Researchers find way to "bounce" malware into Google app store
Two researchers demonstrated how they were able to push a malicious information-stealing app onto Google Play, even while Google's Bouncer custom malware scanner is watching.
They circumvented Bouncer, an automated scanner, with a JavaScript trick that transformed a benign Android app into a malicious one on Google Play, Nicholas Percoco, head of Trustwave Spider Labs, told attendees at Black Hat security conference in Las Vegas on Wednesday.
Sean Schulte, a back-end SSL services developer at Trustwave joined Percoco for the presentation. The pair developed a benevolent app called “SMS Bloxer,” which looked like other SMS blocker apps on the market. In order to ensure regular users didn't accidentally download the app, Trustwave also priced it at $49.95, in stark contrast to similar apps, which were usually $2 or less, or free.
