Now, the researchers say iPhone apps linked to the malware could also present a risk.<\/p>\n
Wandera, an enterprise security firm, said it found 14 apps \u2014 all retro-style games \u2014 that were communicating with the same command and control server used by the Golduck malware.<\/p>\n
\u201cThe [Golduck] domain was on a watchlist we established due to its use in distributing a specific strain of Android malware in the past,\u201d said Michael Covington, Wandera\u2019s vice-president of product. \u201cWhen we started seeing communication between iOS devices and the known malware domain, we investigated further.\u201d<\/p>\n
The apps include:\u00a0Commando Metal: Classic Contra<\/a>,\u00a0Super Pentron Adventure: Super Hard<\/a>,\u00a0Classic Tank vs Super Bomber<\/a>,\u00a0Super Adventure of Maritron<\/a>,\u00a0Roy Adventure Troll Game<\/a>,\u00a0Trap Dungeons: Super Adventure<\/a>,\u00a0Bounce Classic Legend<\/a>,\u00a0Block Game<\/a>,\u00a0Classic Bomber: Super Legend<\/a>,\u00a0Brain It On: Stickman Physics<\/a>,\u00a0Bomber Game: Classic Bomberman<\/a>,\u00a0Classic Brick \u2013 Retro Block<\/a>,\u00a0The Climber Brick<\/a>, and\u00a0Chicken Shoot Galaxy Invaders<\/a>.<\/p>\n According to the researchers<\/a>, what\u00a0they saw so far seems relatively benign \u2014 the command and control server simply pushes a list of icons in a pocket of ad space in the upper-right corner of the app. When the user opens the game, the server tells the app which icons and links it should serve to the user. They did, however, see the apps sending IP address data \u2014 and, in some cases, location data \u2014 back to the Golduck command and control server. TechCrunch verified their claims, running the apps on a clean iPhone through a proxy, allowing us to see where the data goes. Based on what we saw, the app tells the malicious Golduck server what app, version, device type, and the IP address of the device \u2014 including how many ads were displayed on the phone.<\/p>\n As of now, the researchers say that the apps are packed with ads \u2014 likely as a way to make a quick buck. But they expressed concern that the communication between the app and the known-to-be-malicious server could open up the app \u2014 and the device \u2014 to malicious commands down the line.<\/p>\n \u201cThe apps themselves are technically not compromised; while they do not contain any malicious code, the backdoor they open presents a risk for exposure that our customers do not want to take.<\/p>\n \u201cA hacker could easily use the secondary advertisement space to display a link that redirects the user and dupes them into installing a provisioning profile or a new certificate that ultimately allows for a more malicious app to be installed,\u201d said the researchers.<\/p>\n That could be said for any game or app, regardless of device maker or software. But the connection to a known malicious server isn\u2019t a good look. Covington said that the company has \u201cobserved malicious content being shared from the server,\u201d but that it wasn\u2019t related to the games.<\/p>\n The implication is that if the server is sending malicious payloads to Android users, iPhone users could be next.<\/p>\n TechCrunch sent the list of apps to\u00a0data insights firm Sensor Tower, which estimated that the 14 apps had been installed close to one million times since they were released \u2014 excluding repeated downloads or installs across different devices.<\/p>\n When we tried contacting the app makers, many of the App Store links pointed to dead links or to pages with boilerplate privacy policies but no contact information. The registrant on the Golduck domain appears to be fake, along with other domains associated with Golduck, which often have different names and email addresses.<\/p>\n Apple did not comment when reached prior to publication. The apps are appear to still be downloadable from the App Store, but all now say they are \u201cnot currently available in the U.S. store.\u201d<\/p>\n Apple\u2019s app stores may have a better rap than Google\u2019s, which every once in a while lets malicious apps<\/a> slip through the net. In reality, neither store is perfect. Earlier this year, security researchers found a top-tier app in the Mac App Store that was collecting users\u2019 browsing history<\/a> without permission, and dozens of iPhone apps that were sending user location data<\/a> to advertisers without explicitly asking first.<\/p>\n For the average user, malicious apps remain the largest and most common threat to mobile users \u2014 even with locked down device software and the extensive vetting of apps.<\/p>\n If there\u2019s one lesson, now and always: don\u2019t download what you don\u2019t need, or can\u2019t trust.<\/p>\n Cybersecurity 101: Five simple security guides for protecting your privacy<\/a><\/p>\n<\/blockquote>\n<\/div>\n Powered by WPeMatico<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":" Security researchers say they\u2019ve found more than a dozen iPhone apps covertly communicating with a server associated with Golduck, a historically Android-focused malware that infects popular classic game apps. The malware has been known about for over a year, after it was first discovered by Appthority infecting classic and retro games on Google Play, by… Read the full article…<\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[174,377],"tags":[],"class_list":["post-58306","post","type-post","status-publish","format-standard","hentry","category-games-media","category-gaming"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
<\/p>\n