HiddenAds Spread via Android Gaming Apps on Google Play

Authored
by
Dexter
Shin 

Minecraft
is
a
popular
video
game
that
can
be
played
on
a
desktop
or
mobile.
This
is
a
sandbox
game
developed
by
Mojang
Studios.
Players
create
and
break
apart
various
kinds
of
blocks
in
3-dimensional
worlds
and
they
can
select
to
enjoy
Survivor
Mode
to
survive
in
the
wild
or
Creative
Mode
to
focus
on
being
creative. 

Minecraft’s
popularity
has
led
to
many
attempts
to
recreate
similar
games.
As
a
result,
there
are
so
many
games
with
the
same
concept
as
Minecraft
worldwide.
Even
on
Google
Play,
we
can
easily
search
for
similar
games.
McAfee
Mobile
Research
Team
recently
discovered
38
games
with
hidden
advertising.
These
HiddenAds
applications
discovered
on
the
Google
Play
Store
and
installed
by
at
least
35
million
users
worldwide,
have
been
found
to
send
packets
stealthily
for
advertising
revenue
in
bulk.

 

McAfee,
a
member
of
the


App
Defense
Alliance,

focused
on
protecting
users
by
preventing
threats
from
reaching
their
devices
and
improving
app
quality
across
the
ecosystem.
reported
the
discovered
apps
to
Google,
which
took
prompt
action
and
the
apps
are
no
longer
available
on
Google
Play.
Android
users
are
protected
by


Google
Play
Protect,
which
can
warn
users
of
identified
malicious
apps
on
Android
devices,
and
McAfee
Mobile
Security
detects
this
threat
as
Android/HiddenAds.BJL.
For
more
information,
and
to
get
fully
protected,
visit


McAfee
Mobile
Security. 

How
is
it
distributed
to

users? 

They
were
officially
uploaded
to
Google
Play
under
various
titles
and
package
names. Many games
have
already
been
downloaded
by
users,
including
apps

with

10M+
downloads. 

Figure



1.

10M+
downloaded
app
being
one
of

them 

Also,
because
they
can play

the
game,
users
can’t
notice
the
large
amount
of
advertising
packets
being
generated
on
their
devices. 

Figure



2.

Game
screen
that
can
be
played 

What
does
it

do?

After
the
game
is
running,
the
user
can
play
without
any
problems
in
the
block-based
world,
only
like
Minecraft-type
games.
However,
advertisement
packets
of
various
domains
continuously
occur
on
the
device.

For
example,
the

four

packets
shown
in
the
picture
are

questionable

packets
generated
by the
ads libraries
of
Unity,
Supersonic,
Google,
and

AppLovin.

Unfortunately,

nothing
is
displayed
on
the
game
screen. 

Figure



3.

Continuous
advertising
packets 

What’s

even
more
interesting
is
the

initial

network
packets
of
these
games.

The

structure

of
the

initial

packet
is
very
similar.

All
domains
are
different.

But

using
3.txt
as
the
path
is
equivalent.
That
is,
packets
in
the
form
of
https://(random).netlify.app/3.txt
commonly
occur
first.

The
picture
below
is
an
example
of
the
first
packet
extracted
from
three
different
apps. 

Figure



4.

Similarity
of
the

initial

packet
form 

Users

affected

worldwide 

This
threat
has
been
detected
in
various
countries
around
the
world.
Indicated
by
our
telemetry,
the
threat
has
been
most
prominently
detected
in
the
United
States,
Canada,
South
Korea,
and
Brazil.

Figure



5.

Users
around
the
world
who
are
widely

affected 

As
we
featured
in


the

McAfee
2023
Consumer
Mobile
Threat
Report,
one
of
the
most
accessible
content
for
young
people
using
mobile
devices
is
games.
Malware
authors
are
also
aware
of
this
and
try
to
hide
their
malicious
features
inside
games.
Not
only
is
it
difficult
for
general
users
to
find
these
hidden
features,
but
they
can
easily
trust
games
from
official
stores
such
as
Google
Play. 

We
first
recommend
that
users
thoroughly
review
user
reviews
before
downloading
applications
from
the
store.
And
users
should
install
security
software
on
their
devices
and
always
keep
up
to
date. 

Indicators
of
Compromise 

Introducing
McAfee+

Identity
theft
protection
and
privacy
for
your
digital
life

Download
McAfee+
Now

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts