Deliver Malicious App via Authorized App Store

Malicious applications are a common attack vector used by adversaries to gain a presence on mobile devices. Mobile devices often are configured to allow application installation only from an authorized app store (e.g., Google Play Store or Apple App Store). An adversary may seek to place a malicious application in an authorized app store, enabling the application to be installed onto targeted devices.

App stores typically require developer registration and use vetting techniques to identify malicious applications. Adversaries may use these techniques against app store defenses:

Adversaries may also seek to evade vetting by placing code in a malicious application to detect whether it is running in an app analysis environment and, if so, avoid performing malicious actions while under analysis. [1] [2] [3] [4]

Adversaries may also use fake identities, payment cards, etc., to create developer accounts to publish malicious applications to app stores. [2]

Adversaries may also use control of a target's Google account to use the Google Play Store's remote installation capability to install apps onto the Android devices associated with the Google account. [5] [6] (Only applications that are available for download through the Google Play Store can be remotely installed using this technique.)

ID: T1475
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
Tactic: Initial Access
Platforms: Android, iOS
Version: 1.1
Created: 17 October 2018
Last Modified: 14 October 2019

Procedure Examples

Name Description
Bread

Bread has been distributed through the Play Store. Some versions started off as clean to build a userbase and developer reputation. These versions were then updated to introduce malicious code.[14]

Concipit1248

Concipit1248 has been distributed through the App Store.[13]

Corona Updates

Corona Updates has been distributed through the Play Store.[13]

DEFENSOR ID

DEFENSOR ID was delivered via the Google Play Store.[15]

Dvmap

Dvmap was delivered via the Google Play Store. It evaded Google Play Store checks by uploading a clean application, and replacing it with a malicious version for a short period of time. This occurred at least 5 times in a one month period.[11]

Exodus

Exodus One has been distributed via the Play Store.[10]

Pegasus for Android

Pegasus for Android attempts to detect whether it is running in an emulator rather than a real device.[8]

SimBad

SimBad was distributed via the Google Play Store.[12]

Triada

Early Triada variants were delivered through trojanized apps that were distributed via the Play Store.[9]

ZergHelper

ZergHelper apparently evaded Apple's app review process by performing different behaviors for users from different physical locations (e.g. performing differently for users in China versus outside of China), which could have bypassed the review process depending on the country from which it was performed.[7]

Mitigations

Mitigation Description
Application Vetting

App store operators and enterprises could assess reputational characteristics of the app, including the popularity of the app or other apps from the same developer and whether or not security issues have been found in other apps from the same developer.

User Guidance

Encourage developers to protect their account credentials and enable multi-factor authentication if available. Encourage developers to protect their signing keys.

Detection

  • An EMM/MDM or mobile threat defense solution can identify the presence of unwanted or known insecure or malicious apps on devices.
  • Developers can scan (or have a third party scan on their behalf) the app stores for presence of unauthorized apps that were submitted using the developer's identity.

References