“Brain training” games and IQ tests are popular right now, and mobile versions that people can download while waiting at the dentist or for a ride or the subway are even more popular. Enterprise malware writers have come up with a way to take advantage of this, with a new malware on the Google Play Store that turns them into a mind game.
According to Check Point Software, the BrainTest app has been published playing double-board, with between 100,000 and 500,000 downloads at a time, according to Google statistics. It was able to bypass Google’s mobile apps security scan using a number of techniques.
“It has an arsenal of exploitable privilege escalations, which are used to install a rootkit on the device, so that it can remain on the device even if the user uninstalls it,” Check Point researchers noted in an analysis. “[ Therootkit] allows the device to download and execute any code a cybercriminal wants to run—for example, displaying unwanted ads, or potentially, downloading and deploying a payload that steals credentials from an infected device.”
The malware was first detected on a Nexus 5 smartphone, and even when the user attempted to remove the infected app, the malware reappeared on the same device shortly after.
The malware’s creators used multiple methods to avoid detection by Google, including evading Google’s Android defense tool “Bouncer,” which scans apps entering the Play store.
“It detects whether the malware is running from an IP address or domain that matches Google Bouncer, and if so, it will not attempt to perform malicious activity,” Check Point explained. “A confusing tool was used to disguise the malware, as it was the only way it could re-upload to Google Play after it was first removed.”
Google , 2015, but it was soon back with a new attempt and a different package name, which uses the same code. That version was removed from the Play store on September 15, but anyone who has downloaded the app should be notified about the issue.
