Incident: Fake Antivirus Apps Exploit Fear of WannaCry, Infecting Devices

Published Date: 2017-06-13

Postmortem Analysis
Timeline 1. The software failure incident of fake antivirus apps masquerading as WannaCry protectors happened in late May [60965].
System 1. Google Play Store 2. Apple's App Store 3. Various antivirus apps 4. Mobiles24 app store 5. iOS app search ad functions
Responsible Organization 1. Hackers who leaked the exploit targeting outdated Windows systems used by WannaCry [60965] 2. Scammers who created fake antivirus apps filled with malware, masquerading as protection against WannaCry [60965]
Impacted Organization 1. Mobile phone users were impacted by the software failure incident involving fake antivirus apps masquerading as WannaCry protectors [60965].
Software Causes 1. The software failure incident was caused by the proliferation of fake antivirus apps in response to the WannaCry ransomware attack, which were actually filled with malware [60965].
Non-software Causes 1. Lack of proper vetting and approval process for ads in Apple's search ad functions [60965] 2. Exploitation of fear and hysteria around the WannaCry ransomware attack to drive downloads of fake antivirus apps [60965] 3. Inadequate scrutiny of app content and permissions by app stores, including Google Play and Apple's App Store [60965]
Impacts 1. The software failure incident led to the creation of fake antivirus apps that were filled with malware, including adware, Trojans, and other sources of malware, which posed a significant threat to users' devices [60965]. 2. Users who downloaded these fake antivirus apps were at risk of having their personal information compromised, facing financial scams, and potentially falling victim to cybercriminal activities [60965]. 3. The incident highlighted the growing trend of viruses masquerading as antivirus apps, exploiting fear and hysteria around cyber threats like WannaCry to drive downloads and deceive users [60965]. 4. The presence of fraudulent antivirus apps on reputable platforms like Google Play store raised concerns about the dangers facing mobile app consumers and the need for increased vigilance while downloading apps [60965]. 5. Scammers were able to make substantial profits, such as $80,000 a month, through fake apps like "Mobile protection: Clean & Security VPN," which deceived users into expensive subscriptions and potentially harmful actions [60965].
Preventions 1. Implementing stricter app store review processes to detect and remove fake antivirus apps [60965]. 2. Enhancing user education on how to identify and avoid fraudulent apps, especially those masquerading as antivirus software [60965]. 3. Developing more robust security measures within operating systems to prevent malware infiltration through fake apps [60965].
Fixes 1. Implement stricter app store review processes to detect and remove fake antivirus apps [60965]. 2. Enhance user education on how to identify and avoid fraudulent apps by checking for grammatical errors and suspicious permissions [60965]. 3. Develop better security measures within app stores to prevent the distribution of malicious apps [60965].
References 1. RiskIQ cybersecurity firm [60965] 2. McAfee [60965] 3. Google Play store [60965] 4. Apple's App Store [60965] 5. Medium post by app developer Johnny Lin [60965]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - The article reports on the discovery of fake antivirus apps related to the WannaCry ransomware attack, which were filled with malware and executed attacks they promised to protect against [60965]. - Specifically, the article mentions the case of the "Antivirus Malware Trojan" app, which had more than 10,000 downloads before being removed from the Play Store [60965]. - Additionally, the article highlights the case of the fake iOS app "Mobile protection: Clean & Security VPN," which scammed users into expensive subscriptions and made $80,000 a month before being taken down [60965]. (b) The software failure incident having happened again at multiple_organization: - The article mentions that RiskIQ found seven fake WannaCry-related apps in the Google Play store and two in Apple's App Store, indicating that this trend of fake antivirus apps is not limited to a single organization [60965]. - It is also noted that there has been a recent rise in fake antivirus apps in general, with hundreds of fraudulent antivirus apps on the market packed with adware, Trojans, and malware [60965]. - The article highlights the broader issue of fake antivirus apps across various app stores, not just limited to one organization or platform [60965].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the case of fake antivirus apps that were filled with malware and masqueraded as protection against threats like WannaCry. These apps were developed and designed to deceive users into downloading them under the guise of providing security against known cyber threats. The incident highlights a failure in the design and development process of these malicious apps, which introduced contributing factors that ultimately led to the spread of malware [60965]. (b) The software failure incident related to the operation phase is evident in the misuse of fake antivirus apps by unsuspecting users. These users operated the apps on their devices, believing they were protecting themselves from threats like WannaCry. However, the operation of these apps led to the installation of malware on their devices, causing harm instead of providing security. This misuse of the apps by users contributed to the failure of the system, as they inadvertently allowed malware to infiltrate their devices [60965].
Boundary (Internal/External) within_system (a) The software failure incident reported in the articles is primarily within_system. The failure occurred due to the presence of fake antivirus apps that were filled with malware, masquerading as protection against threats like WannaCry [60965]. These apps were found on reputable platforms like Google Play store and Apple's App Store, indicating that the issue originated from within the system itself. The apps exploited users' fears and lack of knowledge about cybersecurity to push malware onto their devices, highlighting a significant failure within the system's security measures.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident related to non-human actions in the articles is the presence of fake antivirus apps filled with malware, including those masquerading as WannaCry protectors. These apps were discovered to be executing attacks they promised to protect against, indicating a failure introduced without human participation [60965]. (b) The software failure incident related to human actions in the articles is the creation and distribution of fraudulent antivirus apps by scammers and cybercriminals. These individuals took advantage of the fear and hysteria surrounding ransomware like WannaCry to drive downloads of their malicious apps, ultimately leading to the compromise of users' devices [60965].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The article does not mention any software failure incident related to hardware issues [60965]. (b) The software failure incident related to software: - The software failure incident in the article is primarily related to fake antivirus apps filled with malware that were masquerading as protection against the WannaCry ransomware attack [60965].
Objective (Malicious/Non-malicious) malicious (a) The objective of the software failure incident was malicious. The incident involved the creation of fake antivirus apps that were filled with malware, including adware, Trojans, and other sources of malware. These apps masqueraded as protection against the WannaCry ransomware attack but actually executed attacks themselves. The apps were designed to deceive users and harm their devices, showcasing a clear intent to harm the system [60965].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident: - The incident of fake antivirus apps related to the WannaCry ransomware attack can be attributed to poor decisions made by malicious actors who created these apps with the intent to deceive users [60965]. - These fake antivirus apps were designed to exploit the fear and hysteria surrounding the WannaCry ransomware to drive downloads, even though mobile systems were not vulnerable to WannaCry [60965]. - Scammers took advantage of Apple's search ad functions, which lacked filtering or approval processes, to promote fake apps like "Mobile protection: Clean & Security VPN" [60965]. - The fake iOS app mentioned in the article, "Mobile protection: Clean & Security VPN," was designed to trick users into subscribing to expensive services through deceptive practices [60965].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the case of fake antivirus apps claiming to protect against WannaCry but actually containing malware themselves. These apps were discovered in various app stores, including Google Play and Apple's App Store, indicating a lack of professional competence by the developers who created and distributed these malicious apps [60965]. (b) The software failure incident related to accidental factors is seen in the case of users unknowingly downloading fake antivirus apps that contained malware. These users were misled by the false promises of protection against threats like WannaCry, leading to accidental installation of harmful software on their devices [60965].
Duration permanent (a) The software failure incident described in the articles is more of a permanent nature. The incident involves the discovery of numerous fake antivirus apps in various app stores, including Google Play and Apple's App Store, that were filled with malware and posed as protection against threats like WannaCry [60965]. These fake apps were designed to deceive users and push malware onto their devices, indicating a deliberate and ongoing attempt to exploit users' trust and security vulnerabilities. The presence of such fraudulent apps in reputable app stores like Google Play highlights the persistent threat posed by malicious actors in the digital ecosystem.
Behaviour omission, value, byzantine, other (a) crash: The articles do not mention any specific instances of software crashing. (b) omission: The software failure incident related to omission is seen in the case of fake antivirus apps that promised to protect against malware but were actually filled with malware themselves. These apps omitted to perform their intended function of providing protection and instead posed a threat to users [60965]. (c) timing: The articles do not mention any specific instances of software failure related to timing issues. (d) value: The software failure incident related to value is evident in the case of fake antivirus apps that claimed to provide security but actually contained adware, Trojans, and other malware. These apps provided incorrect and harmful functionality instead of genuine protection [60965]. (e) byzantine: The software failure incident related to byzantine behavior is observed in the deceptive actions of the fake antivirus apps. These apps pretended to be security solutions while actually engaging in malicious activities, leading to inconsistent responses and interactions with users [60965]. (f) other: The other behavior observed in the software failure incident is the deceptive nature of the fake antivirus apps. These apps used fear tactics related to threats like WannaCry to drive downloads, even though mobile systems were not vulnerable to such attacks. This deceptive behavior falls under the category of misleading users for personal gain [60965].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) death: There is no mention of people losing their lives due to the software failure incident in the provided article [60965]. (b) harm: The article does not mention any physical harm caused to individuals due to the software failure incident [60965]. (c) basic: The incident did not impact people's access to food or shelter [60965]. (d) property: People's material goods, money, or data were impacted due to the software failure incident. The fake antivirus apps were filled with malware, executing attacks they promised to protect against, potentially leading to financial losses and compromised data [60965]. (e) delay: There is no mention of people having to postpone an activity due to the software failure incident in the article [60965]. (f) non-human: Non-human entities were impacted due to the software failure incident. The fake antivirus apps targeted mobile devices, potentially affecting the devices themselves and the data stored on them [60965]. (g) no_consequence: There were real observed consequences of the software failure incident, particularly related to financial losses and compromised data due to the fake antivirus apps [60965]. (h) theoretical_consequence: The article discusses potential consequences of the software failure incident, such as the risks posed by fraudulent antivirus apps and the potential for malware attacks on mobile devices [60965]. (i) other: The article does not mention any other specific consequences of the software failure incident beyond those related to financial losses, compromised data, and the risks associated with fake antivirus apps [60965].
Domain information (a) The software failure incident discussed in the articles is related to the information industry. The incident involves fake antivirus apps, such as those claiming to protect against the WannaCry ransomware attack, which are actually filled with malware and pose a threat to users' devices [60965]. These apps were found on various app stores, including Google Play and Apple's App Store, highlighting the risks faced by mobile app consumers in the digital age.

Sources

Back to List