With most malware campaigns, the goal is to infect as many people as possible. That’s not the case with the latest attack uncovered by researchers at McAfee. The company’s mobile research team reports that North Korea has been caught tinkering with Android malware again, but this time it’s using both Facebook and Google Play to target North Korean defectors living in South Korea.
According to McAfee, North Korea’s Sun Team hackers perpetrated the attack over the last several months. They likely infected around 100 targets, which isn’t a huge number compared with most malware campaigns. However, these were all highly targeted infiltrations to gather intelligence on political opponents. There are currently around 30,000 North Korean defectors living in the south.
The hackers used Facebook to distribute links to the malicious apps, focusing on populations and individuals who would have information about defectors. They created convincing fake profiles, often using images stolen from South Korean users as profile photos. Their posts asked the targets to download and test some Android apps hosted in the Play Store. These apps, however, were not what they appeared.
McAfee researchers found three apps uploaded by Sun Team hackers: 음식궁합 (Food Ingredients Info), Fast AppLock, and AppLockFree. All three were listed as “unreleased” in the Play Store, which kept them from garnering unwanted attention. The hackers only wanted to send specific targets to the listings. Upon installation, the apps would ask for access to contacts, SMS data, and local files before sending it all to the malware operators. This data could lead to more targets for future malware attacks, including both defectors and those who help them escape North Korea. McAfee tied the apps together as part of a single attack from the use of identical developer accounts, emails, and IP addresses.
Luckily, McAfee believes Sun Team to be low on technical skill. The malware attempts to gain control of the target devices, but it uses publicly available sandbox escape, privilege escalation, and code execution exploits. Most devices are patched to block these attacks. So, McAfee suggests Sun Team doesn’t have the technical skill at this time to find new zero-day attacks on Android.
The researchers alerted Google and Facebook to the operation. Google has removed the malicious unreleased apps from the Play Store, and Facebook nuked the fake accounts. McAfee recommends users avoid installing apps that are unreleased or obscure to make sure they aren’t being phished.
ET deals: Save Big on NordVPN
If you're on public WiFi at the library or a coffee shop, anyone can look at your unencrypted traffic. Even when you're online at home, your ISP and government might very well be snooping on your day-to-day activities. Thankfully, investing in a VPN is incredibly affordable. Take advantage of today's deal from NordVPN, and you can get an entire year of service for less than $3 per month.
ET Deals: Norton Core Connected AC2600 Secure Wi-Fi Router with One-Year Security Plus for $200
If you're using the default wireless router that your ISP provides, you might be dealing with coverage issues. Certain rooms in your house might drop your connection, or the speed might be terrible. So if you're ready to upgrade to a better wireless router that doesn't compromise one iota on security, consider the Norton Core.
How to Create and Share 360-Degree Panoramas With Your Drone
Drones add a whole new dimension to panoramas, and make it easier than ever to create interesting 360-degree panoramas that cover an entire scene
We Just Found the First Normal Planet to Orbit a Brown Dwarf
We've just found the first evidence of an ordinary planet circling a brown dwarf — a type of stellar object that sits between a really huge planet and a really small star.