The Rise of Malicious Apps: The New Battleground in Conflicts

Malicious Apps Target Users in Israel and Gaza

The Initial Malicious App

A genuine app called RedAlert – Rocket Alerts, which provides timely and precise alerts about incoming airstrikes, has become popular among users in the Israel and Gaza region. Unfortunately, a malicious, spoofed version of the app has been detected. This fake app collects personal information, including access to contacts, call logs, SMS, account information, and information about other installed apps.

The website hosting the malicious file was found to have been created on October 12, and it has since been taken offline. Only users who installed the Android version of the app are impacted, and they are urged to delete the app immediately. The legitimate RedAlert – Rocket Alerts app is heavily relied upon by individuals in the region to receive critical safety notifications.

According to a recent report from Arctic Wolf, the creation of a malicious app that mimics a well-known brand is common. Malicious apps often disguise themselves by using names, images, or descriptions similar to popular or malware-free apps. They may also have fake reviews to increase their rating and appear more realistic. However, in this case, the malicious app specifically targeted a widely used app to steal data, taking advantage of the heightened level of distress in the region.

More Than One Incident

In addition to the initial malicious app, there has been another incident involving the exploitation of a vulnerability in the app Red Alert: Israel by the pro-Palestinian hacktivist group AnonGhost. This allowed the group to intercept requests, expose servers and APIs, and send fake alerts to some app users, including a message claiming a nuclear bomb strike was imminent.

This incident highlights the diversity of actions that attackers can take, as hacktivists are typically associated with conducting small-scale DDoS attacks and defacement. However, in certain circumstances, their actions can have more devastating consequences. It is crucial for organizations to map and mitigate the risk of hacktivism as part of their threat intelligence program.

App Security and Vulnerabilities

Krishna Vishnubhotla, vice president of product strategy at Zimperium, points out that spoofing mobile apps is easy because many app teams fail to ensure sufficient threat visibility and protection for their apps once they are published. Threat actors exploit this by using reverse engineering to understand an app’s inner workings, including its architecture, data flow, and security mechanisms, to create spoofed apps.

Protecting Yourself from Malicious Apps

Arctic Wolf advises users to check an app’s developers and reviews, restrict permissions when necessary, and only download apps from reputable developers. Users should also be cautious of any mentions of scams or malicious activities in user reviews.

Group-IB suggests that organizations carefully examine and strengthen all web-facing applications, as hacktivists often target these applications due to their perceived vulnerability compared to the principal product APIs.

Casey Ellis, founder and CTO of Bugcrowd, advises users to “trust, but verify” when it comes to protecting themselves from malicious apps. He urges users to double-check before trusting an app that claims to assist with personal safety and to triple-check before sharing it with others. In this particular case, the malicious apps were likely downloaded by individuals in a state of concern, potentially without thoroughly vetting them.

Conclusion

The discovery of a malicious app targeting users in the Israel and Gaza region demonstrates that cybercrimes associated with the Israel-Hamas conflict extend beyond nation-state attacks on critical infrastructure. Users must remain vigilant when downloading apps, particularly during times of heightened tension and fear. Trusting only reputable developers, checking reviews, restricting permissions, and regularly verifying the safety of apps are crucial steps to protect against malicious apps. Additionally, organizations should fortify their web-facing applications and include hacktivism as a potential threat in their threat intelligence programs. As technology continues to influence all aspects of our lives, it is imperative to prioritize internet security and remain cautious of potential cyber threats.