Scareware - Online Cyber Security News

Scammers Are Using Fake Apple In-App Subscriptions to Make Lot of Money

Tuesday, June 13, 2017 Swati Khandelwal

In this year's annual event, Apple announced that the company had paid out $70 Billion to developers in the App Store's lifetime and that $21 Billion of the amount was paid in the last year alone.

But has all this money gone to the legitimate app developers?

Probably not, as app developer Johnny Lin last week analyzed the Apple's App Store and discovered that most of the trending apps on the app store are completely fake and are earning their makers hundreds of thousands of dollars through in-app purchases and subscriptions.

Scammers Use 'Search Ads' Platform to Boost App Ranking

Shady developers are abusing Apple's relatively new and immature App Store Search Ads, which was launched at last year's Worldwide Developers Conference (WWDC), to promote their app in the store by using a few strategically chosen search ads and a bit of SEO.

"They're taking advantage of the fact that there's no filtering or approval process for ads, and that ads look almost indistinguishable from real results, and some ads take up the entire search result's first page," Lin wrote in his lengthy Medium post.

"I dug deeper to find that unfortunately, these aren't isolated incidents, they're fairly common in the app store's top grossing lists. And this isn't just happening with security related keywords. It seems like scammers are bidding on many other keywords."

Watch Out, Don't fall for Fake Apple In-App Subscriptions

One of the top earning apps Lin found was named "Mobile Protection: Clean & Security VPN" that tricked users into signing up for a $99.99 per week subscription for a complete garbage service by just laying their thumb on the Touch ID.

According to Lin, this app alone has earned its developer an estimated $80,000 per month, according to data from marketing firm Sensor Tower.

With spell and grammatical errors and fake reviews, 'Mobile Protection: Clean & Security VPN' claimed to be a Virus scanner, prompting users to "Instantly use full of smart anti-virus" by offering them a "FREE TRIAL."

But as soon as a victim tapped on the free trial, Touch ID screen appeared that read:

"Use Touch ID to start your free trial to Full Virus, Malware Scanner? You will pay $99.99 for a 7-day subscription starting June 9, 2017."

Usually, users who landed on the Touch ID screen making their mind for a free trial accidentally pressed their thumb on the Touch ID, which netted nearly $400 per month from just one user.

Therefore, the shady app developer needed just 200 people to be tricked into paying for the junk service to earn them $80,000 per month, which means $960,000 annually, according to Lin's calculations.

Lin explained how shady developers are abusing the App Store Search Ads service and "taking advantage of the fact that there's no filtering or approval process for ads, and that ads look almost indistinguishable from real results."

Though Apple removed the app, and several other apps that Lin highlighted in his post, but its App Store is still full of shady apps that use in-app purchases and misleading descriptions to trick users into spending lots of money on garbage.

Affected? Here's How to Cancel App Subscriptions

However, if you, unfortunately, downloaded any of the shady apps in question and paid for an expensive subscription, you can follow these steps to cancel all future payments:

Open Settings app and go to iTunes & App Store → Apple ID → View Apple ID.
Enter your Apple ID password or press against Touch ID when prompted.
Click on Subscriptions and then tap on the subscriptions you want to cancel, and tap Confirm.
Now once your current subscription period ends, you'll not charge.

Lin has also provided a long list of recommendation for Apple to implement to make its App Store safe for users, which includes steps to make better UI on Touch ID subscriptions, stricter Review of subscriptions, easier cancellation of subscriptions, fraud- and abuse-proof Search Ads, and remove scams and refund users.

Adware Android Apps Found in Google Play With Millions of Downloads

Tuesday, February 03, 2015 Swati Khandelwal

With the rise in mobile market, last year we have seen sharp growth in malicious 'adware' — the most prevalent mobile threat in the world. And now, security researchers have once again found Google Play Store offering malicious apps that are infecting millions of Android users with adware.

It’s not at all surprising that the Android operating system is surrounded by a number of unwanted intrusions that may gain users’ attention to fall victim for one, but this issue might be even worse than we thought.

WHAT IS ADWARE ?

For those not familiar with adware, adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. Doesn’t sound dangerous, Right? But adware could result in a serious threat to users.

Android Adware can pose a major threat to users' privacy, since some ad networks gather personal information like phone number, email address, and many more. Depending on where the ad network is based, there might be no legal guidelines for how that information could be used.

15 MILLION INSTALLS OF MALICIOUS APPS

Researchers from Security firm Avast has pointed out three popular gaming apps on Google Play store that actually infect users’ device with "adware" when installed. What’s interesting about this Android adware is that some of the apps have already been downloaded over a Million times.

The three apps found free in the Play Store include "Durak" card game app, "IQ Test" app and "Russian History" app. The apps are from different developers, but each has the same malicious software installed.

Durak card game app alone has 5 to 10 million installs, and the combination of all the three apps have more than 15 Million installs, according to the data on Google Play Store.

WARNING!! YOUR DEVICE IS INFECTED

Once installed on users smartphone, the malicious apps display advertisements disguised as warning messages to end users when they unlock their Android smartphones, according to a blog post published Tuesday by antivirus provider Avast.

"When you install Durak, it seems to be a completely normal and well working gaming app," says Avast researcher Filip Chytry. "This was the same for the other apps, which included an IQ test and a history app. This impression remains until you reboot your device and wait for a couple of days. After a week, you might start to feel there is something wrong with your device."

After almost 30 days before starting to spam out adverts, users will suddenly start seeing ads appear every time they unlock their device. These ads will warn them that their device is infected or full of porn or needs an update, which is, no doubt, a complete gag.

But, if you approve, you'll be redirected to malicious pages that could cause even more harm and potentially result in you being signed up for a premium SMS service that you have no interest in, and even in installing apps that simply collect your personal data for comfort while offering you no additional value.

SURPRISINGLY ADWARE DIRECTS USERS TO LEGITIMATE SECURITY APPS

What’s more surprising is that the ads also directs users to the Google Play store pages for legitimate security applications as well, claiming that they will clear the smartphone of the advert-serving. "This kind of threat can be considered good social engineering," Chytry claims. As of now, Google has pulled the malicious apps out from its official store.

Google always bound to face trouble over the wide and open nature of its app checking policies on Google Play Store, and despite so many security measures, the search engine giant mostly fails to recognize the Android malware that are lurking around its Google Play store in vast numbers.

Obviously, using the Google Play Store to distribute malware through malicious apps is a violation of Google’s Terms of Service and if detected, the app is removed from the play store and its developer’s licence is cancelled. But when it comes to Adware, Google’s security measures fail to detect it.

Book — Unmasking the Social Engineer: The Human Element of Security

Tuesday, August 05, 2014 Wang Wei

If we talk about old days, a hacker often rely on the natural helpfulness as well as weaknesses of people whom he wanted to target. This tactic to break into a computer network by gaining the confidence of an authorized user and get them to reveal information that compromises the network's security is known as Social Engineering.

WHAT IS SOCIAL ENGINEERING

Social engineering is nothing but a non technical kind of intrusion that relies heavily on human interaction and involves manipulating people so they give up confidential information.

Social engineering was very effective those old days as well as today, as major targets are made victims using this old trick only and it is also one of the important components of many types of exploits like:

Virus writers use social engineering tactics to persuade people to run malicious email attachments
Phishers use social engineering tactics to convince people to disclose their sensitive information such as banking credentials and passwords
Scareware vendors use social engineering to frighten people into running software that is useless at best and dangerous at worst

IMPORTANCE OF SOCIAL ENGINEERING

Now, the question rises, Why there is a need to understand Social engineering tactics and its importance in day-to-day life?

Security experts suggest that as our culture becomes more dependent on information, social engineering will remain the greatest threat to any security system. Prevention includes educating people about the value of information, training them to protect it, and the major part is, increasing people's awareness on how social engineers operate.

Christopher James Hadnagy, the President and Chief Human Hacker of Social-Engineer, Inc., wrote an absolute book on social engineering titled, Social Engineering: The Art of Human Hacking in which he detailed the entire lifecycle of social engineering and almost everything you needed to know about it.

Christopher is an American security consultant, author, and professional social engineer who has spent his last 16 years in security and technology, specializing in understanding the ways in which malicious attackers are able to exploit human weaknesses to obtain access to information and resources through manipulation and deceit.

In his recent released edition Unmasking the Social Engineer: The Human Element of Security (Special 50% OFF for THN Readers, Valid till August 31st, 2014), Christopher has detailed a more advanced science of understanding non-verbal communications along with the knowledge of how social engineers use these skills to build feelings of trust and relationship in their targets.

The author helps his readers to understand how they can identify and detect social engineers and scammers by analyzing their non-verbal behavior, that means body language and facial expressions. It helps you understand both the aspects, to make social engineering easier, and on the other hand, also to defend against social engineering attacks easier as well.

This simply means, if you can understand how a social engineer uses non-verbal behavior, then you can better defend yourself and your organization against them.

THE BOOK WALKS THE READER THROUGH

Clearly combines both the practical and technical aspects of social engineering security
Reveals the various dirty tricks that scammers use
Pinpoints what to look for on the nonverbal side to detect the social engineer
Understanding Nonverbal Displays of Comfort and Discomfort
Decoding the Language of the Body

“The focus wasn't just to write another book about social engineering, but to present the materials in such a way that it made the information easy to grasp and use,” says Christopher Hadnagy.