Introduction
In today’s world of digitisation, where technology has proliferated, and mobile phones have become an integral part of our daily lives, it has changed everything from the shopping experience to the banking experience So, the Television experience has also changed (OTT)mobile app. Staying vigilant against the growing threat of malicious OTT mobile apps is essential. These applications are designed by cyber crooks with criminal intent, which causes a significant risk to our mobile devices and data. What’s more alarming is the emerging trend of these malicious apps being circulated through unsuspecting channels, with YouTube being one of the prominent platforms for their distribution. In this blog post, we shall have a look into rising attacks utilising YouTube as a medium, explore the tactics employed by cyber attackers, and empower ourselves to stay safe. Let’s dive in and shed light on the rise of malicious OTT mobile apps circulated via YouTube.
Red Lags One must look for
Some of the red flags that can help you to identify potentially harmful apps on YouTube. Researchers have detected a new malware that has infected more than 100 apps on Google Play Store. Further, they have also found out that 101 apps are infected with Android. Spy. SpinOk trojan SDK. Here is a list of the top ten apps that contain this virus and have the most downloads in the app store.
- Noizz: music video editor (at least 100,000,000 installs).
- Zapya – File Transfer and Sharing (at least 100,000,000 installs; the trojan module was available in versions 6.3.3 to 6.4 and is no longer present in version 6.4.1).
- VFly: video editor and video producer (at least 50,000,000 downloads).
- MVBit – MV video status creator (over 50,000,000 installs).
- Biugo – video creator and editor (over 50,000,000 installs).
- Crazy Drop (at least ten million installs).
- Cashzine – Earn money by installing at least 10,000,000 times.
- Fizzo Novel – Offline Reading (over 10,000,000 installs).
- CashEM: Earn Rewards (minimum of 5,000,000 installs).
- Check (at least 5,000,000 installations): watch to earn.
Here is the full list of Android apps infected by Android. Spy.SpinOk trojan malware. According to researchers, these apps can cause financial and personal loss.
The Role of YouTube in App Distribution
- Addressing the Challenges: One of the biggest challenges faced by the platform Cybercriminals is continually upgrading and developing their ways to circumvent security systems. They utilise numerous ways to lure users into installing harmful programs, such as impersonating genuine apps, using deceptive names and descriptions, or utilising social engineering approaches. Keeping up with these ever-changing methods necessitates continual monitoring and technical breakthroughs.
- User Reporting and Verification: YouTube mainly relies on user reports to identify and resolve harmful app-related material. This strategy, however, has drawbacks since not all users can properly recognise and report harmful programs. Furthermore, establishing the legality of each reported app necessitates substantial resources and time, complicating the process of monitoring and regulating app-related information.
- Balancing material Diversity and Security: YouTube seeks to maintain a broad spectrum of material, allowing producers to contribute their work and consumers to access a wide range of information. However, this openness raises concerns about the security of app-related material. YouTube needs to work on balancing content diversity and security.
YouTube’s Efforts to Fight Malicious Apps
Here are the few steps taken by YouTube let’s have a look at a few of them:
- Improving the Detection Algorithms: YouTube continues to invest in creating and improving detection algorithms that automatically discover and flag potentially dangerous app-related material. These algorithms examine numerous parameters such as titles, descriptions, user activity, and reported material to identify suspicious trends and possible dangers.
- Collaboration with Security Partners: YouTube collaborates with cybersecurity experts and industry partners to enhance its security measures. By leveraging external expertise, YouTube can stay updated on emerging threats and receive insights on best practices to combat the circulation of malicious apps.
- Enhanced Content screening systems: To provide a safer environment for its viewers, YouTube has beefed up its content screening systems. It utilises content review teams that manually examine reported app-related content, verify its legality, and take necessary action, such as eliminating or blocking access to dangerous applications.
Educating Users
At a personal level, what precautions can people take to avert data theft from mobiles and laptops?
Educating the Audience is important by following a few points, one can safeguard himself/herself
- Be alert of digital platforms
- Never Click on the links that pop-ups
- Change passwords regularly
- Use updated software and use premium versions
- Backup data regularly
- Use genuine software and avoid pirated versions
- Regularly update OS and other software
- Be careful while using public wifi
- Clear your browser’s cache and cookies regularly.
Cases Studies
- Crypto App Scam
- In one example, cyber attackers constructed a bogus Bitcoin mining program that was promoted on YouTube. The program gained many downloads after promising consumers substantial returns on their investments.
- When the software was loaded, it covertly used users’ device resources to mine Bitcoin for the attackers, resulting in considerable battery depletion and device delay. Users unwittingly joined a crypto-mining botnet.
- Learned Lessons: Before installing any software that promises unreasonable profits, research its credibility comprehensively. For Bitcoin apps, stick to legitimate app stores.
- “Fake Antivirus App”
- In this situation, a malicious program masquerading as an antivirus utility was marketed on YouTube. The program purported to safeguard users’ devices from spyware and viruses, attracting many naive users.
- Impact: Once launched, the program presented bogus security alerts and prompted users to purchase a premium version to remove the alleged risks. The program was malware, compromising users’ privacy and potentially collecting important information.
- Lesson Learned: Only download antivirus applications from reputable sites. Before installing any security-related program, do your homework and check user reviews.
- “Phishing App”
- In one scenario, attackers constructed a phishing program masquerading as a famous social networking platform and promoted it on YouTube. The program imitated the official login screen, deceiving users into submitting their login information.
- Users who fell prey to the phishing program unintentionally provided their login information to the attackers. This allowed the attackers to obtain unauthorised access to their social media accounts and potentially exploit personal data.
- Lessons Learned: Always download software from approved sites and avoid clicking on questionable links. Be wary of programs requiring sensitive login information outside approved login pages.
- “Malware-infected Game”
- Description: Cyber attackers constructed a popular gaming software with concealed malware, tempting people to download it through YouTube adverts. The program advertised an intense gaming experience but secretly installed dangerous spyware.
- Impact: Once installed, the virus might steal personal information, record keystrokes, and access sensitive data on the device. User’s privacy and security have been jeopardised.
- Lessons learned: Before installing an app, carefully read the permissions. Stick to renowned game creators and approved app shops for downloading gaming applications.
Conclusion
YouTube is an important channel for app distribution, but it confronts considerable hurdles in policing and controlling app-related material. YouTube works to resist malware by constantly improving its security procedures.
References:
Authors: Ms. Tanushree Saxena, Trainer, CyberPeace
