The Interview: South Korea fans risk downloading malware

http://www.theguardian.com/technology/2014/dec/31/the-interview-android-download-app-banking-trojan

Version 0 of 1.

Controversial film The Interview has earned $18m so far from online sales and cinema viewings in the US, but some people in South Korea trying to download a pirated version are catching a nasty dose of mobile malware instead.

The comedy, which satirises the North Korean regime of Kim Jong-un and sparked the recent cyberattack on studio Sony Pictures, is understandably eliciting plenty of interest in South Korea.

An Android smartphone app in circulation there promises access to a pirated download of the film, but according to security researchers at McAfee, the Technische Universität Darmstadt and the Centre for Advanced Security Research Darmstadt, it’s actually stealing people’s banking details.

“It contains an Android Trojan detected by McAfee products as Android/Badaccents. Android/Badaccents claims to download a copy of The Interview but instead installs a two-stage banking Trojan onto victims’ devices,” wrote security expert Graham Cluley on his blog.

“The banking Trojan, which was hosted on Amazon Web Services, targets customers of a number of Korean banks, as well as one international bank (Citi Bank).”

According to Cluley, the app transmits banking data from infected devices back to a Chinese mail server, with around 20,000 devices having downloaded it so far. While he claimed that the Trojan was hosted on the Amazon Web Services [AWS] cloud service, Amazon has denied that.

“We have a clear acceptable use policy and whenever we have received a complaint of misuse of the services, we have moved swiftly to strictly enforce it,” a spokesperson told the Guardian. “The activity being reported is not running on AWS.”

The Interview’s initially US-only distribution has led people elsewhere in the world to turn to piracy to watch it. According to filesharing-news site TorrentFreak, 200,000 people downloaded the film from torrent sites in the first day after it was released on YouTube, Google Play and Xbox Live in the US.

The Android Trojan is just the latest example of a big news story being used by malware developers as cover to install their software on devices, with the political furore around The Interview fuelling interest – and thus risks – further.

• How you could become a victim of cybercrime in 2015

• It’s been a great year! Thanks to these Facebook scams...

This article was amended on 31 December 2014 to add Amazon’s denial that its cloud service was hosting the Trojan.