android-rooting-malware

A new Android-rooting malware with an ability to disable device’ security settings in an effort to perform malicious tasks in the background has been detected on the official Play Store. What’s interesting? The app was smart enough to fool Google security mechanism by first pretending itself to be a clean app and then temporarily replacing it with a malicious version. Security researchers at Kaspersky Lab discovered a new piece of Android rooting malware that was being distributed as gaming apps on the Google Play Store, hiding behind puzzle game “colourblock,” which was being downloaded at least 50,000 times prior to its removal.

 

“To bypass Google Play Store security checks, the malware creators used a very interesting method: they uploaded a clean app to the store at the end of March, 2017, and would then update it with a malicious version for short period of time,” the researchers said. 

“Usually they would upload a clean version back on Google Play the very same day. They did this at least 5 times between 18 April and 15 May.”

android-rooting-malware-app-google-play-store

To make sure the malicious module gets executed with system rights, the malware overwrites system’s runtime libraries depending on which Android version the device is running.


“Furthermore, it can grant the “com.qualcmm.timeservices” app Device Administrator rights without any interaction with the user, just by running commands. It is a very unusual way to get Device Administrator rights,” the researchers said.

This malicious 3rd party app is responsible for connecting the infected device to the attacker’s command-and-control server, giving out full control of the device into the hands of attackers.

However, the researchers said, they haven’t noticed any commands received by the infected Android devices so far, so it’s unclear “what kind of files will be executed, but they could be malicious or advertising files.”

How to Protect Yourself Against Dvmap Malware

Researchers are still testing the Dvmap malware, but meanwhile, advise users who installed the puzzle game in question to back up their device’s data and perform a full factory data reset in an effort to mitigate the malware.

To prevent yourself from being targeted by such apps, always beware of fishy apps, even when downloading from Google Play Store, and try to stick to the trusted brands only. Moreover, always look at the comments left by other users.

Always verify app permissions before installing any app and grant only those permissions which have relevant context for the app’s purpose.

Advertisements