Unfortunately, Android users looking to sate their need for adult materials may be getting caught with their pants down. A rogue app called Adult Player, found in “off-road” app markets not controlled by Google, takes phones hostage and snaps photos of their users before demanding a ransom.
According to San Jose, California-based security firm Zscaler, which discovered this app, Adult Player can take control of devices only after gullible users grant it device-administrator privileges, letting it essentially control the phone or tablet.
Once the user does so, the app can take a photo using any available front-facing camera, and load the malware it needs to take action against the user from a remote server.
Adult Player locks the phone or tablet’s screen, displays the picture of the user it surreptitiously shot and carries out a classic “police Trojan” scam. It shows a fictitious FBI case number and the user’s IP address, country and cellular carrier, then tells the user that he or she has broken pornography laws and must pay a “fine” of $500 to unlock the device.
The app promises that once users fork over the “fine” in the form of a pre-paid PayPal card, the “device will be unblocked and all information will be decrypted.”
Do Not Click Activate. Image: ZscalerDo Not Click Activate. Image: Zscaler
The app does not actually seem to be encrypting files, so all users need to do is to get past the lockscreen to free themselves from the app’s grip. To do that, boot into safe mode, a process which varies by device (and is explained in our Mobile Security Guide, linked to above). Then you need to go into Settings > Security > Device administrators to remove Adult Player from the list of apps granted administrator rights. Following that, uninstall it from your device.
For those looking to avoid these kinds of digital landmines all together, we advise users only pull apps from reputable online stores such as Google Play or the Amazon Appstore for Android. (To be safe, uncheck Settings > Security > Unknown sources to limit yourself to Google Play.) And be very wary of granting apps device-administrator rights. Just because an app promises you a good time doesn’t mean it won’t lead to an unhappy ending.
