Trojan exploits Android security fix

Powered by SC Magazine
 

Antivirus vendors find a mobile home.

Malware writers have repackaged Google’s recently released Android Market Security Tool with a bonus Trojan. 

The fake Android security tool exploits Google’s answer to the information-stealing DroidDream malware, which had up to 200,000 users.

Google’s real clean up tool promised to remotely wipe 50 offending applications from Android devices and remove the exploits to prevent attackers accessing further information.

The fake tool, meanwhile, allowed its controller to send SMS messages at will. Its impact is currently limited to Chinese Android users.

Symantec researchers discovered the fake Android security tool on a third-party Chinese marketplace.

 

Potential victims of the "Trojanised" clean up tool were advised to be on the look out for subtle differences between the real and fake security tool.

Vanja Svajcer, a virus researcher at Sophos, warned that the fake tool required additional permissions for "services that cost you money" as well as the device’s location.

Google’s tool was also labelled version 2.5 while the fake version was 1.5.

Fellow antivius firm, F-Secure, has posted visual comparisons of the fake and real tools here.

Sophos' Svajcer speculated that the fake clean up tool could spell the beginning of "scareware" for mobile phones -- a technique commonly used to lure Windows PC victims.

"Judging by the popularity of Android devices and the recent increase in malware attacks, it may be just a matter of time before we start seeing highly suspicious products like Antivirus Android 2012 on the market," he said.

Svajcer criticised Google’s decision to open its mobile applications market to unofficial trading platforms.

"Personally, I think that the ability to install non-market applications and ability to create third party application markets was a mistake for Google's Android team from the security point of view. This path is leading us to Windows-like threat levels."

Meanwhile, Tim Armstrong, a virus researcher with Russian antivirus outfit Kaspersky Labs, has criticised Google for releasing a tool which failed to fix the actual vulnerability.

"We’ve had a look at this app, and it does not fix the vulnerability, it simply removes the applications known to be malicious," Armstrong said on Monday.

Copyright © iTnews.com.au . All rights reserved.


Trojan exploits Android security fix
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 437

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 210

Vote