Malicious Android Apps Have Taken Over More Than 1M Google Accounts

[cyndi]

Read about it here
https://consumerist.com/2016/11/30/...have-taken-over-more-than-1m-google-accounts/

Check your device here
https://gooligan.checkpoint.com/

 

[#1BonBonQueen]

Thank you Cyndi,
I just checked my devices, no problems. 
Everyone should check their stuff, making sure it is OK.
Thanks to your heads-up, I am safe.
Sharon

 

[frater secessus]

Android has a built-in stopwatch, and no one needs "Perfect Cleaner" or "WiFi enhancer". So it's hard for me to have a lot of sympathy for folks that d/l crap and grant the requested permissions.

 

[GotSmart]

The only things I have downloaded are gas buddy, banking, and a flashlight.

 

[LeeRevell]

Awhile back, the flashlight apps were indicated as major virus vectors. I carry an LED light as part of my EDC.
A week ago I clicked on a link on one of my primary forums, and got a take-over attempt. Luckily managed to exit out and no indication of trouble since. What probably saved me likely was the malware was aimed at Windoze, and didn't get a good bite of my Android OS.
I also avoid all those listed Google items, except my Gmail account. I refuse to store info online or in "the cloud".

 

[ArtW]

safe! tanks Cyndi

 

[MikeRuth]

According to deployment data, the US has only been hit with about 7% of users. Much higher 50%+ in Asia.

I have advised my client that my concern is only if you have used the sme password for your google account and online financial accounts, If so change your passwords ASAP.

MIke R

 

[Almost There]

As someone who doesn't know a whole lot about this!

Question for you: Does this only affect your PHONE (not laptop) if and only if you use Google on your phone for looking at your mail?

I only ever use Google on my phone to do a quick search for 'the closest XX'.

I do use my phone as a mobile hotspot to connect my laptop for email/forums/etc. etc.

 

[MikeRuth]

At this time the malicious software is attacking Android phones when someone loads a program from a third party source. In your case I would assume any software you have added to your phone came from the Google play store, all software from the play store is rigorously tested and 99% safe. Typically third party software also requires making changes to your phone settings to allow that software to installed, otherwise you will be warned and can't install the software. 
Mike

 

[Almost There]

Thanks MikeRuth!

At this point I'm just learning to turn off about umpteen pre-installed apps that I don't want, will never use and didn't ask for

I know they only use a smidgeon of data while 'running in the background' but why I need an NFL app I'll never know. The HTC phone from Verizon came loaded with a ton of apps.

The only thing I've added to the phone is LocSMS and GasBuddy.

Funny story about phone service. Well it's funny now, certainly wasn't yesterday...

When I got my service turned on this fall, I didn't opt for auto-pay which would have given me an extra gig of data on Verizons' prepaid service. Yesterday I'm almost at my limit with another 8 days to go in the cycle so I figure I'll just put it on Auto-pay so I have more high speed. 2 hours of fighting with the Verizon computer and call center, they tell me that I can't do that because I'm using a credit card with a billing address outside the US...Well duh, of course I am. It's a US credit card, issued by a US bank but I have no billing address inside the US. The 3rd CSR I talked to gave me a credit of a Gig of data because she couldn't help me and suggested maybe a store would be able to! Found a store right on my route across Texas, so I stopped in. A new 'prepaid' plan had just come out that would cost me $10.00 more a month but would double my data usage limit. Ha, don't need to put anything on auto pay, just switch plans. 10 minutes later, I'm a very happy camper! Not only have I doubled my limit but it rolls over to the next month as long as I pay on time!

Go on down the highway, get the Brownwood TX and I've only got 1X service. Make an assumption that since I spent 2 hours on the phone, dealt with multiple CSR's AND the store personnel that someone somewhere pressed a wrong damn key and I have NO data service instead of double. I stopped at a gas station this morning to ask a local where I could find a Verizon store cause I couldn't look them up on line. Guess what, plain smack in the middle of Texas is this big ass hole of Verizon service. Anything within a 30 - 40 mile radius of the town has NO Verizon data service at all. The gas station manager just laughed at me, she says it's a regular occurrence to get asked the same thing by all the travelers coming through town!

Happy as a clam 50 miles down the road, getting caught up!

 

[frater secessus]

AT, on recent versions of Android (last couple of years) you can pull up the Settings | Apps menu and select the unwanted app.  If it was preinstalled you can probably Disable it, which will lock it down.  If it was installed afterwards you can Uninstall it from there.  

This will stop the creeping background data use and battery consumption.

If you only want to control sneaky data use you can go to Settings | Mobile Data (or Data Usage, depending) and select any apps you see listed as being hogs.  Tap on the hog and Restrict app background data.  It will still be able to use mobile data when you are using the app but not when you are not interacting with it.  Apps that you intend to run in the background (email, texting, nav, google services, streaming, whatever) should keep access to background data.

 

[wayne49]

Be careful giving your email address to CheckPoint or any other third party.

You would had to have installed the app from outside of the Play Store. You have to specifically give permission to install apps from a third party source.

"Gooligan spreads when victims download and install an infected app. Crooks are slinging the malware by tricking victims into following malicious links in phishing messages."

What I find interesting is that it would be simple to name the malicious app, but they don't do that in their press release.

 

[DannyB1954]

Never heard of check point. I wonder if they are not just pfishing for good email addresses. If they already had the addresses, why don't they send a letter to all that have been compromised?

I got an email, (appeared to be from pay pal), said my account was used in another city and if that wasn't me to contact them immediately. It gave a link. Guess what, it wasn't from paypal but from a scammer. NEVER click on a link from an email like that! Open a new window and go to paypal manually or from your favorites list.

To see if your account has been breached, send me your name, date and place of birth social security number, mother's maiden name and the numbers off of all your credit cards with expiration dates and code numbers. 

Sorry, the devil made me do it.

 

[cyndi]

The consumerist, a non profit sibling of The Consumer advocate, is a reliable source.

 

[FrozenTundra]

I don't think this is a problem for more recent phones.  It's my understanding that "gooligan" is specifically targeting older, outdated versions of Android.  

I believe it only effects phones running on Jelly Bean, Kitkat, and Lollipop.  Newer versions of the OS(Marshmallow and Nougat) are not effected.  


There is something that's important to understand about Android OS and the Android phones that run it.  "Android" isn't "Android" isn't "Android".  

Google owns Android.  Google makes, or contracts to have made, several Android devices.  The phones among these devices are called Nexus 5x, Nexus 6p(both older models), and the new Google Pixel phones.  These phones run on google's software and google controls the updates completely.  They get the monthly security updates to the Android OS system each and every month.  These are the only Android phones that google controls directly.  

Android itself is a OPEN SOURCE operating system that google licenses and distributes free of charge.  It won't run a phone all by itself.  It's a base software package.  Other companies(Samsung, LG, Motorola, OnePlus, the list goes ever on and on....) take this base operating system and sort of "complete" it, for lack of a better term.  It becomes their proprietary version of Android that is made to run specifically on that make and model of phone.   

Here in lies a problem.  

Google cannot update these phones.  They can, and do, release a monthly security update to the base operating system, but it's up to the manufacturers of the phones(or sometimes the service providers as well) themselves to take this update and apply it to the specific build of Android they have created for your specific phone.  

Hardly any of them bother.  

At least past a certain point.  Some of the major high end players, like Samsung, do a pretty good job of it on their newest, HIGH END models.  They pretty much ALL fail to bother with it on lower end or aging models.  

Apple doesn't really have this problem because their OS is the opposite of open source.  They control all the hardware, as well as all the software.  They also cost a small fortune.   

I prefer Android phones, but it pays to understand the nature of this issue.  For anybody that wants to learn more, I'd recommend reading articles about Android security by Jerry Hildenbrand over at Android Central(.com).  This guy really knows his stuff and is one of the few people who actually cares deeply about the issue on a personal level.  His articles are geared toward normal people, not just ultra-tech-geek squad. 
http://www.androidcentral.com/monthly-security-patches-are-most-important-updates-youll-never-get

Now don't freak out and throw away your phone.  
My 3rd Gen(2013) Motorola Moto G is still running on the December 2015 security patch.  I'm not happy about it, but I'll put up with it for now because I'm cheap.  I'll not use if for mobile banking though, even if the odds that I'll have a problem are really low.

 

[Goshawk]

Not using a phone for mobile banking may be less secure. You never get any warnings. My bank account had $1000 stolen via ATM cloning of a card. Found out via checking the account and automatic text messages.

My plan is to just keep up to date with the latest OS version. Make sure my phone can handle that. So security is the best it can be. Will never trust third party OS tools.


Sent from my iPhone using Tapatalk

 

[cyndi]

I don't think this is a problem for more recent phones.  It's my understanding that "gooligan" is specifically targeting older, outdated versions of Android.

That's what the article states

 

[frater secessus]

Android itself is a OPEN SOURCE operating system that google licenses and distributes free of charge.  It won't run a phone all by itself.  It's a base software package.  Other companies(Samsung, LG, Motorola, OnePlus, the list goes ever on and on....) take this base operating system and sort of "complete" it, for lack of a better term.  It becomes their proprietary version of Android that is made to run specifically on that make and model of phone.

I might push back against this part a little.  The based Android Open Source Project (AOSP) will run on a phone;.  here's an example.  Folks with rooted phones and cooperative bootloaders may be able to shoehorn a clean AOSP ROM onto their phones.  It's amazing how well a clean OS runs on older hardware.
My Blu Studio XL (~$100 Chinese 5.5" phone) was AOSP + google apps + Blu's help and updater app.  Very clean.  My old Note 2 came with Samsung's version of Jellybean (or ICS, can't remember);  the stock ROM was ~900MB and the AOSP ROM for the same version it was ~178MB.  That is some serious bloat.

Other companies.... take this base operating system and sort of "complete" it, for lack of a better term

A better term might be corrupt or adulterate.  IMO most of the changes are pointless and resource-squandering "features" for branding/marketing purposes.  
Relatively few manufacturer changes are actually value-added:  the Note series' stylus software, upgraded cameras, tuned kernels.  
Verizon in particular is infamous for disabling features from AOSP so they can charge people to add them back (tethering, etc).  

I suspect the telcos don't want Google to push core android updates.  It short-circuits the planned obsolescence model.

 

[LeeRevell]

This explains my recent troubles. My four year old Galaxy SIII that I bought new for $100 got to tbe point the old battery was getting to where it took forever to charge and didn't last as long as it used to, and worse the OS and browser had not been updated in a good while, and was no longer recognised by many sites. Neither app source would even allow me in, and I couldn't download any apps. The phone worked fine otherwise, and I used maybe ten percent of what it could do, it had so many bells & whistles.
So, "programmed obsolescence". I ended up spending big money getting the S7 Edge, and a new contract.
I do like the new phone, though NONE of the newly added features are anything I will ever use. A lot of the new google-based apps are useless to me. Much of it is cloud-based nonsense and social website garbage I refuse to use. A lot of sports and music garbage I will never use. A Hell of a lot of bloat. I am tempted to uninstall or disable these garbage apps, but have been concerned about how deeply some are integrated with other useful apps or the phone's essential programming.
My 25 year career in IT was batch processing on a huge mainframe, where the same programs worked fine thirty years down the road.
The way PCs, laptops and smart phones are literally obsolete the moment they hit the stores, and we are forced to completely replace machines and software every very few years boggles my mind, and strikes me as a bald-faced program of building profit for the companies involved, nothing more. We are addicted to our electronic toys, and are led by our noses back to the stores for new machines, and ever more software.
I am disgusted with it all, but I too am addicted to the screen candy.
The only way off this insidious merry-go-round is to totally give up our electronics. I am not ready to use that "nuclear option" just yet. Heaven help us.

 

[Vagabound]

One solution, or at least large improvement, to this is to buy a Nexus 5x from Google.  I just did that a month ago.  Cost $250.  I can't imagine that people are getting reliable phones for much less elsewhere.  See here for details:

https://vanlivingforum.com/Thread-Nexus-5-Phone?pid=245247#pid245247