CopyCat Android Rooting Malware Infected 14 Million Devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2013-6282 | Improper Input Validation in Linux Kernel on ARM Enables Privilege Escalation CVE-2013-6282 is an improper input validation flaw (CWE-20) in the Linux kernel's get_user and put_user API functions, which on ARM v6k/v7 platforms fail to validate the target address before accessing it. When kernel code uses these functions with an application-supplied pointer, the address is not verified as user space, so a local application can supply a kernel-space address (for example via system calls or ioctls) and read and write kernel memory. An attacker who can already run code on the device can leverage this kernel memory access to escalate privileges to root/kernel level, which can enable persistence or further post-exploitation activity. Affected systems are Linux kernels running on ARM v6k/v7 processors, the architecture that dominated Android smartphones and much embedded Linux hardware in that era; the source data does not enumerate specific affected kernel version ranges. Despite the flaw's 2013 origin, CISA added it to the Known Exploited Vulnerabilities catalog on 2022-09-15, confirming exploitation in the wild, with EPSS estimating a 39.7% probability of exploitation within 30 days (99th percentile). Do: Apply updates per vendor instructions (CISA required action): upgrade the Linux kernel on ARM v6k/v7 devices to a vendor-patched version and install OEM/Google security updates on Android devices, checking vendor advisories for the fixed kernel builds. Inventory legacy and internet-exposed ARM-based embedded systems still running old kernels, and because this is a local privilege escalation, restrict execution of untrusted applications and code on affected devices. | — | 40% | KEV |
| masshundreds of millions of ARM v6k/v7-based devices (legacy Android smartphones and embedded Linux systems) | |
| CVE-2014-3153 | Local Privilege Escalation in Linux Kernel futex_requeue (CVE-2014-3153) CVE-2014-3153 is a local privilege escalation flaw in the futex_requeue function of kernel/futex.c in the Linux kernel, where the code does not ensure that a requeue operation involves two different futex addresses. A local, unprivileged user triggers it by issuing crafted futex system calls that requeue a futex back to the same address, corrupting kernel state in the futex priority-inheritance queue. An attacker who exploits it can execute code with kernel-level (root) privileges, fully compromising the host without any network access; the bug was also the basis of the 2014 'Towelroot' one-click Android rooting exploit. Any Linux system running an affected, unpatched kernel is exposed - servers, Android handsets, and embedded devices - although exploitation requires the ability to run code locally on the target. The vulnerability is listed in CISA KEV (added 2022-05-25), indicating known in-the-wild exploitation, with EPSS at 37.2% (98th percentile) and no public PoC catalogued in the source data. Do: Apply kernel updates per vendor instructions (CISA required action): upgrade affected Linux systems to a kernel release from your distribution that includes the futex fix, and confirm the running version with 'uname -r' against your vendor's advisory. Because exploitation requires local code execution, prioritize multi-tenant servers, shared/embedded appliances, and Android device fleets where untrusted users or apps run locally, and monitor those systems for signs of local privilege escalation until patched. | — | 37% | KEV |
| masshundreds of millions of devices (Linux servers plus Android handsets and embedded systems running unpatched 2014-era kernels) |
Full article705 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalJul 06, 2017
A newly uncovered malware strain has already infected more than 14 Million Android devices around the world, earning its operators approximately $1.5 Million in fake ad revenues in just two months.
Dubbed CopyCat, the malware has capabilities to root infected devices, establish persistency, and inject malicious code into Zygote – a daemon responsible for launching apps on Android, providing the hackers full access to the devices.
Over 14 Million Devices Infected; 8 Million of them Rooted
According to the security researchers at Check Point who discovered this malware strain, CopyCat malware has infected 14 million devices, rooted nearly 8 million of them, had 3.8 million devices serve ads, and 4.4 million of them were used to steal credit for installing apps on Google Play.
While the majority of victims hit by the CopyCat malware resides in South and Southeast Asia with India being the most affected country, more than 280,000 Android devices in the United States were also infected.
While there's no evidence that the CopyCat malware has been distributed on Google Play, the Check Point researchers believe that millions of victims got infected through third-party app downloads and phishing attacks.
Like Gooligan, CopyCat malware also uses "state-of-the-art technology" to carry out various forms of advertisement fraud.
CopyCat uses several exploits, including CVE-2013-6282 (VROOT), CVE-2015-3636 (PingPongRoot), and CVE-2014-3153 (Towelroot) to hit devices running Android 5.0 and earlier, which are all widely used and very old, with the most recent uncovered 2 years ago.
The success of the campaign clearly indicates that millions of Android users still rely on old, unpatched, unsupported devices.
Here's How CopyCat Infects Android Devices
CopyCat disguises as a popular Android app that users download from third-party stores. Once downloaded, the malware starts collecting data about the infected device and downloads rootkits to help root the victim's smartphone.
After rooting the Android device, the CopyCat malware removes security defenses from the device and injects code into the Zygote app launching process to fraudulently install apps and display ads and generate revenue.
"CopyCat abuses the Zygote process to display fraudulent ads while hiding their origin, making it difficult for users to understand what's causing the ads to pop-up on their screens," Check Point researchers say.
"CopyCat also installs fraudulent apps directly to the device, using a separate module. These activities generate large amounts of profits for the creators of CopyCat, given a large number of devices infected by the malware."
In just two months of time span, the CopyCat malware helped the hackers make more than $1.5 Million in revenue. The majority of profit (over $735,000) came from nearly 4.9 million fake installations on infected devices, which displays up to 100 million ads.
The majority of victims are located in India, Pakistan, Bangladesh, Indonesia, and Myanmar, though over 381,000 devices in Canada and more than 280,000 devices in the U.S. are infected with CopyCat.
CopyCat Malware Spreads Using Chinese Advertising Network
While there's no direct evidence on who is behind the CopyCat malware campaign, researchers at Check Point found below-mentioned connections that indicate hackers might have used Chinese advertising network 'MobiSummer' for the distribution of the malware.
- CopyCat malware and MobiSummer operate on the same server
- Several lines of CopyCat's code is signed by MobiSummer
- CopyCat and MobiSummer use the same remote services
- CopyCat did not target Chinese users despite over half of the victims residing in Asia
"It is important to note that while these connections exist, it does not necessarily mean the malware was created by the company, and it is possible the perpetrators behind it used MobiSummer’s code and infrastructure without the firm’s knowledge" Check Point researchers say.
Android users on older devices are still vulnerable to the CopyCat attack, but only if they are downloading apps from third-party app stores.
In March 2017, Check Point researchers informed Google about the CopyCat campaign, and the tech giant has already updated Play Protect to block the malware.
So, Android users even on older devices are protected through Play Protect, which is updated regularly as malware strains such as CopyCat continue to grow.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2017/07/copycat-rooting-malware.html