Email
The ring of hackers who gathered naked pictures of more than 100 celebrities also planned to use a malware-ridden “clone” of Flappy Bird to steal photos from Android phones.
They aimed to exploit users’ carelessness about the permissions that Android apps demand on installation to gain access to photos stored on the phone and siphon them to a remote location before Google spotted and blocked the malicious app.
The ring, which experts believe may have been stealing and trading photos for at least two and a half years, congregated on the /stol/ – short for “stolen” – forum on image board AnonIB, a spinoff of the notorious 4chan community. That brought together hackers – who would break into celebrities’ phones, computers and cloud backup services to gain access to private photos – and “hoarders” who would pay substantial sums to receive copies of pictures that had not been made public.
Writing in late July, one poster, discovered by security researcher Nik Cubrilovic, detailed how he had developed a copy of the Flappy Bird app for Android devices that would exploit app permissions granted during installation to steal the photos.
“I am a fucking genious [sic]… Hear me out. I.. modded… the app,” the developer explained. “It now secretly downloads all of the phones pictures to my server when the game is running.”
But, he added: “The problem is this – it’s a violation of google play developers license to do publish sneaky apps like that, and I REFUSE to risk my license over it.” He then asked for financial support to make a second Google Play developer account and promises to “post any wins [stolen photos] obtained in this thread”.
“Note: this app will only work for android,” he added.
Rik Ferguson, the vice president of security research at Trend Micro, said that the AnonIB plan was entirely plausible. “We frequently see manifestations of malware on Google Play Store and it’s certainly not malware-free,” he said.
“Google do actively police Google Play but it tends to be post-release. So he’s saying that if he puts it on his account, it’s going to be found out and he’s going to be suspended. There’s a thriving underground market in verified Google developer accounts for exactly that purpose.”
The Android app would have requested access to the user’s photos – among other functions such as internet access – on installation. Unlike Apple’s iOS, where users can block individual apps’ access to photos and location data, Android requires the user to accept every permission request for the app to install and offers no way to revoke them later.
Ferguson adds that the ability to selectively approve permissions, as in iOS, is one of the improvements he would like to see made to Android. “At the moment, you can do that but only if you download certain third-party apps,” he says.
The existence of the hole the rogue developer was trying to exploit is widely known and has been a source of criticism of Google. In August 2013 a senior manager at Google reversed an alteration to Android that would have given users the ability to revoke permissions – a move that was criticised by the online pressure group Electronic Frontier Foundation.
Though AnonIB is currently unavailable for “scheduled maintenance” the Guardian has found archived copies of the posts.
Ferguson added that although he had not seen examples of malware that specifically targeted photos on a user’s phone “the media attention around this [theft], because it was bigger than all the other ones in terms of number of people affected, is going to go someway towards accelerating interest in this sort of thing, because there will be more people aware of the technical possibility, and of the potential financial rewards”.
Clones of Dong Nguyen’s games, which include Flappy Bird and August’s Swing Copter, have proliferated on app stores. On the day of Swing Copter’s launch, there were already 62 separate clones available on the Google Play store – many of which would have had a few downloads from interested users.
Google’s Play Store, the biggest though not the only Android app store, has a pre-approval process designed to weed out openly malicious apps but it is widely perceived as less aggressive than the equivalent process on the iOS App Store.
That has led to apps that have exploited some users. In December, the US FTC charged the developer of an Android torch app which had had more than 50m downloads with “deception” because it silently shared user location and device IDs with advertisers. In April an Android antivirus app that did nothing but change its icon when pressed received more than 30,000 downloads at $3.99 before being taken down over a week later.
Google declined to comment for this story.
;