{"id":49616,"date":"2016-05-13T16:38:03","date_gmt":"2016-05-13T23:38:03","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=49616"},"modified":"2024-02-19T22:08:39","modified_gmt":"2024-02-20T06:08:39","slug":"sex-sells-looking-at-android-adult-adware-apps","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/","title":{"rendered":"Sex Sells: Looking at Android Adult Adware Apps"},"content":{"rendered":"<p>Advertising is one of the primary methods to generate money from mobile devices. Ads can be displayed in the browser when you visit a specific website or can appear in free apps. In the case of mobile apps, the developer must select a theme that attracts many users to increase revenues. There is probably no better Internet theme than sex-related content.<\/p>\n<p>According to <a href=\"http:\/\/www.covenanteyes.com\/pornstats\/\">CovenantEyes,<\/a>\u00a0one in five mobile searches is\u00a0for pornography, so it is clear that creating adult-oriented apps or distributing them as adult content is one of the best options to attract users. Because these users are looking for adult\u00a0content, it also makes sense to display sexually explicit ads. However, these kind of advertisements are not allowed in most popular ad networks. (AdWords, for example, <a href=\"https:\/\/support.google.com\/adwordspolicy\/answer\/4271759?hl=en&amp;ref_topic=29265\">prohibited <\/a>sexually explicit content in March 2014.) Apps that contain or promote sexually explicit content are not allowed in official app stores such as\u00a0Google Play.<\/p>\n<p>How can these adult apps maximize app distribution and ad revenue on the user\u2019s network without using the most popular ad networks and app stores? In the case of distribution, MvAfee Mobile Research recently found some apps that use social networks such as\u00a0Twitter to post\u00a0links pointing to an .apk file with a sex-related filename:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-49617 size-medium\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png\" alt=\"RubMobo_TwitterDistribution\" width=\"300\" height=\"103\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TwitterDistribution.png 579w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/p>\n<p>Popular adult sites can also appear in the filename of the .apk:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-49618 size-medium\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution3-300x138.png\" alt=\"RubMobo_TwitterDistribution3\" width=\"300\" height=\"138\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TwitterDistribution3-300x138.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TwitterDistribution3.png 581w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><br \/>\nThe downloaded app usually pretends to be a video app, using icons that sometimes belong to legitimate apps such as\u00a0YouTube:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-49619 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_YooTube.png\" alt=\"RubMobo_YooTube\" width=\"97\" height=\"98\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_YooTube.png 132w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_YooTube-32x32.png 32w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_YooTube-64x64.png 64w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_YooTube-96x96.png 96w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_YooTube-128x128.png 128w\" sizes=\"auto, (max-width: 97px) 100vw, 97px\" \/><\/p>\n<p>or Vimeo:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-49620 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_VimeoIcon.png\" alt=\"RubMobo_VimeoIcon\" width=\"107\" height=\"97\" \/><\/p>\n<p>or a generic video app:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-49621 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_PlayVideo.png\" alt=\"RubMobo_PlayVideo\" width=\"89\" height=\"109\" \/><\/p>\n<p>The functionality of these apps is pretty basic. As soon as it is executed, it will display a sexually explicit image and appear to load content.\u00a0However, in the background the app is busy running a ping request to a remote server:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49623\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_ping.png\" alt=\"RubMobo_ping\" width=\"559\" height=\"287\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_ping.png 559w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_ping-300x154.png 300w\" sizes=\"auto, (max-width: 559px) 100vw, 559px\" \/><br \/>\nThis\u00a0is a way to obtain the external IP address of the user and the campaign ID needed to locate and deliver the ads:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49624\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_Ping2.png\" alt=\"RubMobo_Ping2\" width=\"346\" height=\"94\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_Ping2.png 346w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_Ping2-300x82.png 300w\" sizes=\"auto, (max-width: 346px) 100vw, 346px\" \/>In a similar way, the adware uses another server to test the Internet connection by requesting a specific HTML page:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49625\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TestConNetworkTraffic.png\" alt=\"RubMobo_TestConNetworkTraffic\" width=\"561\" height=\"336\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TestConNetworkTraffic.png 561w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TestConNetworkTraffic-300x180.png 300w\" sizes=\"auto, (max-width: 561px) 100vw, 561px\" \/><br \/>\nWhich will return &#8220;OKJA&#8221; if the connection is successful:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49626\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TestConBrowser.png\" alt=\"RubMobo_TestConBrowser\" width=\"354\" height=\"63\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TestConBrowser.png 354w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TestConBrowser-300x53.png 300w\" sizes=\"auto, (max-width: 354px) 100vw, 354px\" \/><\/p>\n<p>In addition to the connectivity checks, the app will load the \u201cOfferURL,\u201d its main purpose, to\u00a0deliver ads by redirecting the request to a specific URL:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49627\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_AdsDeliver.png\" alt=\"RubMobo_AdsDeliver\" width=\"705\" height=\"511\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_AdsDeliver.png 705w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_AdsDeliver-300x217.png 300w\" sizes=\"auto, (max-width: 705px) 100vw, 705px\" \/><br \/>\nThe data sent to the ad delivery URL contains:<\/p>\n<ul>\n<li>Device UUID: Unique device identifier.<\/li>\n<li>AppVer: Version of the app.<\/li>\n<li>TrafficSource: Distribution method of the app. In the preceding case, &#8220;Exo&#8221; stands for ExoClick, an online advertising company that allows sexually explicit content.<\/li>\n<li>CampaignID: The ad campaign&#8217;s unique identifier.<\/li>\n<li>Action: In the preceding case, LoadOffer gets ads as well as runs other actions without the user&#8217;s consent.<\/li>\n<li>HourSinceInstall: The app will report how much time has passed since its\u00a0installation every time a request to the ad delivery URL is submitted.<\/li>\n<li>Flag: In the preceding case, Main is the primary behavior of the app; another flag reports secondary behavior.<\/li>\n<li>AdsCount: The number of ads that have been displayed to the user since the app&#8217;s installation.<\/li>\n<li>OriIP: External-facing IP address of the device.<\/li>\n<li>Connection: A connection log that contains the changes between wireless\u00a0and mobile connections made by the app to change IP addresses and avoid being blocked by ad networks.<\/li>\n<\/ul>\n<p>Next a redirection within the same server gets the real URL (ymtracking.com) to deliver the ads:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49628\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_AdsDeliver2.png\" alt=\"RubMobo_AdsDeliver2\" width=\"705\" height=\"529\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_AdsDeliver2.png 705w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_AdsDeliver2-300x225.png 300w\" sizes=\"auto, (max-width: 705px) 100vw, 705px\" \/><\/p>\n<p>Finally, the URL with the ad is obtained from ymtracking:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49629\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_DeliverOffer.png\" alt=\"RubMobo_DeliverOffer\" width=\"667\" height=\"545\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_DeliverOffer.png 667w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_DeliverOffer-300x245.png 300w\" sizes=\"auto, (max-width: 667px) 100vw, 667px\" \/><br \/>\nOnce the ad is delivered and the user clicks on or closes it, the app loads a popular porn site, just to exercise the video aspect. So far we have an app that displays adult ads when executed\u2014but when the device starts or the phone state changes (for example, with an incoming call), the app sets a system alarm to execute additional instructions every 90 minutes. The first action is to check the unique device identifier with the remote server:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49630\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_CheckUUID.png\" alt=\"RubMobo_CheckUUID\" width=\"561\" height=\"191\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_CheckUUID.png 561w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_CheckUUID-300x102.png 300w\" sizes=\"auto, (max-width: 561px) 100vw, 561px\" \/><br \/>\nAfter that check, if the screen is on and the user is interacting with the device, the app will pop up additional adult ads but this time with user interactions such as \u201cscroll\u201d or \u201cdosome\u201d:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49631\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_scroll_dosome.png\" alt=\"RubMobo_scroll_dosome\" width=\"401\" height=\"428\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_scroll_dosome.png 401w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_scroll_dosome-281x300.png 281w\" sizes=\"auto, (max-width: 401px) 100vw, 401px\" \/><br \/>\nIn the case of &#8220;scroll,&#8221; the adware will scroll to a specific position:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49632\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_scroll.png\" alt=\"RubMobo_scroll\" width=\"781\" height=\"138\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_scroll.png 781w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_scroll-300x53.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_scroll-768x136.png 768w\" sizes=\"auto, (max-width: 781px) 100vw, 781px\" \/><br \/>\nIn the case of &#8220;dosome,&#8221; the app will simulate touch events:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49633\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_DoSome.png\" alt=\"RubMobo_DoSome\" width=\"563\" height=\"223\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_DoSome.png 563w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_DoSome-300x119.png 300w\" sizes=\"auto, (max-width: 563px) 100vw, 563px\" \/><br \/>\nIn addition to this potential click-fraud behavior executing in the background, some apps have implemented persistence mechanisms such as asking for device admin privileges to make it difficult to remove the app:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49634\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_DevAdmin.png\" alt=\"RubMobo_DevAdmin\" width=\"597\" height=\"76\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_DevAdmin.png 597w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_DevAdmin-300x38.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><br \/>\nOr downloading another .apk from a remote server if it is already not installed:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49635\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_DownloadPayload.png\" alt=\"RubMobo_DownloadPayload\" width=\"955\" height=\"56\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_DownloadPayload.png 955w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_DownloadPayload-300x18.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_DownloadPayload-768x45.png 768w\" sizes=\"auto, (max-width: 955px) 100vw, 955px\" \/><\/p>\n<p>If the payload is already installed, the app will attempt to launch it:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49636\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_LaunchPackage.png\" alt=\"RubMobo_LaunchPackage\" width=\"795\" height=\"88\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_LaunchPackage.png 795w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_LaunchPackage-300x33.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_LaunchPackage-768x85.png 768w\" sizes=\"auto, (max-width: 795px) 100vw, 795px\" \/><\/p>\n<p>The payload pretends to be a system service:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49637\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_SystemService.png\" alt=\"RubMobo_SystemService\" width=\"92\" height=\"138\" \/><\/p>\n<p>When the app runs, it broadcasts the android.settings.DEVICE_INFO_SETTINGS to display general device data while in the background starting a service to\u00a0deliver adult ads in a certain amount of time.<\/p>\n<p>These apps can also take a screenshot of the display if the loaded URL contains specific characters, probably as proof that the ad was loaded on the device:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49638\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TakeScreenshot.png\" alt=\"RubMobo_TakeScreenshot\" width=\"775\" height=\"219\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TakeScreenshot.png 775w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TakeScreenshot-300x85.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_TakeScreenshot-768x217.png 768w\" sizes=\"auto, (max-width: 775px) 100vw, 775px\" \/><\/p>\n<p>The screenshot is later sent to a remote server:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-49639\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_Send_ScreenShot.png\" alt=\"RubMobo_Send_ScreenShot\" width=\"863\" height=\"409\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_Send_ScreenShot.png 863w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_Send_ScreenShot-300x142.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/RubMobo_Send_ScreenShot-768x364.png 768w\" sizes=\"auto, (max-width: 863px) 100vw, 863px\" \/><\/p>\n<p>Mobile advertising is a huge business. It can bring in a lot of revenue but it also needs a big installed base. For that reason, adware developers will continue to generate these kinds of apps that are not malicious per se because they are only displaying ads. But they include\u00a0questionable persistence mechanisms, like asking for device admin privileges to \u201cactivate\u201d an\u00a0app or to download, install, and launch payloads from remote servers.<\/p>\n<p>We recommend you install security software, and\u00a0not trust applications downloaded from unknown sources. McAfee Mobile Security detects this threat as Android\/Adware.RubMobo and alerts mobile users if it is present, while protecting them from any data loss. For more information about McAfee Mobile Security, visit <a href=\"http:\/\/www.mcafeemobilesecurity.com\">http:\/\/www.mcafeemobilesecurity.com<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Advertising is one of the primary methods to generate money from mobile devices. Ads can be displayed in the browser&#8230;<\/p>\n","protected":false},"author":462,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[37,214],"coauthors":[1104],"class_list":["post-49616","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-android","tag-mobile-security1"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Sex Sells: Looking at Android Adult Adware Apps | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Advertising is one of the primary methods to generate money from mobile devices. Ads can be displayed in the browser when you visit a specific website or\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Sex Sells: Looking at Android Adult Adware Apps | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Advertising is one of the primary methods to generate money from mobile devices. Ads can be displayed in the browser when you visit a specific website or\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-05-13T23:38:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-02-20T06:08:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png\" \/>\n<meta name=\"author\" content=\"Carlos Castillo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@carlosacastillo\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Carlos Castillo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/\"},\"author\":{\"name\":\"Carlos Castillo\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe\"},\"headline\":\"Sex Sells: Looking at Android Adult Adware Apps\",\"datePublished\":\"2016-05-13T23:38:03+00:00\",\"dateModified\":\"2024-02-20T06:08:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/\"},\"wordCount\":969,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png\",\"keywords\":[\"android\",\"mobile security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/\",\"name\":\"Sex Sells: Looking at Android Adult Adware Apps | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png\",\"datePublished\":\"2016-05-13T23:38:03+00:00\",\"dateModified\":\"2024-02-20T06:08:39+00:00\",\"description\":\"Advertising is one of the primary methods to generate money from mobile devices. Ads can be displayed in the browser when you visit a specific website or\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Sex Sells: Looking at Android Adult Adware Apps\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe\",\"name\":\"Carlos Castillo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/729f5b9d2761341175762c5f10652607\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg\",\"caption\":\"Carlos Castillo\"},\"description\":\"Carlos Castillo specializes in the analysis of mobile threats and Android malware. Castillo performs static and dynamic analysis of suspicious applications to support McAfee\u2019s Mobile Security for Android product. He is the author of the McAfee-published white paper, \\\"Android Malware Past, Present, and Future,\u201d and wrote the \u201cHacking Android\\\" section of the book, \\\"Hacking Exposed 7: Network Security Secrets &amp; Solutions.\u201d As a recognized mobile malware researcher, Castillo has presented at several security industry events, including 8.8 Computer Security Conference and Segurinfo, a leading information security conference in South America. Prior to his position at McAfee, Castillo performed security compliance audits for the Superintendencia Financiera of Colombia, and worked at security startup Easy Solutions Inc., where he conducted penetration tests on web applications, helped shut down phishing and malicious websites, supported security and network appliances, performed functional software testing, and assisted in research and development related to anti-electronic fraud. Castillo joined the world of malware research when he won ESET Latin America\u2019s Best Antivirus Research contest with a paper titled, \u201cSexy View: The Beginning of Mobile Botnets.\u201d Castillo holds a degree in systems engineering from the Universidad Javeriana in Bogot\u00e1, Colombia.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/carlosacastillo\/\",\"https:\/\/x.com\/carlosacastillo\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/carlos-castillo\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Sex Sells: Looking at Android Adult Adware Apps | McAfee Blog","description":"Advertising is one of the primary methods to generate money from mobile devices. Ads can be displayed in the browser when you visit a specific website or","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Sex Sells: Looking at Android Adult Adware Apps | McAfee Blog","og_description":"Advertising is one of the primary methods to generate money from mobile devices. Ads can be displayed in the browser when you visit a specific website or","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-05-13T23:38:03+00:00","article_modified_time":"2024-02-20T06:08:39+00:00","og_image":[{"url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png","type":"","width":"","height":""}],"author":"Carlos Castillo","twitter_card":"summary_large_image","twitter_creator":"@carlosacastillo","twitter_site":"@McAfee","twitter_misc":{"Written by":"Carlos Castillo","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/"},"author":{"name":"Carlos Castillo","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe"},"headline":"Sex Sells: Looking at Android Adult Adware Apps","datePublished":"2016-05-13T23:38:03+00:00","dateModified":"2024-02-20T06:08:39+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/"},"wordCount":969,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png","keywords":["android","mobile security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/","name":"Sex Sells: Looking at Android Adult Adware Apps | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png","datePublished":"2016-05-13T23:38:03+00:00","dateModified":"2024-02-20T06:08:39+00:00","description":"Advertising is one of the primary methods to generate money from mobile devices. Ads can be displayed in the browser when you visit a specific website or","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/RubMobo_TwitterDistribution-300x103.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sex-sells-looking-at-android-adult-adware-apps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Sex Sells: Looking at Android Adult Adware Apps"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe","name":"Carlos Castillo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/729f5b9d2761341175762c5f10652607","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg","caption":"Carlos Castillo"},"description":"Carlos Castillo specializes in the analysis of mobile threats and Android malware. Castillo performs static and dynamic analysis of suspicious applications to support McAfee\u2019s Mobile Security for Android product. He is the author of the McAfee-published white paper, \"Android Malware Past, Present, and Future,\u201d and wrote the \u201cHacking Android\" section of the book, \"Hacking Exposed 7: Network Security Secrets &amp; Solutions.\u201d As a recognized mobile malware researcher, Castillo has presented at several security industry events, including 8.8 Computer Security Conference and Segurinfo, a leading information security conference in South America. Prior to his position at McAfee, Castillo performed security compliance audits for the Superintendencia Financiera of Colombia, and worked at security startup Easy Solutions Inc., where he conducted penetration tests on web applications, helped shut down phishing and malicious websites, supported security and network appliances, performed functional software testing, and assisted in research and development related to anti-electronic fraud. Castillo joined the world of malware research when he won ESET Latin America\u2019s Best Antivirus Research contest with a paper titled, \u201cSexy View: The Beginning of Mobile Botnets.\u201d Castillo holds a degree in systems engineering from the Universidad Javeriana in Bogot\u00e1, Colombia.","sameAs":["https:\/\/www.linkedin.com\/in\/carlosacastillo\/","https:\/\/x.com\/carlosacastillo"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/carlos-castillo\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/49616","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/462"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=49616"}],"version-history":[{"count":1,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/49616\/revisions"}],"predecessor-version":[{"id":183173,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/49616\/revisions\/183173"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=49616"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=49616"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=49616"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=49616"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}