HOBI Weekly Blog Recap (8/28-8/31)
More than 10 million users of Samsung smartphones have done the right thing in managing firmware updates that improve and secure their devices. Unfortunately, by doing so they may have fallen victim to a fraudulent software update app that convinces them to pay for software updates that should be free of charge.
What 10 million Samsung users need to be aware of
Aleksejs Kuprins, a malware analysts at CSIS Security Group, has revealed how an app called “Updates for Samsung” has been installed by more than 10 million users who have dowloaded it directly from the official Google Play app store. As first reported by ZDNet, the app “promises firmware updates, but, in reality, redirects users to an ad-filled website and charges for firmware downloads.”
This is concerning as it undermines the message that many mobile manufactures try to get across about the importance of keeping up to date with the latest updates for smartphones in order to stay one step ahead of those who would do you harm. Installing firmware updates is recommended not only to ensure you device is running with all the latest features and at peak efficiency, but also for security reasons. Anything that devalues that update message also weakens the security status of your device, even if there is no inherent malicious intent from the security perspective of the app developers.
How was a ‘fake’ update app available on the official Google Play store?
According to Kuprins, the fact that the app was named “Updates for Samsung” and made available through the official app store for Android users, which is often but wrongly assumed to be the a hub for perfectly safe apps only, was the key to its success. “It would be wrong to judge people for mistakenly going to the official application store for the firmware updates after buying a new Android device,” Kuprins said, “vendors frequently bundle their Android OS builds with an intimidating amount of software, and it can easily get confusing.”
It is hardly surprising that new and non-technical users of a Samsung device might look to install an app that promises to make some tasks easier and describes its functionality thus: “Download any OS update for any Samsung device ever released, read the latest Android tech news and access the latest firmware upgrades, Android version updates, Android tips, tricks, guides & how-to tutorials to check if you can upgrade or update your device to a new version of the Android OS.”
What does the app actually do?
While the app does, indeed, enable the user to search for firmware specific to their device, Kuprins found it to be “stuffed with advertisement frameworks,” and distributing Samsung firmware as part of a paid subscription scheme. The app developers are not, Kuprins said, officially affiliated with Samsung and are charging an annual fee of $34.99 to access what is actually a free of charge update process. Then there’s also the fact that the payment process itself doesn’t take place via the official, and secure, Google Play subscriptions method but instead asks for credit card details sent to another website.
“There is a shady peculiarity about these firmware downloads,” Kuprins warned, “it does allow registered users to download firmware for free; however, the download rate is limited to 56 KBps.” This means a typical firmware download would take at least 4 hours instead of just minutes if downloaded and installed directly on the handset following the official Samsung update notifications. Kuprins also noted that free downloads almost always failed to complete, therefore “motivating the user to pay for fast downloads through paid premium packages.”
What should users do now?
While not being malicious as such, the application doesn’t appear to be what it seems as both many user reviews and the research by Kuprins would suggest. Users should not download apps such as this, but instead follow Samsung’s procedures for downloading updates which will be shown on your smartphone as a notification and walk you through the simple, speedy and secure process for doing so. If you want to check on the status of your device firmware, simply navigate to the “Software Update” option in the settings menu and select “Download and install” to check if you are running the latest updates; if not then the download will start and the update can be completed in a matter of minutes. As Kuprins said, doing so means that the “updates are guaranteed to come directly from the vendor,” as well as being free of charge.
Related posts
