Godless Android Malware employs multiple rooting exploits
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-3153 | Local Privilege Escalation in Linux Kernel futex_requeue (CVE-2014-3153) CVE-2014-3153 is a local privilege escalation flaw in the futex_requeue function of kernel/futex.c in the Linux kernel, where the code does not ensure that a requeue operation involves two different futex addresses. A local, unprivileged user triggers it by issuing crafted futex system calls that requeue a futex back to the same address, corrupting kernel state in the futex priority-inheritance queue. An attacker who exploits it can execute code with kernel-level (root) privileges, fully compromising the host without any network access; the bug was also the basis of the 2014 'Towelroot' one-click Android rooting exploit. Any Linux system running an affected, unpatched kernel is exposed - servers, Android handsets, and embedded devices - although exploitation requires the ability to run code locally on the target. The vulnerability is listed in CISA KEV (added 2022-05-25), indicating known in-the-wild exploitation, with EPSS at 37.2% (98th percentile) and no public PoC catalogued in the source data. Do: Apply kernel updates per vendor instructions (CISA required action): upgrade affected Linux systems to a kernel release from your distribution that includes the futex fix, and confirm the running version with 'uname -r' against your vendor's advisory. Because exploitation requires local code execution, prioritize multi-tenant servers, shared/embedded appliances, and Android device fleets where untrusted users or apps run locally, and monitor those systems for signs of local privilege escalation until patched. | — | 37% | KEV |
| masshundreds of millions of devices (Linux servers plus Android handsets and embedded systems running unpatched 2014-era kernels) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | market.moboplay.com | oad from a remote command and control (C&C) server, hxxp ://market[.]moboplay[.]com/softs[.]ashx. We believe that this routine is done so t |
| domain | softs.ashx | d and control (C&C) server, hxxp ://market[.]moboplay[.]com/softs[.]ashx. We believe that this routine is done so that the malware |
Full article469 words · extracted from securityaffairs.com · click to collapse
Godless is a new strain of Android Malware recently spotted by experts from Trend Micro that leverages multiple rooting exploits.
Godless is a new strain of malware that uses multiple rooting exploit to compromise Android mobile devices.
The mobile malware is a sort of hacking platform that includes an open-source rooting framework called android-rooting-tools.
The availability of multiple exploits in the framework makes this threat very dangerous, among the known flaws exploited by the Godless there are the CVE-2015-3636 and CVE-2014-3153.
The threat that can compromise devices running Android 5.1 (Lollipop) or earlier was spotted by experts from Trend Micro. Godless has already infected over 850,000 devices worldwide, bad actors delivered it through malicious applications deployed in legitimate app stores, including Google Play.
“We came across a family of mobile malware called Godless (detected as ANDROIDOS_GODLESS.HRX) that has a set of rooting exploits in its pockets.” states the post published by Trend Micro. “By having multiple exploits to use, Godless can target virtually any Android device running on Android 5.1 (Lollipop) or earlier. “
Once the malware has rooted the device it can make several operations through the installation of malicious apps, the experts highlighted that threat has evolved over the time and last variants are able to root the device remotely by downloading malicious payload from the C&C server.
Researchers also observed that first samples of the malware were implementing a standalone Google Play client to steal users’ login credentials, meanwhile, the latest variant installs a backdoor with root access that allows attackers to completely control the device.
“We have seen the evolution of this family. In earlier Godless versions, malicious apps contain a local exploit binary called libgodlikelib.so , which uses exploit code from android-rooting-tools.” states Trend Micro.
“Recently, we came across a new Godless variant that is made to only fetch the exploit and the payload from a remote command and control (C&C) server, hxxp://market[.]moboplay[.]com/softs[.]ashx. We believe that this routine is done so that the malware can bypass security checks done by app stores, such as Google Play.”
The experts observed that several legitimate apps on Google Play have corresponding malicious versions in the wild and even share the same developer certificate.
“The versions on Google Play do not have the malicious code. Thus, there is a potential risk that users with non-malicious apps will be upgraded to the malicious versions without them knowing about apps’ new malicious behavior,” Trend Micro says.
Experts from Trend Micro suggest to carefully review the developer of the app that we are going to download. Don’t trust unknown developers with a low reputation and no background information. Of course always download the apps from trusted stores such as Google Play
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Godless , Android malware)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/48633/breaking-news/godless-android-malware.html