Newsfeed
Nachrichtenbote
Android malware seems to be all the rage at the moment. Here's a few comments on a couple interesting side issues we've been discussing as we've seen them crop up during analyses.
First up: there was a recent report on suspicious applications found the official Android Market. The apps in question have since been taken off the Market, but our threat hunting team still come across them in forums and other such locations, usually promoted as 'free apps'.
The applications themselves appear to be straightforward games. At some point however, it looks like additional services were added to the apps. The earlier versions didn't ask for anything other than Internet access:
However the later versions get a bit more personal than that:
With the changes, the app is able to access various bits of information from the device: the carrier and country, the device's ID, e-mail address and phone number.
The information is sent out to a remote server.
An additional twist this app pulls is that it includes a little icon that when clicked, leads the user to other apps which presumably, they might like to try. The apps being promoted also appear to show the same suspicious behavior.
What was interesting is that both the earlier 'unremarkable' and later 'suspect' versions of the app appear to be from the same developers:
It appears to be a case of questionable new behaviors being added at a later date to an existing app, and not a repackaged app with foreign malicious routines added. We're still looking into various aspects of this; for now, based on the observed behavior, we detect these applications as Spyware:Android/SndApps.A.
This case is interesting to us as we see it as an evolution in Android application development, specifically 'greyware'. This kind of behavior seems to bear out one of our earlier predictions, where an 'established' developer would be able to push out an update containing suspicious/unwanted/unethical routines, which may invade the user's privacy.
The newly added routines could include obtaining user information that can be used for other purposes, like sending marketing advertisements or spam. At worst, the details may be sold to a third party. We would have no way of knowing what is being done with the information.
In another case even more recently, we've been discussing the odd behavior of another reported Android app, this time a trojan.
It didn't make sense that the trojan intercepted an SMS message and then reported it to a loopback address:
From our investigation, it seems like this app might be a test program. We detect this as Trojan:Android/SmsSpy.C.
However, one of our threat hunters did find a file (SHA1: 7d8004b107979e159b307a885638e46fdcd54586) that appears to be more useful:
That looks more like the real deal. We detect this as Trojan:Android/SmsSpy.D.
-----
Analysis and post by: Zimry, Irene, Raulf and Leong
On 15/07/11 At 11:51 AM
Weiterlesen...
First up: there was a recent report on suspicious applications found the official Android Market. The apps in question have since been taken off the Market, but our threat hunting team still come across them in forums and other such locations, usually promoted as 'free apps'.
The applications themselves appear to be straightforward games. At some point however, it looks like additional services were added to the apps. The earlier versions didn't ask for anything other than Internet access:
However the later versions get a bit more personal than that:
With the changes, the app is able to access various bits of information from the device: the carrier and country, the device's ID, e-mail address and phone number.
The information is sent out to a remote server.
An additional twist this app pulls is that it includes a little icon that when clicked, leads the user to other apps which presumably, they might like to try. The apps being promoted also appear to show the same suspicious behavior.
What was interesting is that both the earlier 'unremarkable' and later 'suspect' versions of the app appear to be from the same developers:
It appears to be a case of questionable new behaviors being added at a later date to an existing app, and not a repackaged app with foreign malicious routines added. We're still looking into various aspects of this; for now, based on the observed behavior, we detect these applications as Spyware:Android/SndApps.A.
This case is interesting to us as we see it as an evolution in Android application development, specifically 'greyware'. This kind of behavior seems to bear out one of our earlier predictions, where an 'established' developer would be able to push out an update containing suspicious/unwanted/unethical routines, which may invade the user's privacy.
The newly added routines could include obtaining user information that can be used for other purposes, like sending marketing advertisements or spam. At worst, the details may be sold to a third party. We would have no way of knowing what is being done with the information.
In another case even more recently, we've been discussing the odd behavior of another reported Android app, this time a trojan.
It didn't make sense that the trojan intercepted an SMS message and then reported it to a loopback address:
From our investigation, it seems like this app might be a test program. We detect this as Trojan:Android/SmsSpy.C.
However, one of our threat hunters did find a file (SHA1: 7d8004b107979e159b307a885638e46fdcd54586) that appears to be more useful:
That looks more like the real deal. We detect this as Trojan:Android/SmsSpy.D.
-----
Analysis and post by: Zimry, Irene, Raulf and Leong
On 15/07/11 At 11:51 AM
Weiterlesen...