There is a new threat in the town. A malware called Judy is apparently infecting Android phones. Millions of phones are falling to it, says Check Point, a company that tracks and analyses viruses and the malware that infect smartphones. It's quite scary actually, what Judy is and what it does and unlike many other malware on Android phones, this one actually spreads through Google's own play store. So should you worry about Judy? Is your phone safe from Judy?
What is Judy malware?
The information about Judy comes from Check Point. The company, in a blog post on May 25, says that the malware was discovered by company researchers recently. "Check Point researchers discovered another widespread malware campaign on Google Play, Google's official app store. The malware, dubbed "Judy", is an auto-clicking adware which was found on 41 apps developed by a Korean company," says Check Point.
The scary part of the whole story is that Judy is hiding in app code since April 2016. Although the apps that have been directly linked with Judy have been downloaded "between 4.5 million and 18.5 million" times, there is no direct estimate o9f just how many devices have been affected.
What happens once Judy infects a phone?
Judy is an adware. In other words, it tries to make money for its masters by creating fake ad clicks once it has infected a phone. The infection, on the other hand, happens once a user downloads the app through the Play store. After infecting a phone the app connects to a Control & Command centre managed by its creators. "To bypass Bouncer, Google Play's protection, the hackers create a seemingly benign bridgehead app, meant to establish connection to the victim's device, and insert it into the app store. Once a user downloads a malicious app, it silently registers receivers which establish a connection with the C&C server. The server replies with the actual malicious payload...," notes Check Point.
In other words, it doesn't seem that Judy steals any information from a user. Instead, it seemingly uses a phone to generate fake ad clicks, which then make money for its creators.
But that doesn't mean that you should not worry about Judy. The malware is very sophisticated, as evident by its design that can even defeat Google's Bouncer protection. It's just that at this moment Judy is probably not stealing anything from users. But with the secret gateway it creates between an infected phone and the malware server it can possibly easily steal private details like credit card information and passwords from a phone.
Another interesting part is that the Judy comes from a known developer. "The malicious apps are all developed by a Korean company named Kiniwini, registered on Google Play as ENISTUDIO corp. The company develops mobile apps for both Android and iOS platforms. It is quite unusual to find an actual organization behind mobile malware, as most of them are developed by purely malicious actors," says Check Point.
Should you worry about Judy?
Absolutely. Although Google says that it regularly scans Play store for malicious apps and threats, it is clear that in this case Google's Bouncer protection has failed. This means you have to be very very careful about downloading apps.
Check Point says that it has reported that rogue apps, which had Judy code in them, to Google and that those apps are now gone from Google Play store. But you should still be careful about downloading unknown apps.
How do you know if Judy has affected your phone or not?
The best way to find out is to see whether you have any of these installed or not. There is no other tool. If you have any of these apps installed, your phone is most likely infected. You should format your phone ASAP.
Problems? See this thread at archive.org.)
