Has Judy Malware Infected Your Phone?

What is The Judy Malware?

Google did not even discover the infected apps itself; security vendor Check Point Software did, and notified Google. Check Point described the incident as “possibly the largest malware campaign found on Google Play.”

“Judy,” as Check Point named this malware, primarily targets advertisers. Unknown to the user, Judy clicks on certain ads that it is programmed to recognize... over and over again, even when the app infected by Judy is closed. Every click earns money for the perpetrators of this scam because they own the sites on which the ads appear. This sort of “click fraud” costs advertisers $7-15 billion per year, according to mobile marketing firm Tune.

Judy avoids detection by Google Play’s “Bouncer” algorithm in a rather clever way. The app that is submitted to Google Play is a deliberately benign-looking bit of code called a “bridgehead app,” typically a game of some sort. Nothing in it does anything malicious, so it doesn’t trigger the Bouncer.

Once a user downloads the app, it connects to a comand-and-control server to download the ad-fraud kit, which includes Javascript code, a user agent that imitates a web browser, and target URLs. The user agent uses a URL to connect to a site, and then the Javascript locates and clicks on banner ads in the Google ad network. Each click is money in a bad guy’s pocket.

In addition to fraudulent clicking, Judy displays lots of ads to the user, sometimes so many that the user is left with nothing but ads to click on! That’s a sign your device may be infected by Judy. Also, the name “Judy” appears in the titles of all apps infected with the Judy malware (e.g. Chef Judy, Fashion Judy, Animal Judy, etc.). Aside from the possible annoyance of the ads, Judy doesn't seem to pose any other threats to privacy or security.

But Wait... There's More!

But you aren’t necessarily safe just because you don’t see the word “Judy” among your apps. Other hacker groups are distributing similar malware that is not so easily identified. See the appendices at the end of Check Point’s blog post for all the known names of Judy or “Judy-ish” apps.

Google is surely blushing over this breach of its Play store - actually these forty-one-plus breaches of its Play store. But note that any app store is vulnerable to the shenanigans that Judy pulled. So perhaps next week, Apple will be similarly red-faced. (Kiniwini, the Korean company that owns the Judy apps, also has similar apps in the Apple Store, but Checkpoint didn't see any evidence of the click fraud going on there.)

The moral of this story is that you have to take charge of your own security. Be very careful about installing apps on your mobile device. I don't know of any mobile security tools that would have prevented or detected this type of malware. So my advice is to use only well-known apps from well-known companies. Anything that's not "mission critical" should be scrapped.

Your thoughts on this topic are welcome. Post your comment or question below...