OXFORD, U.K. — 四月 8, 2020 —

Sophos, a global leader in next-generation cybersecurity, today published a SophosLabs report, Don’t Let Fleeceware Sneak into Your iPhone, showing how Apple device users are being targeted by applications that overcharge users through costly subscriptions or unscrupulous in-app purchases. Sophos calls this kind of app “fleeceware” and researchers have found more than 30 iOS fleeceware apps available on Apple’s official App Store. Between them they appear to have been installed around 3.6 million times, according to publicly available data.

The fleeceware apps include image editors, horoscope/fortune telling/palm reader, QR code/barcode scanner, and face filter apps, with some charging weekly subscriptions of $9.99 (or $520 a year).

sophos-labs-fleeceware-apps

 

Sophos first alerted mobile users to fleeceware in September 2019, when it found a number of such apps available for Android phones. In January 2020, the researchers published a further paper, Fleeceware Apps Persist on the Play Store, detailing the discovery of another 20 such applications, with nearly 600 million alleged installations between them, as reported by Google Play.

“The main purpose of the iOS fleeceware apps we found seems to be severely overcharging users,” said Jagadeesh Chandraiah, senior security researcher at SophosLabs and the report author. “As was the case with the Android apps discovered in 2019, the app developers take advantage of monetization practices widely used by legitimate free apps, but take them one step further. For example, in the hands of the fleeceware app developers, short free trials followed by a monthly subscription soon add up to hundreds of dollars a year in charges, and in-app purchases turn out to be essential for good app functionality rather than optional enhancements or extras.

“Fleeceware apps are not officially malicious, but they are unethical, preying on consumer trust with devious techniques designed to make money. They appear to encourage unsuspecting users to install them through aggressive online advertising and what are likely to be fake five star reviews. Fortunately, there are some practical steps mobile users can take to better protect themselves against fleeceware. This includes knowing how to cancel an unwanted subscription and taking a close look at an app before installing it.”

Advice for mobile phone users

  • Only install apps from official and trusted app stores like the Apple App Store and Google Play – malicious or unscrupulous apps are regularly reported to them by security researchers and others
  • Despite that, always remain vigilant when installing apps, only install those you are familiar with, and carefully scrutinize those that are new or which you have heard about through in-app advertising
  • Know how to cancel subscriptions – just deleting the app from your phone is not enough. The best online directions are on Apple’s support page and Google’s Play Store support page
  • Have an effective security solution in place that will alert you to dubious applications before they can do any harm. For example, Sophos Intercept X for Mobile is available for free on the Apple App Store and Google Play

For additional information, please reference the SophosLabs Uncut article.

关于 Sophos

Sophos 是先进网络安全解决方案的全球领导者和创新者,包括托管式侦测与响应 (MDR) 和事件响应服务,各种端点、网络、电子邮件和云安全技术,帮助企业防御网络攻击。作为最大的纯网络安全供应商之一,Sophos 帮助全球超过 500,000 家企业和超过 1 亿用户抵御主动攻击对手、勒索软件、网络钓鱼、恶意软件等。Sophos 的服务和产品通过 Sophos Central 云管理控制台连接,并得到内部跨领域威胁情报部门 Sophos X-Ops 的支持。Sophos X-Ops 情报优化整个 Sophos Adaptive Cybersecurity Ecosystem 自适应网络安全生态体系,包括一个中央数据湖,为客户、合作伙伴、开发人员和其他网络安全与信息技术供应商提供一组丰富的开放 API。Sophos 为需要全托管并即使可用的安全解决方案的企业提供网络安全即服务,客户还可以直接利用 Sophos 的安全运行平台管理其网络安全,或者采用混合方法,为内部团队补充 Sophos 服务(包括威胁追踪与修复)。Sophos 通过世界各地的经销商合作伙伴和托管服务供应商 (MSP) 销售。Sophos 总部位于英国牛津。如欲了解更多信息,请访问 www.sophos.com.