Push Technology Used in Mobile Attacks

[silversurfer]

Researchers have detected an Android trojan that abuses the web push technology. In its benign use, web push is used by legitimate websites -- such as news sites -- to send out new event notifications. The less benign use is to employ the technology to send out what amounts to phishing notifications.
 
Android.FakeApp.174 was discovered by Doctor Web researchers in two apps on Google Play. These have since been removed. The malware pretends to be the official app of a major brand. However, when the app is launched, it opens a series of websites in Chrome. Each website asks the user to allow notifications -- sometimes openly, and sometimes disguised as verification proof that the user is human and not a robot.
 
If notifications are allowed by the user, those websites start sending out dubious content. The notifications are received and displayed in the Android status bar even if the browser is closed, and even if the app has been removed. The contact is now between the website and the device -- and the user has given permission for the website to contact it. 
 
The content delivered is dubious to say the least, "from false notifications about cash bonuses or transfers or new messages on social media to advertisements of horoscopes, casinos, goods and services, even various 'news'." Since the attacker has control over the notifications, it could be anything. Examples found by Doctor Web include links to casino sites, adult sites, phishing sites, and snake oil medicines.

"Many of these resources," warn the researchers, "are involved in well-known fraudulent schemes for stealing funds, but attackers can also launch an attack to steal confidential data at any time. For example, by sending an 'important' notification via the browser on behalf of a bank or a social network. Potential victims can think the fake notification is real and tap it only to be redirected to a phishing site, where they will be prompted to indicate their name, credentials, email addresses, bank card numbers, and other confidential information."

SOURCE: https://www.securityweek.com/push-techno...le-attacks