DKFBootKit - First Android BootKit Malware

          NQ Mobile Security Research Center has recently uncovered a new malware DKFBootKit. This malware is identified when monitoring and analyzing the evolution of earlier DroidKungFu variants. What sets DKFBootKit apart from malware like DroidDream, is that DKFBootKit replaces certain boot processes and can begin running even before the system is completely booted up. 

 

         DKFBootKit repackages legitimate apps by enclosing its own malicious payloads in them. However, the victim apps it chooses to infect are utility apps which require the root privilege to work properly. NQ says the malicious code has already infected 1,657 Android devices in the past two weeks and has appeared on at least 50 different mobile apps.

 

           These apps seem to have legitimate reasons to request root privilege for their own functionality. It is also reasonable to believe that users will likely grant the root privilege to these apps. DKFBootKit makes use of the granted root privilege for other malicious purposes, namely comprising the system integrity.

In order to avoid being infected by this beast, NQ recommends three commonsense steps: 

• First, don't download any apps from sketchy app stores.
• Second, don't accept app permissions from unknown sources and always be sure to read the permissions an app is requesting.
• Third, download a security app that can scan your apps for you to search for malicious code.

NQ Mobile Security for Android is available for download.

Read More

Samsung Rolls Out Ice Cream Sandwich for the Galaxy S II

After a very long waiting period, Galaxy S2 owners have a sign of relief as Samsung has finally rolled out the latest Android 4.0 Ice Cream Sandwich update for the Samsung Galaxy S II smartphone. The official announcement was made via the company’s Samsung Tomorrow blog stating that the update will initially be available in Europe, with Poland, Hungary and Sweden mentioned specifically, as well as in Korea. This initial phase will make way for a wider roll out soon after.

 The update to the latest version of the Android OS is done using Samsung’s Kies software. However, users who wish not to wait any longer can follow the instructions on the XDA developers forum to manually update their Samsung Galaxy S2 smartphones.

JK Shin, President of Samsung’s IT and Mobile Communications Group, says -

We expect that our customers will enjoy an enhanced experience with their Galaxy device through this upgrade. Samsung is committed to satisfying our customer needs.

Samsung also made a public announcement on its Samsung Mobile’s Facebook page. Moments later, the announcement brought in over 700+ comments from fans and users of the Samsung Galaxy 2 smartphone.

Read More

Backdoor in Android for No-Permissions Reverse Shell

          Security expert Thomas Cannon working at viaForensics as the Director of R&D has demonstrated a custom-developed app that installs a backdoor in Android smartphones – without requiring any permissions or exploiting any security holes.

          Thomas built an app which requires no permissions and yet is able to give an attacker a remote shell and allow them to execute commands on the device remotely from anywhere in the world.

It is not a zero-day exploit or a root exploit. They are using Android the way it was designed to work, but in a clever way in order to establish a 2-way communication channel. This has been tested on Android versions ranging from 1.5 up to 4.0 Ice Cream Sandwich, and it works in a similar way on all platforms.

          The application operates by instructing the browser to access a particular web page with specific parameters. This web page, and the server behind it, will, in turn, control the app by forwarding the browser to a URL that starts with a protocol prefix that is registered as being handled by the app, for example app://. This process can then be repeated and in doing so it enables two-way communication.

 

          Android’s power and flexibility were perhaps also its downfall. Other smartphone platforms may not offer the controls we are bypassing at all, and the multi-tasking capabilities in Android allowed us to run the attack almost transparently to the user. This power combined with the open nature of Android also facilitates the customisation of the system to meet bespoke security requirements. This is something we have even been involved in ourselves by implementing a proof of concept Loadable Kernel Module to pro-actively monitor and defend a client’s intellectual property as it passed through their devices. It is no surprise that we have seen adoption of Android research projects in the military and government as it can be enhanced and adapted for specific security requirements, perhaps like no other mobile platform before it

Read More

Dodgy apps steal $1m from Android users: report

          Premium-rate text messages cause "mobile pickpocketing" epidemic. A new report has suggested that malicious apps may have cost Android users as much as $1m during 2011.

          The report comes from Lookout Mobile Security and its Mobile Threat Network, which collects information from one million apps and 15 million devices worldwide. The report found that the likelihood of encountering malware on an Android device went up in 2011 compared to 2010, rising from 1% to 4%. Not huge figures, but it is still a sharp rise and confirms what many other companies have suggested - that threats to mobile devices are on the rise.

          Lookout has identified what it calls "mobile pickpocketing" - dodgy Android apps that can steal money from users by signing them up for premium-rate text message services. The company name-checked GG Tracker as one such app. Lookout estimates that more than $1m has been stolen from Android users via this method.

          2012 will see more apps that target users in this way, Lookout Mobile Security believes. "2011 was a watershed year in terms of the types threats we saw emerging. Threats had greater sophistication and were deployed using more innovative and efficient distribution methods," said Kevin Mahaffey, Lookout's co-founder and chief technology officer. "In 2012, we expect to see the mobile malware business turn profitable. What took 15 years on the PC platform has only taken the mobile ecosystem two years."

          Apple's iOS devices are not safe either. Lookout predicts that 2012 will see more malware aimed at that platform, as well as Android, because of the vulnerable nature of mobile phones. "Due to the difficulty of updating software and patching vulnerabilities on mobile phones, malware writers will continue to exploit iOS and Android OS at a pace greater than vulnerabilities can be resolved," the report says.

Read More