Login
Researchers say mobile malware purveyors have been abusing a bug in the Google Android platform that lets them sneak malicious code into mobile apps and evade security scanning tools. Google says it has updated its app malware detection mechanisms in response to the new research.
At issue is a mobile malware obfuscation method identified by researchers at ThreatFabric, a security firm based in Amsterdam. Aleksandr Eremin, a senior malware analyst at the company, told KrebsOnSecurity they recently encountered a number of mobile banking trojans abusing a bug present in all Android OS versions that involves corrupting components of an app so that its new evil bits will be ignored as invalid by popular mobile security scanning tools, while the app as a whole gets accepted as valid by Android OS and successfully installed.
“There is malware that is patching the .apk file [the app installation file], so that the platform is still treating it as valid and runs all the malicious actions it’s designed to do, while at the same time a lot of tools designed to unpack and decompile these apps fail to process the code,” Eremin explained.
Eremin said ThreatFabric has seen this malware obfuscation method used a few times in the past, but in April 2023 it started finding many more variants of known mobile malware families leveraging it for stealth. The company has since attributed this increase to a semi-automated malware-as-a-service offering in the cybercrime underground that will obfuscate or “crypt” malicious mobile apps for a fee.
Eremin said Google flagged their initial May 9, 2023 report as “high” severity. More recently, Google awarded them a $5,000 bug bounty, even though it did not technically classify their finding as a security vulnerability.
“This was a unique situation in which the reported issue was not classified as a vulnerability and did not impact the Android Open Source Project (AOSP), but did result in an update to our malware detection mechanisms for apps that might try to abuse this issue,” Google said in a written statement.
Google also acknowledged that some of the tools it makes available to developers — including APK Analyzer — currently fail to parse such malicious applications and treat them as invalid, while still allowing them to be installed on user devices.
“We are investigating possible fixes for developer tools and plan to update our documentation accordingly,” Google’s statement continued.
Image: ThreatFabric.
According to ThreatFabric, there are a few telltale signs that app analyzers can look for that may indicate a malicious app is abusing the weakness to masquerade as benign. For starters, they found that apps modified in this way have Android Manifest files that contain newer timestamps than the rest of the files in the software package.
More critically, the Manifest file itself will be changed so that the number of “strings” — plain text in the code, such as comments — specified as present in the app does match the actual number of strings in the software.
One of the mobile malware families known to be abusing this obfuscation method has been dubbed Anatsa, which is a sophisticated Android-based banking trojan that typically is disguised as a harmless application for managing files. Last month, ThreatFabric detailed how the crooks behind Anatsa will purchase older, abandoned file managing apps, or create their own and let the apps build up a considerable user base before updating them with malicious components.
ThreatFabric says Anatsa poses as PDF viewers and other file managing applications because these types of apps already have advanced permissions to remove or modify other files on the host device. The company estimates the people behind Anatsa have delivered more than 30,000 installations of their banking trojan via ongoing Google Play Store malware campaigns.
Google has come under fire in recent months for failing to more proactively police its Play Store for malicious apps, or for once-legitimate applications that later go rogue. This May 2023 story from Ars Technica about a formerly benign screen recording app that turned malicious after garnering 50,000 users notes that Google doesn’t comment when malware is discovered on its platform, beyond thanking the outside researchers who found it and saying the company removes malware as soon as it learns of it.
“The company has never explained what causes its own researchers and automated scanning process to miss malicious apps discovered by outsiders,” Ars’ Dan Goodin wrote. “Google has also been reluctant to actively notify Play users once it learns they were infected by apps promoted and made available by its own service.”
The Ars story mentions one potentially positive change by Google of late: A preventive measure available in Android versions 11 and higher that implements “app hibernation,” which puts apps that have been dormant into a hibernation state that removes their previously granted runtime permissions.
Aside from using it for calls and texting, we use our smartphones for plenty of things. We’re sending money with payment apps. We’re doing our banking. And we’re using them to set the alarm, turn our lights on and off, see who’s at the front door, and for some of us, even start our cars. The smartphone is evolving, and in many ways, it’s become the “universal remote control” of our lives. And that means it needs protection.
Truly, think about all that you do from the palm of your hand. Your phone connects you to so many essential things, it’s tough to think what the day would be like without it—or worse yet, if your phone got stolen or lost. Maybe you know the feeling. That rising panic when you misplace your phone and then the relief you feel when you find it.
Yet you have plenty of ways you can protect yourself and your phone, not only from loss and theft but from hacks and attacks too.
Comprehensive online protection software can protect your phone in the same ways that it protects your laptops and computers. Installing it can protect your privacy, keep you safe from attacks on public Wi-Fi, and automatically block unsafe websites and links, just to name a few things it can do.
Updates do all kinds of great things for gaming, streaming, and chatting apps, like add more features and functionality over time. Updates do something else—they make those apps more secure. Hackers will hammer away at apps to find or create vulnerabilities, which can steal personal info or compromise the device itself. Updates will often include security improvements, in addition to performance improvements.
iPhones update apps automatically by default, yet you can learn how to turn them back on here if they’ve been set to manual updates. For Android phones, this article can help you set apps to auto-update if they aren’t set that way already.
Much the same goes for the operating system on smartphones too. Updates can bring more features and more security. iOS users can learn how to update their phones automatically in this article. Likewise, Android users can refer to this article about automatic updates for their phones.
Fewer people use a lock screen than you might think. A finding from our recent global research showed that only 56% of adults said that they protect their smartphone with a password or passcode. The problem with going unlocked is that if the phone gets lost or stolen, you’ve basically handed over a large portion of your digital life to a thief. Setting up a lock screen is easy. It’s a simple feature found in both iOS and Android devices.
So what happens if your phone actually ends up getting lost or stolen? A combination of device tracking, device locking, and remote erasing can help protect your phone and the data on it. Different device manufacturers have different ways of going about it, but the result is the same—you can you’re your phone, prevent others from using it, and even erase it if you’re truly worried that it’s in the wrong hands or simply gone for good. Apple provides iOS users with a step-by-step guide, and Google offers up a guide for Android users as well.
One way hackers work their way into smartphones is through malicious apps that pose as photo editors, VPNs, and games—yet are loaded with malware that spy on your activity or steal account information. Google Play and Apple’s App Store have measures in place to review apps to help ensure that they are safe and secure. Granted, cybercriminals have found ways to work around Google and Apple’s review process, yet they’re quick to remove malicious apps once discovered. Yet third-party app stores and websites likely have no such protections in place. In fact, some third-party sites may intentionally host malicious apps as part of a scam. Stick with the official app stores for a far safer phone.
Truly, we hold so much in the palm of our hand. Our smartphones connect us to our friends and family, work and livelihoods, banking and finances, and even our homes and the smart devices in them. It’s no exaggeration to say that a good portion of daily life courses through our smartphones. And when we look at them that way, it puts the importance of protecting them in a whole new light.
The post Protecting the Universal Remote Control of Your Life—Your Smartphone appeared first on McAfee Blog.
FreshRSS 