Slashdot Mirror
Android Malware Using Blog As C&C Server
wiredmikey writes "Security researchers have discovered a unique feature circulating in some Android-based malware. The malicious application is using a blog in China to act as a Command and Control (C&C) server. On Tuesday, Trend Micro discovered a malicious Android application out of China using the new trick to receive instructions, and appears to be the first time Android malware implemented this kind of technique to communicate with its server."
The obvious solution is to use something that is at once ubiquitous and innately evil, like twitter or facebook.
Imagine the new 'activates malware' hashtag!
Hehe, I thought for a moment it was being used as a Command & Conquer server...
Android wouldn't be having this problem if it ran a HURD kernel...
> : )
PS: I don't reply to ACs.
Why aren't all malware creators doing this?
This actually makes sense considering that so many "computers" being manufactured for the Chinese market are now Android based. Yes, Microsoft is freaking out and trying to get their OS on ARM because of all the ARM based Android tablets, micro-books, or net-books that are on the market in China are eating their market share for "real" computers. Why spend almost a months disposable income on a machine capable of running a pirated copy of Windows XP when you can spend 1/5 to 1/3 that amount on a fully featured Android tablet/palm-top/micro-book/whatever? The idea of malicious keywords also makes some of the webforum spam I have seen recently. Interesting.
You first have to install a the app from an untrusted site and ignore the page full of warnings the OS throws at you before this can do anything. Seriously, look at the screen shot in the FA. You have to agree that the app can make outgoing phone calls. If you click through that many warnings I would hardly call this malware. Its doing exactly what it says it will do.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
A blog in China is a C&C server? Okay, here's what we do:
We gather a whole bunch of engineers, load them into a helicopter, land *inside* their base, and then rush their construction yard. If we're lucky, they haven't built many SAM sites or antipersonnel defenses inside their base, and we can cut off their ability to build anything new.
God help us if they have a mobile construction vehicle hidden somewhere.
and appears to be the first time Android malware implemented this kind of technique to communicate with its server.
correction, this is the first time those security researchers have found this implementation. this isn't exactly rocket science.
Anons need not reply. Questions end with a question mark.
Or Google?
There are two types of people in the world: Those who crave closure
Still crack up at "That was left-handed!"
google doesnt have nukes...
I've seen Scripting Layer for Android (SL4A) request a shitload of permissions so that scripts loaded into it can access API features that require those permissions.
Ok, so let me get this right. You have to agree to permissions for everything an android app does? Do you just spend your whole life agreeing to stuff on your phone? I'll take my iPhone, it works, and it always works thank you.
Did anyone else read the headline as "Command and Conquer" instead of "Command and Control"?
No, no, he thinks we should google china from orbit. The ISS has an internet connection, doesn't it? Though I don't know what the astronauts should do with fine ceramic dinner plates.
It ain't google's fault if people are stupid enough to download apps from some dodgy warez site and infect themselves in the process.
This is an Android phone. It doesn't have to be a "warez" site. It can be a legitimate 3rd party download site that all the Androids gush about. Nothing is stopping these attacks from a legitimate store. Don't blame users for doing exactly what Android anti-"walled garden" advocacy tells them to do.
US law requires that cellphone network carriers accept emergency calls, even from non-active cellphones. So if you turn the thing on and it can see a tower, you can use it to make a 911 call. No account, no contract, no cost.
Some charity organizations, like domestic abuse shelters, are giving out donated inactivated cellphones to people who don't have one of their own so that no matter where they are, if they get into trouble, they can at least dial 911.
A little quality time with your search engine of choice should turn up any number of places that you can take your old phones (preferably WITH chargers) to be donated. Hell, you carrier's local storefront probably has a dropbox. -- Just make sure you ask first whether they donate the working phones or just send the whole shebang out to the scrappers.
This is why all Android users who install apps from "untrusted sources" should install permission dog. What permission dog does is twofold
a) It does a full audit of all the apps on your phone, so you can easily see a simple breakdown of all of the permissions apps you CURRENTLY HAVE are using. Ones using too many permissions are flagged with warning icons.
b) If you have root, then It allows you to deny individual permissions to apps. So if an app is asking for permission A B and C, you can allow A and C but deny B. Depending on the app, this can either simply not a certain function work, cause the app to crash totally, or allow it to work 100%. But the important thing is it gives the control to you as a user as to what you want every app to be allowed to do.
So, there's some Android malware using a blog in the .CN area as a C&C proxy? That's funny. By analogy, it reminds me of certain political tools in the modern society using pundits on certain TV networks as C&C proxies - and what else that could serve to remind oneself of, the irony.
Anonymous because Big Brother is a myth, but some would perceive a myth as though it was reality.
And hey, to put it back on topic: Where are all the "social engineering" threads, these days?
Perhaps someone already turned on "Unknown sources" to get the Amazon Appstore-exclusive game Angry Birds Rio working. And once that's on, you don't need to use ADB to sideload; you can just navigate to the APK using a web browser.
I scanned down the list of things in TelephonyManager that require READ_PHONE_STATE.
Say a program needs to stop playing music if the phone starts ringing. In Android, background processes such as Internet radio applications run as services. So how is a service created by a program without READ_PHONE_STATE notified that the phone is ringing so that the service can stop playing the stream? Or does Android automatically stop all other audio sources once the phone starts ringing?
Say a program needs to make a unique user ID. The program could require the user to enter an e-mail address and password, but that has three drawbacks:
So applications tend to generate a user ID based on the IMEI or the IMSI, which requires READ_PHONE_STATE.
The Chinese may one day defeat my ultimate security system for Android: When the app's summary is written in bad Engrish, do not install.
It can be a legitimate 3rd party download site that all the Androids gush about.
I'll still happily live with the risks, and tell anyone who thinks I should subject myself to a walled garden to fuck right off.
--Jeremy
Jesus was a liberal
As for the non walled garden approach, clearly most people prefer it given the popularity of Android.
Riiiight. Might work in the east, where the masses have never had a computer in the first place, won't work in the west and here is why: Just last year one of the local vendors in my area sold "Windows netbooks for $100" with in tiny writing "Compact Edition" but hell, people don't know what that means. it looked like XP, that was all that they saw.
Within a few weeks the local CL was filled to the brim with folks practically GIVING the things away. Why was that? Was there something wrong with them? Nope I tried one for a few weeks before giving it away and it was just fine for basic net surfing but it wouldn't run Windows programs so everyone (including me) got rid of them.
The reason why MSFT rules the desktop is the same reason why MSFT has to royally bust their ass maintaining backwards compatibility and that is the millions of x86 apps written that folks use every day, from the software that came with their cameras and printers to the software they use at the office. it is ALL x86 and while Linux guys can scream "We got stuff just as good!" frankly that's bullshit. Where is the custom medical and shipping apps? software equal to Quicken/Quickbooks? it doesn't exist in Linux and it sure as hell doesn't exist in ARM Linux, which has even less apps than x86 Linux.
The reason Apple can get away with the numbers they do is because everyone considers their cell phones throw away items. folks use it until their contract is up and then get another one and they have been trained that their programs won't work because what worked with phone foo don't with phone bar. Hell everyone I know has drawers filled with the things as they don't know WTF to do with all their old phones. from what I've seen the masses treat the tablet as "a big cell phone" and therefor phone rules apply. but when you start talking netbooks and the like? those are "baby laptops" and they damned well WILL expect it to run everything their desktop runs, just slower because "its a baby". Believe me as a retailer I've seen it first hand.
I would mod your post insightful except for one thing -- you seem oblivious to the concept of emulation. Every thing you say could be true, if computers weren't Turing machines -- anything that can be implemented on one Turing machine can be implemented on another, and this includes the Turing machine itself. As processors and storage evolve, you can expect to see VM implementations for *any* hardware/software architecture you care to name transparently available for any platform. Right now, I run Windows-specific apps on my Solaris CDE desktop in a Windows XP VM that boots automagically when the app is launched. It is only a matter of (probably very little) time when you will be able to do this on your Android or IOS tablet. It just takes a little bit more CPU horsepower than is presently commercially available, and Moore's law isn't dead yet, not by a long shot.
My wife and I have relatively new Sprint HTC EVO Android-based smart phones. My wife has downloaded a lot of apps, nothing that looks suspicious, reads a lot of Email newsletters, and uses hers to send and exchange GMail Email, etc. With limited vision, I do all my newsletters, Email, etc. on this desktop except I have read some news etc., and received some mail from her etc., on my cell phone. We're both suddenly getting both messages and mail from unknown sources that is spam, some highly objectionable, some signed with unrecognizable handles, some simply undecipherable gibberish not all of which is in English characters or recognizable and may be Chinese or whatever, . Our phones have both also started switching, changing home page apps, placing calls without being touched and to people in our directories but not last person called, etc. Our primary concern is that we both use our phones for privileged and confidential medical, legal, etc. matters, and our people lists contain doctors and friends with whom we have privileged and confidential relationships and some very sensitive confidential information. Both phones are on the federal Do Not Call list, though that is usually not necessarily for cell phones. Sprint is not happy hearing from us again. Please keep us posted on this including, but not limited to, effective defenses as they are developed. By the way, most sites I know don't cover Android apps for legal and other things and this is the only site on which I have found two wanrings now about Android malware. Where can I find best malware, security, legal and other research, adn other apps for Android? Also, several of the available free and cheap Android apps I don't really want on my cell phone, which has limited battery life, but would really like ot have on my MS Windows desktop, and there are some my wife would like on her laptop. I'm sure there must be a way to do that but can't figure out how. Any suggestions.