SECURITY
SECURITY
SECURITY
New Android malware drains batteries and uses data in ad fraud scam
A newly discovered form of Android malware is draining batteries and gobbling up user data as part of a major ad-fraud operation.
Discovered by Oracle Corp. technology teams from its Moat and Dyn acquisitions, “DrainerBot” is being distributed through infected apps.
Infected apps, which have since been removed from the Google Play Store, include the augmented reality beauty app Perfect365, a sketching app called Draw Clash of Clans, music app Touch ‘n’ Beat – Cinema and VertexClub. The Oracle researchers say the apps have been downloaded more than 10 million times.
Running as a mobile ad scam, the infected apps run fraudulent, invisible video ads on an infected device. The app reports back to the ad network that each video advertisement has appeared on a legitimate publisher site but the sites are “spoofed,” not real.
An infected user sees nothing untoward since the ads don’t appear on the screen of the device, but where they may notice is in data and battery usage. The app can consume more than 10 gigabytes a month of data, likewise quickly draining the battery as well.
“DrainerBot is one of the first major ad fraud operations to cause clear and direct financial harm to consumers,” said Eric Roza, senior vice president and general manager of Oracle Data Cloud, said in a statement. “DrainerBot-infected apps can cost users hundreds of dollars in unnecessary data charges while wasting their batteries and slowing their devices. We look forward to working with companies across the digital advertising ecosystem to identify, expose, and prevent this and other emerging types of ad fraud.”
The researchers claim that the apps appear to have been distributed by a Dutch firm called Tapcore Inc., a company that assists app developers detect pirated installations of their apps, then displays targeted ads to the pirate app user.
Tapcore denied the allegation, saying in a blog post that it “strongly denies any intentional involvement with the supposed ad fraud scheme and is extremely surprised and alarmed by the allegations and attempt to connect the company with the scheme.”
It added that it has launched an internal investigation to see whether any such code was ever distributed through its network without its knowledge and that it “is ready to cooperate with all interested parties and provide all results on its findings.”
Photo: Marcin Wichary/Wikimedia Commons
Since you’re here …
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.
