Legitimate Android applications can be easily repacked with malware and uploaded to the Google Marketplace, Symantec says.
The Android application package file (apk) tool Geinimi allowed legitimate apps to be re-written with malicious code.
Applications were then ready to be uploaded since they were self-signed, Symantec security response engineer Mario Ballano Barceno said.
Geinimi created a connection to the command and control centre (C&C) from where information on a victim's device including operating system details and personal data could be downloaded.
Ballano said any application could be affected and re-uploaded.
He said website redirections could be added to web browsers, and phones could be made to place premium phone calls and SMSes.
“The attacker implements a set of changes and they suggest the changes,” Ballano said.
Symantec security response senior security operations manager Orla Cox said all applications can be compromised.
“If they're using the same malware all of the time, anti-virus vendors can easily handle that. Google is also pretty swift in pulling down known malicious apps from the official market store once it knows about them,” Cox said.
“It's better for the attackers to be stealthier and fly under the radar if they can. It means that their apps are more likely to last on the market.”
This article originally appeared at scmagazineuk.com
Copyright © SC Magazine, US edition
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @itnews.com.au to your white-listed senders.