安全研究人员近期揭露App Store托管的十个App中内含广告诈欺应用程序,安卓系统的Google Play则有75个App在应用程序上涉嫌广告诈欺,若用户下载了这些App,建议立即移除。
根据外媒Bleeping Computer报导,来自Human的Satori Threat Intelligence安全研究人员近期揭获了85个App有广告诈欺之嫌,而这些涉嫌诈欺的App,目前已超过1300万次被下载。这些诈欺广告皆来自于一家Scylla的公司。
Satori Threat Intelligence团队称,Scylla是他们自2019年8月以来揭获的第三波名为海神号(Poseidon)的行动。目前该团队已通报苹果和谷歌,将这些应用程序自App Store及Google Play删除。
根据该安全研究团队公布的苹果APP STORE十个有夹带诈欺广告的应用程序名称为:
•掠夺城堡(Loot the Castle):com.loot.rcastle.fight.battle (id1602634568)
•Run Bridge:com.run.bridge.race (id1584737005)
•闪灵枪(Shinning Gun):com.shinning.gun.ios (id1588037078)
•Racing Legend 3D:com.racing.legend.like (id1589579456)
•绳跑者(Rope Runner):com.rope.runner.family (id1614987707)
•木雕刻家(Wood Sculptor):com.wood.sculptor.cutter (id1603211466)
•防火墙(Fire-Wall):com.fire.wall.poptit (id1540542924)
•忍者暴击(Ninja Critical Hit):wger.ninjacriticalhit.ios (id1514055403)
•Tony Runs:com.TonyRuns.game
安全人员表示,发现的这些恶意App,在下载后并不会对手机有害,只在App中显示恶意诈欺广告,一旦点阅进入,就可能开启其他恶意App侵入手机的大门。且Scylla应用程序名称上会假冒像似广告点击,透过ID的定期循环来逃避诈欺的检测。
安全人员建议,手机用户若想知道自己是否有下载过这类的含有诈欺广告的恶意App,可经由应用程式列表,查看是否有应用程式正在不合理地消耗大量电量,或正在大量地使用手机的行动网路。
安卓系统的恶意App名称如下,目前也已从Google Play商店中删除。
超过100万次下载的恶意App:
Roll Turn (com.roll.turn.song.wusi.pt)
Crush Car (com.crush.car.fly.delivery.lingjiu)
超级英雄-拯救世界!(com.asuper.man.playmilk)
Spot 10 Differences (com.different.ten.spotgames)
恐龙传奇(com.huluwagames.dinosaur.legend.play)
一张线图(com.one.line.drawing.stroke.yuxi)
射击大师(com.shooter.master.bullet.puzzle.huahong)
人才陷阱 – 新(com.talent.trap.stop.all)
找出 5 个差异 – 新(com.find.five.subtle.differences.spot.new)
超过50万次下载的恶意App:
直升机攻击 – 新(com.helicopter.attack.shoot.sanba)
Arrow Coins (com.helicopter.attack.shoot.sanba)
停车大师(com.ekfnv.docjfltc.parking.master)
射击:使用枪(com.bullet.shoot.fight.gtommm.tom)
Super Flake (com.chop.slice.flake2020)
五星级切片(com.five.star.slice)
沙画(com.sand.drawing.newfight)
恐龙先生:玩你的恐龙(com.topggame.facego.finger.crazy.dino)
Track Sliding New (com.track3d.sliding.new)
超过十万次下载的恶意App:
Peter Shoot (com.ltc.peter.shoot.tslgame)
盗贼王(com.ltcking.thief.game.tsl)
Spin: Letter Roll (come.letter.roll.race)
Relx cash (com.tycmrelx.cash)
Lady Run (com.lady.dress.run.sexylady)
Magic Brush 3D (com.magic.brush.gamesly)
Shake Shake Sheep (com.ldle.merge.free.coinspiggy)
数字组合:彩色筹码(com.yigegame.jyfsmnq.gg)
Ztime:轻松赚取现金奖励(com.pocky.ztime)
Lucky Wings – Lotto Scratchers (com.free.scratchers.luckywings)
Shake Shake Pig (com.ldle.merge.free.coinspiggy)
幸运钱树(com.ldle.merge.lucky.moneytree)
Run And Dance (com.tap.run.and.dance)
Beat Kicker New (com.beat.kicker.two.game)
填充颜色 3D (com.cube.fill.color.paint.turn.fei)
Draw Live (com.draw.live.milipop)
Draw 1 Stroke (com.draw.one.line.stroke.xipi)
Fidget Cubes (com.fidget.cubes.feel.like)
Girls Fight (com.girls.fight.fly)
忍者刺客(com.knifeninja.assassin.dltc)
射击拼图 2020 (com.my.bullet.shooting.man.hunter.youxi)
滑轮跑酷(com.pul.parkour.bbroller)
Chop Flake 3D (com.slice.chop.superslice3d)
武器幻想(com.weapon.fantasy.games)
超过5万次下载的恶意App:
Bike Extreme Racing (com.bike.extreme.raceing.bikegames)
Player Spiral Maker 3D (com.player.spiral.maker.d3)
Scratch Carnival (com.scratchers.jackpot.luckypiggy)
Billionaire Scratch (com.free.tickets.scratchers.Billionaire)
幸运星:Lotto Scratch (com.free.tickets.scratchers.LuckyLotto)
Balloon Shooter (com.balloon.shooter.play)
音乐剧(com.ltcmusical.fun2021)
Chop Slices (com.lvdiao.chop.slices.chef)
Ninja Slice (com.slice.masked.games)
在工作,在忙!(com.work.now.slack)
超过1万次下载的恶意App:
绘制完成(com.ltcdraw.complete.fly)
Draw a War (com.draw.war.army)
Match 3 Tiles (com.blocks.tile.matching)
2048 Merge Cube – Win Cash (com.cube.merge.shooter)
拉虫(com.pull.bugs.worm)
Shoot Dummy – 赢取奖励和 Paypal 现金(com.shoot.dummy.fast.speed.linger)
瓶跳(com.bottle.jump.flip.challenge.fun)
玉米刮刀(com.corn.scraper.cut.pipe.siling)
Idle Wood Maker (com.idle.wood.maker.gametwo)
Pop Girls Schooler (com.pop.girls.schooler)
Romy Rush (com.romy.rushrun)
矛英雄(com.spear.super.man.hero)
超过5千次下载的恶意App:
隐藏抽奖(com.hiding.drawltc.games)
Downhill Race (com.downhill.race.redbull)
Jackpot Scratcher-Win Real (com.physicswingsstudio.JackpotScratchers)
Dig Road Balls (com.dig.road.balls.play.games.ygygame)
Crowd Battle: Fight the bad guy (com.crowd.battle.goamy)
超过5千次下载的恶意App:
Design n Road (com.ltcdesign.nroad)
救援大师(com.rescue.master.gear.mechanics.wushi)
Lucky Scratchers: Lotto Card (com.lotto.bingo.lucky.scratchcard)
BOO Popstar (com.boostar.boo.popstar)
绘制完成 A (com.darwa.completea.ltca)
超过1百次下载的恶意App:
绘画战争(com.painting.war.inpaper)
Rush 2048: 3D Shoot Cubes (com.rushcube.puzzle.block)
Auto Stamp Camera (com.stac.amper.qweaf)
0次被下载的恶意App:
认识相机(com.magicvcam.hdmeet.cam008)
不适用的恶意App:
com.find.five.differences.lvye.xsl
com.mufc.zwxfb