IMPACTFUL VIRUSES IN HISTORY: HUMMINGBAD

Megan Poljacik • December 19, 2024

Imagine a virus infecting over 85 million Android phones without anyone catching on. Believe it or not, this really happened in 2016! How could a virus be so easily distributed without human intervention?

 

The HummingBad virus was a persistence rootkit, which is a very smart and nasty virus. It is difficult to find and even more difficult to remove. They embed themselves within the system without the users knowledge and they are designed to hide themselves and their activities, even from security software. A rootkit will take over an infected system on its own, or if it cannot gain root access, it will push a fake update prompt, tricking the user into installing. Once the malware has control of the device, it begins downloading and installing apps, and the lucrative business of conning users begins. The HummingBad virus was designed to click on the ads within the apps to generate advertising revenue. This inflated ad click and view counts, allowing the attackers to earn more revenue without actual user engagement. The malware also promoted and installed additional malicious


The HummingBad virus was named as such because hummingbirds are known for their speed and agility, and they suck the nectar out of flowers. The analogy is that the virus does the same, acting swiflty and extracting bits of information and money from each device as it goes.


apps on infected devices. In some instances, HummingBad would push fake system notifications or pop-ups claiming that the device needed a security update. When users clicked on the notifications, it would redirect them to download and install other infected apps. This generated revenue through app installations and allowed hackers to exploit them.


While the primary focus was on generating revenue through ad fraud, HummingBad could also harvest sensitive information from infected devices. This included personal data, such as contacts, login credentials, and financial information, which could be used for identity theft or sold on the black market.  



Another interesting tactic for financial gain was HummingBads use of botnets. Being installed on millions of devices, HummingBad had the opportunity create a network of compromised devices controlled by attackers, known as a botnet. These botnets could be leased to carry out various malicious activities, such as conducting distributed denial-of-service (DDoS) attacks or sending spam emails, in exchange for money.


HummingBad was able to infect a large number of devices by using several techniques. The hackers primarily targeted users in China and Southeast Asia, where alternative app stores and third-party app markets are popular due to certain regional restrictions. These alternative app stores are often full of counterfeit software and absolutely not vetted for viruses. Another method was through “driveby downloads.” This is when a hacker finds vulnerabilities within a known safe website and then imbeds malicious code. When the site is visited, the malware installs itself without the users knowledge. The same technique can be used with ads within websites – known as malvertizing. A user will click on an ad that is infected and that will redirect them to websites hosting HummingBad or trigger an automatic download.


HummingBad infected millions of Android devices worldwide, making it one of the largest cellphone malware attacks ever seen. The grand scale shows the extent to which hackers can exploit vulnerabilities if we are not careful. One way to prevent this from happening to you is to ensure you are using trusted app stores such as Google Play and Apple App Store. Both google and Apple have stringent security measures to ensure the software they promote is safe for their users. When installing apps be sure to pay attention to the permissions requested. Consider it a red flag if they ask for location information or contacts. It is important to be vigilant in the modern age.


Uncomplicate IT News Blog

IMPACTFUL VIRUSES IN HISTORY: STUXNET

By Megan Poljacik • July 31, 2025
In the early 2000s, tensions in the middle east were on the rise. Iran’s government had begun expanding its uranium enrichment capabilities, insisting it was for nuclear energy purposes. However many countries around the globe feared it was a coverup for a nuclear weapons program. Despite pressure from United Nations and the International Atomic Energy Agency, Iran continued to enrich uranium. Frustrations reached a fever pitch and it appeared a conflict was imminent, until a mysterious solution came from a completely unexpected source: the Stuxnet Computer Worm.

DARK WEB MONITORING: ESSENTIAL SAFEGUARD OR WASTED SPEND?

By Megan Poljacik • June 26, 2025
With growing concerns about data breaches and stolen credentials, many businesses feel pressured to invest in services that claim to scan the dark web for leaked information. But before committing resources, it's worth asking whether these tools actually provide meaningful information or if they are an unproductive expenditure. The dark web is a hidden part of the internet that you can’t reach with standard browsers or search engines. It operates using a system called Tor, which stands for The Onion Router. Tor keeps users anonymous by sending their internet traffic through several different servers around the world, encrypting the data each time. This makes it extremely difficult to trace who someone is or where they’re connecting from. Unlike regular websites that end in .com or .org, dark web sites usually end in .onion and require the Tor browser to access them. While some people use the dark web for legitimate reasons like protecting their privacy or avoiding censorship, it’s mostly associated with hosting illegal activities like online black markets, where stolen corporate data is sold.

PENETRATION TESTING VS VULNERABILITY MANAGEMENT

By Megan Poljacik • May 29, 2025
When it comes to protecting your company’s infrastructure, two commonly used terms often cause confusion: vulnerability management and penetration testing. While they both serve the same purpose of keeping your data secure, they work very differently. Think of your company’s IT infrastructure like a museum that stores priceless artifacts. To keep it secure, you wouldn’t just install locks and hope for the best. You’d want to routinely check those locks, ensure windows are closed properly, and perhaps even hire someone to test how easy it is to break in. This is basically the difference between vulnerability management and penetration testing.