First malware using Android Gingerbreak root exploit

It did not take too long to find out about the discovery of Gingermaster, the first Android malware to use theGingerbreak exploit, to acquire a sample which was still available from a Chinese alternative Android Marketplace.

The package downloaded uses the following permissions:

android.permission.READ_PHONE_STATE
android.permission.READ_LOGS
android.permission.DELETE_CACHE_FILES
android.permission.ACCESS_CACHE_FILESYSTEM
android.permission.WRITE_SECURE_SETTINGS
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_OWNER_DATA
android.permission.WRITE_OWNER_DATA
android.permission.WRITE_SETTINGS
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RESTART_PACKAGES

It was quite interested to find out how and why the Gingerbreak privilege escalation exploit, also known asCVE-2011-1823 is used.

Despite its Chinese origin, the Gingermaster malware is perfectly capable of spreading globally: It had no trouble installing it on test rig and in the Android emulator.

The malware purports to be an application which displays “Beauty of the day” pictures. The content is downloaded from a website, not packaged with the application.

(When I carried out my tests, the list of beauties also included photos of Lady Gaga – some celebrities seem to be truly global.)

Apart from displaying the photos, Gingermaster creates a service that steals information from your device, sending it out to a remote website in an HTTP POST request. The information grabbed includes: user identifier, SIM card number, telephone number, IMEI number, IMSI number, screen resolution and local time.

The server responds with the various configuration parameters including the update frequency and the update URL. The responses are just simple JSON objects.

In the assets folder of the APK file, Gingermaster includes three ELF executables and one shell script, all with the file name extension .png, presumably to make the exploit code slightly less obvious. The file names are gbfm.png, install.png, installsoft.png and runme.png. The malware also creates a file calledgbfm.sh. This contains the the actual Gingerbreak exploit code, launched in a separate thread.

Gingermaster also generates an output log, called logcat, which contains information about what the malware has done so far:

If the root exploit is successful, the system partition is remounted as writable and various additional utilities installed, supposedly to make removal more difficult and allow for additional functionality.

One these utilities, installsoft.png, contains code to install Android packages using the command line version of the package manager.

This is an interesting technique which we have not seen before and nicely bypasses the Android permissions system by removing the requirement for declaring the “uses-permission” INSTALL_PACKAGESin the Android manifest file.

Of course, once a malicious process gets root, its powers are potentially unlimited.

The Android malware writing scene is heating up as the season of summer holidays is coming to its end.

Hopefully, we will have enough time to document the more interesting ones and share them with you on our Blog.

If you are an Android user, here are some security hints:

* Avoid alternative Android Marketplaces unless you have strong evidence they are trustworthy.

* Avoid applications which request more permissions than they need.

(Gingermaster claims to be an application which downloads “beauty of the day” pictures of celebrities from a website. Why would it need permissions such as WRITE_USER_DATA and MOUNT_UNMOUNT_FILESYSTEMS?)

* Email your vendor to urge them to update the OS on your device if they have not yet done so.

Google pulls out malicious apps from Android Market

Google has removed at least 10 applications from its Android Market after it detected malicious code in the guise of add ons to one of its popular apps. Most of the infected apps posed as add ons or cheats to Angry Birds, a popular mobile applications developed by Rovio. The apps were spotted and reported by Xuxian Jiang, an assistant professor of computer science at North Carolina State University. According to Jiang, several apps included a stealthy spyware called as Plankton.

Plankton works like a parasite: latching onto its host applications as a background service which has no affect on that apps intended purpose. When a user runs an infected application on their Android phone, Plankton collects information such as the device ID and list of granted permissions and sends them via HTTP POST message to a remote update server, the NC State researchers found.

That remote server returns a URL pointing to an executable file for the device to download. Once downloaded, the jar file is dynamically loaded. In this way, the payload evades static analysis and is difficult to detect.

Analysis of the payload shows that the virus does not provide root exploits, but supports a number of bot-related commands. One interesting function is that the virus can be used collect information on users’ accounts.

The spyware reportedly uploads data such as browser bookmarks and browser history by connecting to the remote server.

A new malware called DroidKungFu was also detected.

In Android versions 2.2 (Froyo) and earlier,DroidKungFu takes advantage of two vulnerabilities in the platform software to install a backdoor that gives hackers full control of your phone. Not only do they have access to all of your user data, but they can turn your phone into a bot – and basically make your smartphone do anything they want.

According to reports, the malware is already being circulated outside the Android market. It is said that the high end malware is capable of bypassing anti-virus and installs itself in backdoor allowing hackers to take the control of the device.

This is just the latest in a series of apps being removed from the Android Market. Google recently pulled out more than two dozen apps from the Android Market over malware infection. In early March, Google was compelled to remotely delete apps from users' phones due to malware called as DroidDream. The search engine giant also issued a security update to rectify the malady.

Android Market is pretty popular among developers as here they get ample freedom which is not available at any other retail outlets. Contrary to Apple's iPhone, Android Market publishes the apps almost instantaneously. There are hundreds of free apps that are downloaded and installed daily. This freedom has certainly made the Android Market popular. But the popularity comes at cost like these vulnerabilities. Google does not monitor the apps that are launched in the Android Market but responds only to complaints.

View more articles from: Internet