[General Topics] ohiojoe:
Reporting a maliciois app in Android Market

RE: Homerun 3D and Slice It

I searched for a proper place to ask this, and describe what I found, and found this thread. I am aware Google has a malicious app reporting process, but I was wondering if any of the great minds here know of a more efficient means to get an app scrutinized by the Market powers-that-be.

The App is a duo, really, that I know of so far. I did not go too far with my investigations once I determined this is a Chinese company (remember the lcd picture frame Trojan?) and once I saw what I did.

I downloaded "Homerun 3D" for my EVO 4G (cyanogen mod), a kick ass batting game to which I quickly was addicted. However, as is common with many apps, during transitions (ad breaks) it would overlay a large ad for various other apps, but the most heavily pushed app (by an estimated 9:1 ratio relative to other apps) was "Slice It", offering extra bonuses in the Homerun 3D game if you DL'd it. I dl'd it and installed it, but once I opened it, superuser notified me it was attempting root access. Of course, this is a HUGE deal, in fact I'd say (and request feedback from those in the know) that proves it is a malicious app, given that no where did it mention that it needed or would use root access. I can't fathom this being an 'honest' developer's mistake.

So I denied it root access and it launched anyway. Hm. In other words, an ingenious method to check for unlocked doors without having to set up a complex ruse of creating an app that notifies it will need to have root access to work. Just write a kick ass fun and addictive 'innocent' app, heavily push and offer incentives to dl and install a so-so app that checks for an exploits unprotected root access, and wah-la, due to the intensely developed dun and addictive nature of the 'innocent' app, you have a much wider distribution of your Trojan that ostensibly gets more chances of hitting an unlocked door. By adding the extra layer of an 'innocent' app, that high-end intensely developed app continues to be listed on the market and continues to push the simple trojan app and so only the trojan app gets removed once discovered. All that the devs need to do then is quickly hammer out another trojan simple app, and update the high-end app to push the new low-end app, instead of developing a whole different kick ass app each time they're discovered.

It's the equivalent of a legit door-to-door cable tv salesmen heavily referencing an unscrupulous installer who is known to sneak around the your house looking for unlocked drawers, cabinets, etc. The fact that the legit cable salesman heavily references him makes that cable salesman very suspicious.

So, while I suspected the Homerun 3D app was complicite given the heavy pushing of the 'Slice It' root checking app, I kept poking around. I looked at the "credits" and while seemingly not hiding the fact they all had Asian sounding names, the use of the middle name nick (as in Jung "Madman" Li) seemed overdone, as if they used corny English nicks, almost too corny to be real, to appear disarming.

But the final straw was when I looked at one of the standard banner ads that run along the bottom of the screen during gameplay. It was a generic Best Buy (low res graphics at that) ad for a $349 laptop. I clicked it and it took me to an ad proxy URL which reported it could not resolve the URL. But get this...the URL of the ad proxy showing in my browser window was:

fraud.mojility.com.

Hm. Not sure why mojility would redirect a banner add to land on a URL with "fraud" in its address, and yet not explain why, but all my circumstantial evidence put together (as if Slice It's secret root checking is not enough in and of itself) warrants a report, I think.

1. Homerun 3D app heavily pushes obvious Trojan app.

2. Homerun 3D app contains at least one banner that directs to a fraud URL.

3. Homerun 3D app credits seem concocted.

4. Slice it app SECRETLY checks for root access, works anyway when denied.

So, thoughts about my tentative conclusion? And if it's agreed, anyone know a more efficient means to alert of a potential malicious app than the Android process?