8 Popular Android Apps Caught Up In Million-Dollar Ad Fraud Scheme

Nov 27, 2018

Cheetah Mobile—a prominent Chinese app company, known
for its popular utility apps like Clean Master and Battery
Doctor—and one of its subsidiary Kika Tech have allegedly
been caught up in an Android ad fraud scheme that stole millions of
dollars from advertisers.

According to app analytics firm Kochava, 7 Android apps
developed by Cheetah Mobile and 1 from Kika Tech with a total 2
billion downloads on Google Play Store have been accused of falsely
claiming the credits for driving the installation of new apps in
order to claim a fee or bounty.

Many mobile application developers generate revenue by promoting
and recommending the installation of other apps inside their apps
for a fee or a bounty that typically ranges from $0.50 to
$3.00.

To know which advertisement recommended the app and should get the
credit, the newly installed app does a “lookback” immediately after
it is opened for the first time to see from where the last click
was originated and attribute the installation accordingly.

However, Kochava found that Cheetah Mobile and Kika Tech apps
are misusing user permissions to track when users download new apps
and are apparently exploiting this data to hijack app-install
bounties for even apps installed from other referrals, according to
Buzzfeed
News.
^[1]

“This is theft — no other way to say it,” Grant Simmons, the head
of client analytics for Kochava, told the publication. “These are
real companies doing it — at scale — not some random person in
their basement.”

Here’s the list of seven Cheetah Mobile apps and one Kika app,
which received an investment from Cheetah Mobile in 2016, caught
participating in the fraudulent ad scheme:

Clean Master (with 1 billion users)
Security Master (with 540 million users)
CM Launcher 3D (with 225 million users)
Battery Doctor (with 200 million users)
Cheetah Keyboard (with 105 million users)
CM Locker (with 105 million users)
CM File Manager (with 65 million users)
Kika Keyboard (owned by Kika Tech with 205 million users)

So, if you have any of the above-listed apps installed on your
Android device, you are recommended to uninstall them
immediately.
These apps inappropriately claim credits for having caused the app
downloads even when they played no role in the installations. The
bounties, in this case, range in the millions of dollars.

You can have a look on the typical ad referral process (left
picture) versus a hijacked ad referral process (right
picture).

Kika Tech responded to the allegations, claiming the company
“has no intentions of engaging in fraudulent practices,” and it
“will do everything to quickly and fully rectify the situation and
take action against those involved.”

However, Cheetah Mobile blamed third-party SDKs (software
development kits) or ad networks for the click injection, but when
Kochava pointed out the SDK involved in the click fraud activity is
actually owned and developed by Cheetah Mobile itself, and not by
third parties, Cheetah denied that its SDKs were involved in ad
fraud.

When contacted, Google told the publication that the company is
still investigating Cheetah Mobile and Kika Tech apps for any
fraudulent activity reported by the app analytic firm.

References

^{^}
Buzzfeed News
(www.buzzfeednews.com)

The Hacker News Headlines

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

Aug 18, 2023

The Hacker News Headlines

Google Chrome’s New Feature Alerts Users About Auto-Removal of Malicious Extensions

Aug 18, 2023

The Hacker News Headlines

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

Aug 18, 2023

OWASP TOP !0

Injection. Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. Broken Authentication. Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently. Sensitive Data Exposure. Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. XML External Entities (XXE). Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks. Broken Access Control. Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc. Security Misconfiguration. Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion. Cross-Site Scripting XSS. XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. Insecure Deserialization. Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks. Using Components with Known Vulnerabilities. Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts. Insufficient Logging & Monitoring. Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.

8 Popular Android Apps Caught Up In Million-Dollar Ad Fraud Scheme

References

Related Post

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

Google Chrome’s New Feature Alerts Users About Auto-Removal of Malicious Extensions

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

You missed

Protected: Rotary VI EAST

Protected: BetterCyberCareer Group

Protected: Benin Club 1931 – Official

Protected: Whatsapp AI Automation Group