{"id":172245,"date":"2023-08-04T06:36:07","date_gmt":"2023-08-04T13:36:07","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=172245"},"modified":"2024-11-19T21:35:01","modified_gmt":"2024-11-20T05:35:01","slug":"invisible-adware-unveiling-ad-fraud-targeting-android-users","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/invisible-adware-unveiling-ad-fraud-targeting-android-users\/","title":{"rendered":"Invisible Adware: Unveiling Ad Fraud Targeting Android Users"},"content":{"rendered":"

Authored by <\/span>SangRyol<\/span> Ryu, <\/span><\/span>McAfee Threat Researcher<\/span><\/p>\n

We live in a world where advertisements are everywhere, and it’s no surprise that users are becoming tired of them. By contrast, developers are driven by profit and seek to incorporate more advertisements into their apps. However, there exist certain apps that manage to generate profit without subjecting users to the annoyance of ads. Is this really good? <\/span>\u00a0<\/span><\/p>\n

Recently, McAfee\u2019s Mobile Research Team discovered a concerning practice among some apps distributed through Google Play. These apps load ads while the device\u2019s screen is off, which might initially seem convenient for users. However, it’s a clear violation of <\/span>Google Play Developer policy<\/span><\/a> on how ads should be displayed. This affects not only the advertisers who pay for invisible Ads, but also the users as it drains battery, consumes data and poses potential risks such as information leaks and disruption of user profiling caused by Clicker behavior.<\/span>\u00a0<\/span><\/p>\n

The team has <\/span>identified<\/span> 43 apps that collectively downloaded 2<\/span><\/span>.5<\/span><\/span><\/span> million times<\/span>.<\/span> Among the targeted apps are TV\/DMB Player, Music Downloader, News, and Calendar applications. <\/span>McAfee is a member of the <\/span><\/span>App Defense Alliance<\/span><\/span><\/a> focused on protecting users by preventing threats from reaching their devices and improving app quality across the ecosystem. We reported the discovered apps to Google, which took prompt <\/span>action<\/span>.<\/span> M<\/span>ost <\/span>apps are no longer available on Google Play<\/span> while <\/span>others<\/span> are updated <\/span>by the developer<\/span>. <\/span>McAfee Mobile Security detects this threat as Android\/<\/span>Clicker<\/span>. For more information, and to get fully protected, visit <\/span><\/span>McAfee Mobile Security<\/span><\/span><\/a>.<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

Many affected apps<\/p>\n

How does it work?<\/span><\/span>\u00a0<\/span><\/h2>\n

This ad fraud library <\/span>uses<\/span> specific tactics to avoid detection and inspection. <\/span>I<\/span>t <\/span>deliberately <\/span>delays the initiation of its fraudulent activities, creating a latent period<\/span> from the time of installation<\/span>. <\/span>What’s<\/span> more, all the intricate configurations of this library can be remotely <\/span>modified<\/span> and <\/span>pushed <\/span>using Firebase Storage or Messaging service. These factors significantly add to the complexity of <\/span>identifying<\/span> and analyzing this fraudulent behavior.<\/span> No<\/span>tably, the latent period typically spans several weeks, whic<\/span>h makes it challenging to detect<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

Getting latent period by using <\/span>Firebase Messaging Service<\/span><\/span>\u00a0<\/span><\/p>\n

It is important to be cautious about the implications of granting permissions, such as excluding ‘power saving’ and allowing <\/span>‘draw over other apps’. These permissions can enable certain activities to occur discreetly in the background, raising concerns about the intentions and behavior of the app<\/span>lication<\/span>s<\/span> or libraries in question.<\/span> Allowing these permissions can result in more malicious behavior, such as displaying phishing pages, also to displaying ads in the background.<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

Asked permissions<\/span> to run in the background and keep it hidden<\/span><\/span>\u00a0<\/span><\/p>\n

When the device screen is turned off<\/span> after the latent period<\/span>, the fetching and loading of ads <\/span>starts,<\/span> resulting in users being unaware of the presence of running advertisements on their devices. <\/span>This ad library registers device information by accessing the unique domain (<\/span>ex: <\/span>mppado.oooocooo.com) linked with the application. Then go to Firebase<\/span> Storage<\/span> to get the specific <\/span>advertisement<\/span> URL and show the ad<\/span>s<\/span>. <\/span>It is important to note that this process consumes power and mobile data resources.<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

O<\/span>bserved <\/span>traffic when the screen off<\/span><\/span>\u00a0<\/span><\/p>\n

If users quickly turn on their screens at this point, they might catch a glimpse of the ad before it is automatically <\/span>closed<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n