{"id":23670,"date":"2016-08-19T11:43:56","date_gmt":"2016-08-19T03:43:56","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=23670"},"modified":"2016-08-19T11:48:22","modified_gmt":"2016-08-19T03:48:22","slug":"risks-not-behind-pokemon-go","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2016\/08\/19\/risks-not-behind-pokemon-go\/","title":{"rendered":"Risks – or not – behind Pok\u00e9mon Go"},"content":{"rendered":"

By\u00a0Axelle Apvrille Anti-Virus Malware Researcher, FORTINET<\/em><\/strong><\/p>\n

At FortiGuard, we wouldn’t let you down without an analysis of Pok\u00e9mon Go. Is it safe to install? Can you go and hunt for Pok\u00e9mon, or stay by a pokestop longing for pokeballs? While this article won’t assist you in game strategy, I’ll give you my first impressions analyzing the game.<\/p>\n

Versions<\/p>\n

There are two sorts of Pok\u00e9mon applications:<\/p>\n

    \n
  1. The\u00a0official<\/i>\u00a0versions, issued by Niantic.<\/b><\/li>\n<\/ol>\n

    \"Risks<\/a><\/p>\n

    We will talk more about these later, but in brief, they are not malicious.<\/p>\n

      \n
    1. The\u00a0hacked<\/i>\u00a0versions.<\/b>\u00a0These are also known as “mods”, which are issued by other developers, for multiple reasons. It is in this category we are the most likely to encounter malware. For instance, a repackaged version infected with DroidJack RAT has been identified to be in the wild (see analysis below).<\/li>\n<\/ol>\n

      15db22fd7d961f4d4bd96052024d353b3ff4bd135835d2644d94d74c925af3c4<\/p>\n

      However, not all hacked versions are necessarily malicious: we inspected hacks to play on Android 4.0 (the minimum requirement is normally 4.4), or to modify GPS coordinates, neither of which showed any malicious intent.<\/p>\n

      baf0dc2e19c6ec9ebfc2853785e92e175064c522a82410c2e56e204fad156838 4d482cf9beef8d4f03a6c609025fc6025069c0c83598032e46380d23a75f1979<\/p>\n

      Besides manual inspection, we also sent those samples to our learning-based Android prediction engine,\u00a0SherlockDroid \/ Alligator<\/i><\/a>,\u00a0<\/i>which confirmed our analysis \ud83d\ude09<\/p>\n

      Risk #1 Installing an infected version<\/b><\/p>\n

      As mentioned earlier, a sample with sha256<\/p>\n

      15db22fd7d961f4d4bd96052024d353b3ff4bd135835d2644d94d74c925af3c4<\/p>\n

      is infected with Android\/SandrC.tr, dubbed DroidJack RAT.<\/p>\n

      This is a known malware, for which we have had a signature since 2015. Therefore, Fortinet customers were protected from this malicious Pok\u00e9mon app from the beginning \ud83d\ude42<\/p>\n

      This malware is quite widespread. Internal statistics at Fortinet indicate more than 8,800 detections in a year, and 160 last month alone, but those figures are largely underestimated for various reasons, including the fact that reporting is not enabled by default. So, basically, what you should remember is that this malware is still in the wild and active currently.<\/p>\n

      More malware to come?<\/p>\n

      Yes, very certainly. Malware authors are likely to continue to re-package the game with a variety of malware and distribute it. The fact the game wasn’t released in all countries at the same date, for example, (thus forcing impatient users to look for alternatives on the web), combined with the fact there are large game hacking (that’s nice) and cheating (that’s bad \ud83d\ude09 communities only increase the potential for downloading an infected version of the game..<\/p>\n

      Risk #2 Full Google Account Information? (This is fixed)<\/b><\/p>\n

      Adam Reeve\u00a0noticed<\/a>\u00a0that the game requested full access to your Google account. Note:\u00a0we are not talking about an Android permission here but a permission of an app connected to a Google account<\/i>.<\/p>\n

      This was an error and\u00a0Niantic fixed this<\/a>. So be sure to\u00a0remove the permission<\/a>\u00a0from your account and upgrade your Pok\u00e9mon Go application.<\/p>\n

      Finally, note that it is not extremely clear in the documentation exactly how much “full access” really means, but no malware or exploit of this has been reported so far.<\/p>\n

      Risk #3 Unwanted network traffic<\/b><\/p>\n

      In a perfect world, we’d expect games to only send packets over the network that are absolutely necessary for the game to run, such as your location, the details of Pok\u00e9mon around you, etc.<\/p>\n

      However, this is very far from reality, and for years now most Android applications are bundled with third party kits (analytics, crash reporting, cross platform engines, etc.) which use up the bandwidth which send and receive more or less useful side information containing, in the best cases, the exact model of your smartphone, or in the worst, personal information such as your phone number and other private data.<\/p>\n

      Pok\u00e9mon Go is one of these bandwidth hungry applications. I downloaded it two weeks ago, and it is already close to being the most greedy application on my phone…<\/p>\n

      \"Risks<\/a><\/p>\n

      For mobile users, the consumption of bandwidth is\u00a0a real issue<\/a>. On average, 24% of an application’s traffic is for third party tracking and advertising services. For some applications, the rate rockets to 98%.<\/p>\n

      While the percentage of side traffic for Pok\u00e9mon Go hasn’t been measured precisely, given the number of third party functionality it includes, I wouldn’t be surprised if it isn\u2019t well above 50% \ud83d\ude09<\/p>\n

      Here is a list of what version 0.31.0 contains:<\/p>\n