Dozens of Apps on Microsoft Store Displaying Adult, Gambling Content

On March 14, we discovered 81 potentially unwanted applications (PUAs) on the Microsoft Store, some of which display pornographic images and gambling content. While some have been removed, most of these apps are still available to download from the app store.

The apps cover a range of different categories such as sports, games, news, tips, etc. They appear to be published by more than 30 different developers. A full list of the 81 apps, as well as their store page links and author names, can be found in the table at the end of this blog.

Fake apps

To trick users, the apps use familiar names from some popular brands in their titles, such as Wix Updates Application, Antivirus Avira App, Norton Antivirus Updates App, McAfee Antivirus Updates News, Tinder Dating Updates, Tips and Games, and Grindr Updates.

However, these apps have nothing to do with the brands or their original apps. In fact, some of them display content such as pornographic images and advertisements for gambling websites. Other apps merely redirect users to the legitimate website of the brand they are claiming to be related to but they all have the ability to display whatever content they chose at a later date.

Questionable content

All these apps show their unsavory content at start time (see Figures 3 and 4 for examples).

At the same time, none of the apps state this behavior in the description section on the app store page. In fact, the apps all display innocuous screenshots provided by the developers, which are totally unrelated to the real functionality of the apps.

Shared server

We analyzed the samples and found that they all call http://myservicessapps[DOT]com/firebase/[PHP Name]?app=[APP ID] to get the configuration for the current application, where the app can parse the style and specified URL by the “red_ph” value in the configuration. For example, for the app Buy Bitcoin, the app will call http://myservicessapps[DOT]com/firebase/win_new_cl.php?app=2504-buy-bitcoin at app start time to retrieve the configuration, and the “red_ph” value directs the application to behave accordingly. This tactic allows the apps to display whatever content the developers choose, so even the apps that currently redirect to legitimate websites could display dodgy content at a later date.

Potential for more serious risks

Since the app is fully controlled by the server, it is possible for the developer to inject malicious code of their choosing. This could, for example, be coin-mining scripts, allowing the app developers to generate profit from users who have installed their apps. The developers can also display phishing websites in the apps. In fact, some of the apps already show suspicious phishing content that requests credit card information (Figure 7).

Similar file structure

We explored the application packages of all 81 apps and found that the content of each looks very similar (Figure 8). This, combined with the fact that they are sharing the same server, makes it highly likely that these applications are published by the same group of developers.

Microsoft was notified about our discovery and said it would investigate. Several of the apps are no longer available on the Microsoft Store.

Mitigation

Stay protected from malware and other risks by taking these precautions:

• Keep your software up to date
• Do not download apps from unfamiliar sites
• Only install apps from trusted sources
• Install a suitable security app, such as Norton or Symantec Endpoint Protection, to protect your device and data
• Make frequent backups of important data

In addition, the following tips can help you avoid downloading PUAs:

• Check the name of the app you’re thinking of downloading. If it’s a popular app, search online for it and make sure the name matches the results. Fake app authors will often add words to the legitimate app’s name, such as “Updates” which can be a clue something isn’t right.

• Check the app developer’s name, which can be found on the app’s store page. Do an internet search for the developer as there may be users who have had experience of their apps—good or bad.
• Check the app reviews. While fake reviews are common, they’re often short and generic. There may also be legitimate reviews from users who have figured out that the app isn’t what it appears to be.
• There may also be some visual clues that the app is not legitimate, such spelling mistakes or layouts and user interfaces that look unprofessional.

Protection

Symantec and Norton products detect the apps as the following:

• PUA.Redpher

List of apps