These Android privacy apps might be distributing malware and spying on you
How To Sideload Apps On Android TV
If you want to install an app that isn’t available in the Google Play Store on your Android TV, you’ll have to sideload the app. This means manually downloading the app, transferring it to your TV, and installing the app. We’ll show you various ways to do this.
Make sure you download Android apps (APKs) from a trusted source; many sites are offering malware-infected Android app files. We recommend APKMirror.Com.
From Your ComputerIf you’ve downloaded the app on your computer and would like to use your computer to install the app on your Android TV, you can use a file manager app on your TV. This app will turn your TV into a File Transfer Protocol (FTP) host, allowing you to send and receive files from other devices.
To do that, launch the Google Play Store on your Android TV. Search for the app named Cx File Explorer, select the app in the search results, and choose "Install." You’ll use this app to receive the app file from your computer.
'Install' highlighted for Cx File Explorer on an Android TV.
Open Cx File Explorer after installing it and grant the app all the permissions it needs. On the app’s main interface, choose the "Network" tab. Here, select the first option that says "Access From Network."
'Network' and 'Access From Network' highlighted in Cx File Explorer.
On the following page, choose "Start Service" to enable FTP.
'Start Service' highlighted in Cx File Explorer.
Now that FTP is enabled, use your computer to send the app file to the TV.
On your computer, download, install, and launch a free FTP tool. There are many such tools to choose from (I prefer FileZilla as it’s free, open-source, and easy to use). In the FTP tool, click the "Host" field and type the FTP location shown on your TV (it starts after ftp://). Click the "Username" field and type the username. Select the "Password" field and type the password. Choose the "Port" field and type the port number. Then, click "Quickconnect."
FTP connection fields highlighted in FileZilla.
You’ll see the Android TV’s files in the FTP tool. Navigate to the "/device/Download" path folder. Then, locate the Android app’s APK file you’ve downloaded to your computer, drag the file, and drop it onto the FTP tool. This will upload the file to the Android TV.
After transferring the app file, on the Android TV, select "Stop Service" to disable FTP. Press the Back button on the TV remote, access the "Local" tab, and choose "Downloads."
'Local' and 'Downloads' highlighted in Cx File Explorer.
You’ll see the APK you just sent to your TV. Select this APK file and allow Cx File Explorer to install unofficial apps in the prompt.
The Facebook APK file highlighted in Cx File Explorer.
Select "Install" to begin installing the chosen app on the Android TV.
'Install' highlighted for Facebook in Cx File Explorer.
You’ve successfully installed the app on your TV.
Using an Android PhoneIf your downloaded app is on your Android phone and you’d like to use your phone to install the app on your Android TV, use a free ad-enabled app called Send files to TV. This app allows you to send apps from your Android phone to your Android TV.
First, install the Send files to TV app on both your Android phone and your Android TV. Launch the newly installed app on both devices. On your phone, choose the "Send" option. On your TV, select the "Receive" option.
'Receive' highlighted in Send files to TV.
In the app on your phone, navigate to the folder where you’ve saved the APK file. Select the file and choose your Android TV on the list.
The UC Browser APK file highlighted in Send files to TV.
In the app on your TV, you’ll see the APK file received. Select this file and choose "Open."
'Open' highlighted for UC Browser in Send files to TV.
In the prompt, allow the Send files to TV app to install unofficial apps, then select the "Install" option.
'Install' highlighted for UC Browser in Send files to TV.
Wait while the app installs the selected APK file.
From the CloudYou can also install apps from cloud storage providers like Dropbox, Google Drive, OneDrive, and Box on your Android TV. You’ll use a cloud-enabled file manager on your TV to get apps from these sources.
To do that, install the free Cx File Explorer app on your Android TV. Launch the app and grant all the permissions it needs. Then, access the app’s "Network" tab and choose "New Location."
'Network' and 'New Location' highlighted in Cx File Explorer.
From the open menu, choose your cloud storage provider.
Various cloud storage providers highlighted in Cx File Explorer.
Cx File Explorer will redirect you to the chosen cloud storage provider’s login page. Log in to your cloud account and allow Cx File Explorer to access your files.
Box's login page in Cx File Explorer.
You’ll see your cloud files in Cx File Explorer. Pick the APK file you want to install on your Android TV.
The MX Player APK highlighted on Box.
And you’re set.
Using Android Debug Bridge (ADB)Android Debug Bridge (ADB) allows you to issue commands to your Android devices from your computer. You can use a command to install APK files from your computer to your Android TV.
To use this method, connect both your Android TV and your computer to the same network. Then, on your Android TV, head into Settings > Device Preferences > About and select "Android TV OS Build" seven times. Head back one menu, choose "Developer Options," and turn on "USB Debugging."
'USB Debugging' highlighted in Android TV Settings.
Find your Android TV’s IP address from Settings > Device Preferences > About > Status. You’ll use this IP address to connect to your Android TV from your computer.
An Android TV's IP address highlighted.
On your computer, download and extract Google’s Platform Tools. Open the extracted folder and you’ll see adb.Exe. Copy the APK file to this folder and then copy the current folder’s path from File Explorer’s address bar.
The ADB folder's path highlighted in File Explorer.
Launch Windows Search, type Command Prompt, and select "Run as Administrator." In the User Account Control prompt, choose "Yes." Next, type the following command replacing PATH with the path you copied. Then, press Enter.
cd PATHThe 'cd' command typed in Command Prompt.
Next up, type the following command replacing IP with the IP address you noted. This will connect ADB on your computer to your Android TV.
adb connect IPThe 'adb connect' command typed in Command Prompt.
Now that ADB is connected, run the following command to install the APK file on your Android TV. Make sure to replace MyApp.Apk with the actual name of your APK file.
adbinstallMyApp.ApkThe 'adb install' command typed in Command Prompt.
Wait for ADB to finish installing the app on your Android TV. When the app is installed, you’ll see the success message in Command Prompt. And that’s it.
How to Launch Sideloaded Apps on an Android TVUnlike Android phones and tablets, Android TV doesn’t display the sideloaded apps with the official apps. You’ll have to use a third-party launcher or the Settings menu to access sideloaded apps on your TV.
If you’d like to use the launcher, get the Sideload Launcher app. This launcher displays all your official and sideloaded apps together, letting you launch any app you want on your Android TV.
If you don’t wish to use a launcher, head into Settings > Apps > See All Apps, select a sideloaded app, and choose "Open" to run the app.
'Open' highlighted for an app in Android TV Settings.
And that’s how you enjoy your favorite apps that aren’t available on the official Play Store on your Android TV. Have fun!
View comments
This Android Malware Has Infected Over 11 Million Devices
Every now and then, we learn about malicious Android apps sneaking their way onto the Play Store. The most recent discovery, however, concerns two Play Store apps containing a malware Trojan that has affected over 11 million Android devices. The same malware was also found in unofficial apps, which means the number of victims here is likely much higher.
Researchers from Kaspersky discovered a new version of the Necro Trojan, which has attacked users from two sources: On the one hand, the Necro Trojan is being delivered through legitimate apps distributed on the Google Play Store. On the other, bad actors injected their Trojan into modified apps, such as custom versions of Spotify and Minecraft, that users downloaded through unofficial means—otherwise known as sideloading.
Modified appsKaspersky first investigated a modified Spotify app called Spotify Plus, which advertised as offering Spotify Premium features for no charge. While the app claimed to be "Security Verified," Kaspersky's analysis found these claims were false, and that the app allows the Trojan to infect these devices. Researchers also found the Trojan in modified versions of WhatsApp, in both "GBWhatsApp" and "FMWhatsApp."
In addition, Kaspersky says they found Necro in a series of game mods. That includes Minecraft, Stumble Guys, Car Parking Multiplayer, and Melon Sandbox.
Kaspersky stresses that it's impossible to say how many victims there are from these unofficial sources. All we can tally are the number of downloads from affected apps in the Play Store.
Play Store appsBetween all the affected apps Kaspersky discovered in Google's Play Store, it turns out the Necro Trojan has infected more than 11 million Android devices. The largest app in the series by far is the Wuta Camera app, which Kaspersky says was downloaded more than 10 million times alone. The app wasn't always malicious, either: Researchers say the Trojan first appeared in version 6.3.2.148 of the app. It has since been removed, so the app is currently safe to download.
Max Browser also contained the Trojan, and was downloaded more than one million times. The first version of this app to contain the Trojan was version 1.2.0, but since Kaspersky reported the app, Google has taken Max Browser off their app store entirely.
What Necro doesWhen installed on your device, Necro malware can execute a number of functions. As explained by BleepingComputer, Necro's payloads can activate malicious plugins to run adware that opens its links with invisible windows; programs that run various scripts; programs to activate fraudulent subscriptions; and tools that route malicious traffic through your device.
In effect, your unofficial app download, or official download in the case of Max Browser and Wuta Camera, generates money for attackers as you inadvertently open advertisements and run fraudulent subscriptions in the background.
How to protect your deviceThe first thing you should do is scan your Android phone for any of the Play Store apps mentioned above. If you have Wuta Camera, make sure to update the app immediately, or delete it from your phone. If you have Max Browser, delete it: There is no safe version of this app.
In addition, delete any of the modified apps named in this piece if you have them on your smartphone, and be vigilant with unofficial downloads going forward. Sideloading certainly opens up more apps than are contained on the Play Store, but since there are fewer checks and regulations, you run the risk of downloading something malicious.
Android Apps Are Blocking Sideloading And Forcing Google Play Versions Instead
You might sideload an Android app, or manually install its APK package, if you're using a custom version of Android that doesn't include Google's Play Store. Alternately, the app might be experimental, under development, or perhaps no longer maintained and offered by its developer. Until now, the existence of sideload-ready APKs on the web was something that seemed to be tolerated, if warned against, by Google.
This quiet standstill is being shaken up by a new feature in Google's Play Integrity API. As reported by Android Authority, developer tools to push "remediation" dialogs during sideloading debuted at Google's I/O conference in May, have begun showing up on users' phones. Sideloaders of apps from the British shop Tesco, fandom app BeyBlade X, and ChatGPT have reported "Get this app from Play" prompts, which cannot be worked around. An Android gaming handheld user encountered a similarly worded prompt from Diablo Immortal on their device three months ago.
Google's Play Integrity API is how apps have previously blocked access when loaded onto phones that are in some way modified from a stock OS with all Google Play integrations intact. Recently, a popular two-factor authentication app blocked access on phones with modified firmware, including GrapheneOS, which aims to surpass the security of Android's stock system. Apps can call the Play Integrity API and get back an "integrity verdict," relaying if the phone has a "trustworthy" software environment, has Google Play Protect enabled, and passes other software checks.
Comments
Post a Comment