3 Google Play Store Apps Exploit Android Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-2215 | Use-After-Free Privilege Escalation in Android Kernel (CVE-2019-2215) CVE-2019-2215 is a use-after-free flaw (CWE-416) in the Android kernel's binder.c IPC driver that allows privilege escalation from an application to the Linux kernel. Exploitation requires no user interaction, but an attacker must either run a malicious local application or chain the bug with a vulnerability in a network-facing application. Successful exploitation yields kernel-level code execution, effectively rooting the device and giving the attacker full control over apps, data, and communications. Affected parties include Android devices with unpatched kernels (reporting at the time indicated most Android phones were affected), plus products shipping affected Android kernel code, including Google Android, Debian/Ubuntu builds, and NetApp and Huawei offerings. The flaw was publicly disclosed and patched in Android's October 2019 security updates, public proof-of-concept exploits exist, and it is listed in CISA's Known Exploited Vulnerabilities catalog with a high (72.1%) EPSS probability of exploitation; headlines confirm in-the-wild use, including a Google Play app that leveraged it to deliver spyware. Do: Apply vendor-supplied updates per CISA's required action — for phones and tablets, ensure the device is on the October 2019 Android security patch level or later (check Settings > About phone > Android security patch level) and patch via MDM across your fleet; NetApp, Huawei, Debian, and Ubuntu customers should install their vendors' corresponding kernel updates. Because this is a local privilege escalation with no user interaction required, also patch any network-facing applications that could be chained with it, and hunt for signs of exploitation such as unexpected root or unknown sideloaded/rooting apps on managed devices. | 7.8 | 72% | KEV PoC ×2 |
| massbillions of devices |
Full article602 words · extracted from thehackernews.com · click to collapse
The Hacker NewsJan 07, 2020
Watch out! If you have any of the below-mentioned file managers and photography apps installed on your Android phone—even if downloaded from the official Google Store store—you have been hacked and being tracked.
These newly detected malicious Android apps are Camero, FileCrypt, and callCam that are believed to be linked to Sidewinder APT, a sophisticated hacking group specialized in cyber espionage attacks.
According to cybersecurity researchers at Trend Micro, these apps were exploiting a critical use-after-free vulnerability in Android at least since March last year—that's 7 months before the same flaw was first discovered as zero-day when Google researcher analysed a separate attack developed by Israeli surveillance vendor NSO Group.
"We speculate that these apps have been active since March 2019 based on the certificate information on one of the apps," the researchers said.
Tracked as CVE-2019-2215, the vulnerability is a local privilege escalation issue that allows full root compromise of a vulnerable device and could also be exploited remotely when combined with a separate browser rendering flaw.
This Spyware Secretly Root Your Android Phone
According to Trend Micro, FileCrypt Manager and Camero act as droppers and connect to a remote command and control server to download a DEX file, which then downloads the callCam app and tries to install it by exploiting privilege escalation vulnerabilities or abusing accessibility feature.
"All of this is done without user awareness or intervention. To evade detection, it uses many techniques such as obfuscation, data encryption, and invoking dynamic code," the researchers said.
Once installed, the callCam hides its icon from the menu, collects the following information from the compromised device, and sends it back to the attacker's C&C server in the background:
- Location
- Battery status
- Files on device
- Installed app list
- Device information
- Sensor information
- Camera information
- Screenshot
- Account
- Wifi information
- Data from WeChat, Outlook, Twitter, Yahoo Mail, Facebook, Gmail, and Chrome.
Besides CVE-2019-2215, the malicious apps also try to exploit a separate vulnerability in the MediaTek-SU driver to get root privilege and stay persistent on a wide range of Android handsets.
Based on the overlap in location of the command and control servers, researchers have attributed the campaign to SideWinder, believed to be an Indian espionage group that historically targeted organizations linked to the Pakistani Military.
How to Protect Android Phone from Malware
Google has now removed all the above-mentioned malicious apps from Play Store, but since Google systems are not sufficient to keep bad apps out of the official store, you have to be very careful about downloading apps.
To check if your device is being infected with this malware, go to Android system settings → App Manager, look for listed package names and uninstall it.
To protect your device against most cyber threats, you are recommended to take simple but effective precautions like:
- keep devices and apps up-to-date,
- avoid app downloads from unfamiliar sources,
- always pay close attention to the permissions requested by apps,
- frequently back up data, and
- install a good antivirus app that protects against this malware and similar threats.
To prevent yourself from being targeted by such apps, always beware of fishy apps, even when downloading from Google Play Store, and try to stick to the trusted brands only. In addition, always look at the app reviews left by other users who have downloaded the app, and also verify app permissions before installing any app and grant only those permissions that are relevant for the app's purpose.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2020/01/android-zero-day-malware-apps.html