, a leading information security conference in South America. Prior to his position at McAfee, Castillo performed security compliance audits for the Superintendencia Financiera of Colombia, and worked at security startup Easy Solutions Inc., where he conducted penetration tests on web applications, helped shut down phishing and malicious websites, supported security and network appliances, performed functional software testing, and assisted in research and development related to anti-electronic fraud. Castillo joined the world of malware research when he won ESET Latin America\u2019s Best Antivirus Research contest with a paper titled, \u201cSexy View: The Beginning of Mobile Botnets.\u201d Castillo holds a degree in systems engineering from the Universidad Javeriana in Bogot\u00e1, Colombia.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/carlosacastillo\/\",\"https:\/\/x.com\/carlosacastillo\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/carlos-castillo\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Google Code Projects Host Android Malware | McAfee Blog","description":"Google Code is a well-known platform that provides a collaborative environment for developers working on open source projects. It's also a target for","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Google Code Projects Host Android Malware | McAfee Blog","og_description":"Google Code is a well-known platform that provides a collaborative environment for developers working on open source projects. It's also a target for","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2012-03-01T17:54:33+00:00","article_modified_time":"2025-06-02T07:43:56+00:00","og_image":[{"width":1090,"height":196,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/03\/database1.png","type":"image\/png"}],"author":"Carlos Castillo","twitter_card":"summary_large_image","twitter_creator":"@carlosacastillo","twitter_site":"@McAfee","twitter_misc":{"Written by":"Carlos Castillo","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/"},"author":{"name":"Carlos Castillo","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe"},"headline":"Google Code Projects Host Android Malware","datePublished":"2012-03-01T17:54:33+00:00","dateModified":"2025-06-02T07:43:56+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/"},"wordCount":584,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/database1.png","keywords":["android","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/","name":"Google Code Projects Host Android Malware | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/database1.png","datePublished":"2012-03-01T17:54:33+00:00","dateModified":"2025-06-02T07:43:56+00:00","description":"Google Code is a well-known platform that provides a collaborative environment for developers working on open source projects. It's also a target for","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/database1.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/03\/database1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-code-projects-host-android-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Google Code Projects Host Android Malware"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe","name":"Carlos Castillo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/729f5b9d2761341175762c5f10652607","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg","caption":"Carlos Castillo"},"description":"Carlos Castillo specializes in the analysis of mobile threats and Android malware. Castillo performs static and dynamic analysis of suspicious applications to support McAfee\u2019s Mobile Security for Android product. He is the author of the McAfee-published white paper, \"Android Malware Past, Present, and Future,\u201d and wrote the \u201cHacking Android\" section of the book, \"Hacking Exposed 7: Network Security Secrets &amp; Solutions.\u201d As a recognized mobile malware researcher, Castillo has presented at several security industry events, including 8.8 Computer Security Conference and Segurinfo, a leading information security conference in South America. Prior to his position at McAfee, Castillo performed security compliance audits for the Superintendencia Financiera of Colombia, and worked at security startup Easy Solutions Inc., where he conducted penetration tests on web applications, helped shut down phishing and malicious websites, supported security and network appliances, performed functional software testing, and assisted in research and development related to anti-electronic fraud. Castillo joined the world of malware research when he won ESET Latin America\u2019s Best Antivirus Research contest with a paper titled, \u201cSexy View: The Beginning of Mobile Botnets.\u201d Castillo holds a degree in systems engineering from the Universidad Javeriana in Bogot\u00e1, Colombia.","sameAs":["https:\/\/www.linkedin.com\/in\/carlosacastillo\/","https:\/\/x.com\/carlosacastillo"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/carlos-castillo\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/14187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/462"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=14187"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/14187\/revisions"}],"predecessor-version":[{"id":214788,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/14187\/revisions\/214788"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=14187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=14187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=14187"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=14187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}