Rogue App Stores Appearing Online Near You; Stay Away

Rogue app stores seem to be showing up more and more these days. They house mobile apps that appear to be legitimate, but most of the time, are not. The service they provide is appealing to many who would prefer not to pay for popular apps. In fact, the top 10 paid apps in both the Google and Apple app stores were found in the rogue stores for “free.” However, they really come with a potentially serious cost.

Some of these actually contain malware that can steal banking credentials, intercept the text messages from financial institutions used for multi-factor authentication, mine Bitcoins, install adware or other malicious apps, or any number of other things. They do this by stealing the legitimate digital certificates of the approved app stores which ultimately trick the users into thinking they are OK for use.

To avoid this, don’t get apps from places other than the official app stores for the related devices. Doing so is called sideloading and until recently could only be done on jailbroken devices. That is no longer the case.

The software that gets into the Google and Apple app stores go through more stringent approval processes and are much less likely to contain malware. That’s not to say that some don’t. It has happened in the past with games like knockoffs of Angry Birds and Flappy Birds, but considering the vast number of apps in these stores, very few of them are malicious.

Make sure to read reviews and only download apps from trusted sources. If you don’t know the developer that’s listed, spend a bit more time performing some due diligence to make sure you feel comfortable putting it on your device.

If you are in charge of a network at your organization, implement security measures such as:

• Educate employees, contractors, and anyone connecting to your network on rogue apps how to avoid them; 

• Put strict policies in place regarding bring your own device (BYOD) use. Include a requirement to have anti-malware installed on those devices in order to connect;

• Put a training program in places regarding how to identify phishing and what to do should it happen.

Once you have created a good security policy, make sure to enforce it. It does no good to have them if they are ignored with no penalty.