Third party provided Pokémon GO apk contains malware

[minibois]

To start of the thread a little more light hearted; their title is golden: "DroidJack Uses Side-Load…It's Super Effective! Backdoored Pokemon GO Android App Found"

 

The Android and iOS augmented reality game 'Pokémon Go' has been released in the US, Australia and New Zealand now. People are able to download the apk (Android Application Package) to get their hand on the game though. Security firm 'Proofpoint' has found out that some of the third parties provided apk's have been infected with malware 'DroidJack'.

Quote

In this case, Proofpoint researchers discovered an infected Android version of the newly released mobile game Pokemon GO [1]. This specific APK was modified to include the malicious remote access tool (RAT) called DroidJack (also known as SandroRAT), which would virtually give an attacker full control over a victim’s phone. The DroidJack RAT has been described in the past, including by Symantec [2] and Kaspersky [3]. Although we have not observed this malicious APK in the wild, it was uploaded to a malicious file repository service at 09:19:27 UTC on July 7, 2016, less than 72 hours after the game was officially released in New Zealand and Australia.

 

[...]

 

Individuals worried about whether or not they downloaded a malicious APK have a few options to help them determine if they are now infected. First, they may check the SHA256 hash of the downloaded APK. The legitimate application that has been often linked to by media outlets has a hash of 8bf2b0865bef06906cd854492dece202482c04ce9c5e881e02d2b6235661ab67, although it is possible that there are updated versions already released. The malicious APK that we analyzed has a SHA256 hash of 15db22fd7d961f4d4bd96052024d353b3ff4bd135835d2644d94d74c925af3c4.

 

Another simple method to check if a device is infected would be to check the installed application’s permissions, which can typically be accessed by first going to Settings -> Apps -> Pokemon GO and then scrolling down to the PERMISSIONS section. Figure 1 shows a list of permissions granted to the legitimate application. These permissions are subject to change depending on the device’s configuration; for example the permissions “Google Play billing service” and “receive data from Internet” are not shown in the image but were granted on another device when downloading Pokemon GO from the Google Play Store. In Figures 2 and 3, the outlined permissions have been added by DroidJack. Seeing those permissions granted to the Pokemon GO app could indicate that the device is infected, although these permissions are also subject to change in the future.

Quote

Spoiler

Figure 1: Granted permissions from legitimate Pokemon GO APK

Spoiler

Figure 2: Granted permissions from the backdoored Pokemon GO APK (first screenshot)

Spoiler

Figure 3: Granted permissions from backdoored Pokemon GO APK (second screenshot)

(Description underneath picture)

 

The article notes that infected versions of the app are indistinguishable from the real one (except for its permissions and has code)

 

Their conclusion:

Quote

Conclusion

 

Installing apps from third-party sources, other than officially vetted and sanctioned corporate app stores, is never advisable. Official and enterprise app stores have procedures and algorithms for vetting the security of mobile applications, while side-loading apps from other, often questionable sources, exposes users and their mobile devices to a variety of malware. As in the case of the compromised Pokemon GO APK we analyzed, the potential exists for attackers to completely compromise a mobile device. If that device is brought onto a corporate network, networked resources are also at risk.

 

Even though this APK has not been observed in the wild, it represents an important proof of concept: namely, that cybercriminals can take advantage of the popularity of applications like Pokemon GO to trick users into installing malware on their devices. Bottom line, just because you can get the latest software on your device does not mean that you should. Instead, downloading available applications from legitimate app stores is the best way to avoid compromising your device and the networks it accesses.

Source (with more pictures, more information on how the malware was package, where it was distributed, under what codes and references): https://www.proofpoint.com/us/threat-insight/post/droidjack-uses-side-load-backdoored-pokemon-go-android-app

 

My conclusion:

It sucks that people are taking advantage of the popularity and unavailability of the application elsewhere in the world to trick people into potentially downloading their malware. I am glad they have not found the infected app they analyzed, advertised by any websites, but oh well  

This just further shows that you should always be careful on what you download.

[suicidalfranco]

tl;dr: do your homework before downloading from shady sources 

[ThinkWithPortals]

I should probably tell my multiple friends who downloaded it like this...

[Misanthrope]

Mine seems clean according to those permissions, got the link from OC3D earlier today.

 

Oh well hackers might look at a few nudes I have on my phone, do let me know if you see me on an amateur porn site to laugh hehehe

[vorticalbox]

it's on the play store so use one of the many websites that pull apk from google play.

[dtaflorida]

I don't know why ppl even use 3rd part repositories when it's on the Play store and it's free-to-play.

[minibois]

8 minutes ago, dtaflorida said:

I don't know why ppl even use 3rd part repositories when it's on the Play store and it's free-to-play.

It's not released anywhere that is not US, Australia or New Zealand, so you can't even find it on the Play Store in many places. Downloading the apk and installing it will have the game working though.

[BuckGup]

Just to think 2 days ago I posted a thread about how it was stealing your google account login data

[SurvivorNVL]

That's what you get for liking Poke-man.

[Thony]

Why did they release is in those countries 1st ???

The app is still not available for UK on android WTF nintendo ????

[minibois]

12 minutes ago, Thony said:

Why did they release is in those countries 1st ???

The app is still not available for UK on android WTF nintendo ????

Apparently it had to do with them thinking the servers could not handle a worldwide release, so that is why they released it in parts.

[minibois]

21 minutes ago, SurvivorNVL said:

That's what you get for liking Poke-man.

 

[DevilishBooster]

*GASP!!!* Egad!! An unauthorized, third-party installation of a mobile game contains malware!?!? Nooooooooooo.... Say it ain't sooo....

[Trik'Stari]

Pokemon Go has already been used, in its base functionality, to allow people to mugg other people.

 

Congratulations, you are now aware that spying, telemetry, GPS, whatever you want to call it, actually MAKES. YOU. VULNERABLE.

 

"Nothing to hide nothing to fear" has never been a legitimate argument, unless you consider Hitlers S.S. to be a valid source of argument. (also the USSR's KGB, who did the same thing).

 

Why bother with hacking your phone, when I can just wait for you to come to a gym, hit you over the head from behind, and steal your credit card and your phone?

[WelshDdraig]

Just checked the version that I have installed, all good - although getting a GPS signal where I live is like finding gold in the middle of a city - next to impossible. But it was working in the UK before, so the version I have works and is not just malware.

But those fans who just want the app will most likely rush past the permissions screen and download from un-trusted sources. It is sneaky how fast people modified the APK to add this stuff. 

Thanks for the information. 

[Thony]

8 hours ago, Minibois said:

Apparently it had to do with them thinking the servers could not handle a worldwide release, so that is why they released it in parts.

But why did they pick New Zealand and Australia before UK ?

[Syfes]

5 hours ago, Trik'Stari said:

Why bother with hacking your phone, when I can just wait for you to come to a gym, hit you over the head from behind, and steal your credit card and your phone?

Because I'm a 6ft tall 250lbs bear?

[skywake]

36 minutes ago, Thony said:

But why did they pick New Zealand and Australia before UK ?

Because Australia has a smaller population that's spread out over a larger range of timezones and is less in sync with the US. When New York sleeps, London is waking up and Sydney is getting over Lunch. Being on the other side of the world has its advantages.

[manikyath]

 

i found this one on the twitters a while back, chances are that this person is using the backdoored app?