UPDATED 21:31 EDT / FEBRUARY 21 2019

SECURITY

New Android malware drains batteries and uses data in ad fraud scam

A newly discovered form of Android malware is draining batteries and gobbling up user data as part of a major ad-fraud operation.

Discovered by Oracle Corp. technology teams from its Moat and Dyn acquisitions, “DrainerBot” is being distributed through infected apps.

Infected apps, which have since been removed from the Google Play Store, include the augmented reality beauty app Perfect365, a sketching app called Draw Clash of Clans, music app Touch ‘n’ Beat – Cinema and VertexClub. The Oracle researchers say the apps have been downloaded more than 10 million times.

Running as a mobile ad scam, the infected apps run fraudulent, invisible video ads on an infected device. The app reports back to the ad network that each video advertisement has appeared on a legitimate publisher site but the sites are “spoofed,” not real.

An infected user sees nothing untoward since the ads don’t appear on the screen of the device, but where they may notice is in data and battery usage. The app can consume more than 10 gigabytes a month of data, likewise quickly draining the battery as well.

“DrainerBot is one of the first major ad fraud operations to cause clear and direct financial harm to consumers,” said Eric Roza, senior vice president and general manager of Oracle Data Cloud, said in a statement. “DrainerBot-infected apps can cost users hundreds of dollars in unnecessary data charges while wasting their batteries and slowing their devices. We look forward to working with companies across the digital advertising ecosystem to identify, expose, and prevent this and other emerging types of ad fraud.”

The researchers claim that the apps appear to have been distributed by a Dutch firm called Tapcore Inc., a company that assists app developers detect pirated installations of their apps, then displays targeted ads to the pirate app user.

Tapcore denied the allegation, saying in a blog post that it “strongly denies any intentional involvement with the supposed ad fraud scheme and is extremely surprised and alarmed by the allegations and attempt to connect the company with the scheme.”

It added that it has launched an internal investigation to see whether any such code was ever distributed through its network without its knowledge and that it “is ready to cooperate with all interested parties and provide all results on its findings.”

Photo: Marcin Wichary/Wikimedia Commons

A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU