1. Home
  2. Techniques
  3. Mobile
  4. Generate Traffic from Victim

Generate Traffic from Victim

Adversaries may generate outbound traffic from devices. This is typically performed to manipulate external outcomes, such as to achieve carrier billing fraud or to manipulate app store rankings or ratings. Outbound traffic is typically generated as SMS messages or general web traffic, but may take other forms as well.

If done via SMS messages, Android apps must hold the SEND_SMS permission. Additionally, sending an SMS message requires user consent if the recipient is a premium number. Applications cannot send SMS messages on iOS

ID: T1643
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
ⓘ
Tactic: Impact
ⓘ
Platforms: Android, iOS
ⓘ
MTC ID: APP-16
Version: 1.1
Created: 06 April 2022
Last Modified: 20 March 2023
Version Permalink

Procedure Examples

ID Name Description
S0440 Agent Smith

Agent Smith shows fraudulent ads to generate revenue.[1]
S0525 Android/AdDisplay.Ashas

Android/AdDisplay.Ashas can generate revenue by automatically displaying ads.[2]
S0293 BrainTest

BrainTest provided capabilities that allowed developers to use compromised devices to post positive reviews on their own malicious applications as well as download other malicious applications they had submitted to the Play Store.[3]
S0432 Bread

Bread can perform SMS fraud on older versions of the malware, and toll fraud on newer versions.[4]
S0290 Gooligan

Gooligan can install adware to generate revenue.[5]
S0322 HummingBad

HummingBad can create fraudulent statistics inside the official Google Play Store, and has generated revenue from installing fraudulent apps and displaying malicious advertisements.[6]
S0321 HummingWhale

HummingWhale generates revenue by displaying fraudulent ads and automatically installing apps. When victims try to close the ads, HummingWhale runs in a virtual machine, creating a fake ID that allows the perpetrators to generate revenue.[7]
S0325 Judy

Judy uses infected devices to generate fraudulent clicks on advertisements to generate revenue.[8]
S0303 MazarBOT

MazarBOT can send messages to premium-rate numbers.[9]
S0291 PJApps

PJApps has the capability to send messages to premium SMS messages.[10]
S0326 RedDrop

RedDrop tricks the user into sending SMS messages to premium services and then deletes those messages.[11]
S0419 SimBad

SimBad generates fraudulent advertising revenue by displaying ads in the background and by opening the browser and displaying ads.[12]
S0545 TERRACOTTA

TERRACOTTA has generated non-human advertising impressions.[13]
S0424 Triada

Triada can redirect ad banner URLs on websites visited by the user to specific ad URLs.[14][15]

S0494 Zen

Zen can simulate user clicks on ads.[16]

Mitigations

ID Mitigation Description
M1011 User Guidance

Users should be advised that applications generally do not require permission to send SMS messages.

Detection

ID Data Source Data Component Detects
DS0041 Application Vetting Permissions Requests

Application vetting services can detect when applications request the SEND_SMS permission, which should be infrequently used.
DS0042 User Interface System Settings

On Android, the user can review which applications can use premium SMS features in the "Special access" page within application settings.

References

  1. A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020.
  2. L. Stefanko. (2019, October 24). Tracking down the developer of Android adware affecting millions of users. Retrieved October 29, 2020.
  3. Chris Dehghanpoor. (2016, January 6). Brain Test re-emerges: 13 apps found in Google Play Read more: Brain Test re-emerges: 13 apps found in Google Play. Retrieved December 21, 2016.
  4. A. Guertin, V. Kotov, Android Security & Privacy Team. (2020, January 9). PHA Family Highlights: Bread (and Friends) . Retrieved April 27, 2020.
  5. Check Point Research Team. (2016, November 30). More Than 1 Million Google Accounts Breached by Gooligan. Retrieved December 12, 2016.
  6. Dan Goodin. (2016, July 7). 10 million Android phones infected by all-powerful auto-rooting apps. Retrieved January 24, 2017.
  7. Dan Goodin. (2017, January 23). Virulent Android malware returns, gets >2 million downloads on Google Play. Retrieved January 24, 2017.
  8. CheckPoint. (2017, May 25). The Judy Malware: Possibly the largest malware campaign found on Google Play. Retrieved September 18, 2018.
  1. Graham Cluley. (2016, February 16). Android users warned of malware attack spreading via SMS. Retrieved December 23, 2016.
  2. Lookout. (2016, May 25). 5 active mobile threats spoofing enterprise apps. Retrieved December 19, 2016.
  3. Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved September 18, 2018.
  4. Elena Root, Andrey Polkovnichenko. (2019, March 13). SimBad: A Rogue Adware Campaign On Google Play. Retrieved November 21, 2019.
  5. Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.
  6. Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019.
  7. Kivva, A. (2016, June 6). Everyone sees not what they want to see. Retrieved July 16, 2019.
  8. Siewierski, L. (2019, January 11). PHA Family Highlights: Zen and its cousins . Retrieved July 27, 2020.