6 ms·

I'm interested if anyone has been able to identify the library or spot any clues other than the image from the article http://www.fireeye.com/blog/wp-content/up

by Sektor 13y ago

I'm interested if anyone has been able to identify the library or spot any clues other than the image from the article http://www.fireeye.com/blog/wp-content/uploads/2013/10/screen.png http://www.fireeye.com/blog/wp-content/uploads/2013/10/scree...

jevinskie 13y ago
I'm curious as to why FireEye chose not to disclose the library. What would you call this kind of disclosure?
- Sektor 13y ago
  Covering their own asses so the framework dev doesn't come after them is the only reason I could see. The pixelization just reminds me of 'dodgy plumbers' on 'current affairs' shows or somesuch. I'm sure someone will recognize the pictured app eventually.
- greenyoda 13y ago
  "I'm curious as to why FireEye chose not to disclose the library." For the same reason that most responsible security researchers don't disclose zero-day threats: to prevent people from exploiting them before they can be fixed. In this case, they did notify Google, which can pull the compromised apps out of their app store and notify the developers who've used this library that they need to rewrite their apps.
- gcb0 13y ago
  your point is moot. The ad library, who runs the code and expose the JS apis so that html ads can call it, proably advertise to its clients that they can do that. So which actor exactly is being left out if they do not disclose? only the victims.
Sektor 13y ago
Just noticed it seems to be some sort of tamagotchi clone from what I can see. the yellow/white meter could be growth and the icon to the right an egg. this (unrelated) app uses the same 'notebook' style of backdrop. https://lh3.ggpht.com/8gjIb24gOSjoLwxYvVgfFfMz9ItAT_0h86QRlYJAl2lptKz-xtFFNiFlGbAnkj8beA-1=h900 https://lh3.ggpht.com/8gjIb24gOSjoLwxYvVgfFfMz9ItAT_0h86QRlY...
ricardobeat 13y ago
It could be any of a dozen in the 2% range http://www.appbrain.com/stats/libraries/ad http://www.appbrain.com/stats/libraries/ad
duked 13y ago
The game is candy crush so I assume it refers to AdTrack.king which is strange because googling that library shows that people knew it was malicious even while it wasn't flagged as such by mobile AV. http://malwarefixes.com/remove-adtrack-king-com-redirect/ http://malwarefixes.com/remove-adtrack-king-com-redirect/

by Sektor 13y ago

jevinskie 13y ago

I'm curious as to why FireEye chose not to disclose the library. What would you call this kind of disclosure?

Sektor 13y ago
Covering their own asses so the framework dev doesn't come after them is the only reason I could see. The pixelization just reminds me of 'dodgy plumbers' on 'current affairs' shows or somesuch. I'm sure someone will recognize the pictured app eventually.
greenyoda 13y ago
"I'm curious as to why FireEye chose not to disclose the library." For the same reason that most responsible security researchers don't disclose zero-day threats: to prevent people from exploiting them before they can be fixed. In this case, they did notify Google, which can pull the compromised apps out of their app store and notify the developers who've used this library that they need to rewrite their apps.
gcb0 13y ago
your point is moot. The ad library, who runs the code and expose the JS apis so that html ads can call it, proably advertise to its clients that they can do that. So which actor exactly is being left out if they do not disclose? only the victims.

Sektor 13y ago

Just noticed it seems to be some sort of tamagotchi clone from what I can see. the yellow/white meter could be growth and the icon to the right an egg. this (unrelated) app uses the same 'notebook' style of backdrop. https://lh3.ggpht.com/8gjIb24gOSjoLwxYvVgfFfMz9ItAT_0h86QRlYJAl2lptKz-xtFFNiFlGbAnkj8beA-1=h900 https://lh3.ggpht.com/8gjIb24gOSjoLwxYvVgfFfMz9ItAT_0h86QRlY...

ricardobeat 13y ago

It could be any of a dozen in the 2% range http://www.appbrain.com/stats/libraries/ad http://www.appbrain.com/stats/libraries/ad

duked 13y ago

The game is candy crush so I assume it refers to AdTrack.king which is strange because googling that library shows that people knew it was malicious even while it wasn't flagged as such by mobile AV. http://malwarefixes.com/remove-adtrack-king-com-redirect/ http://malwarefixes.com/remove-adtrack-king-com-redirect/