Slashdot Mirror
Android Malware Using Blog As C&C Server
wiredmikey writes "Security researchers have discovered a unique feature circulating in some Android-based malware. The malicious application is using a blog in China to act as a Command and Control (C&C) server. On Tuesday, Trend Micro discovered a malicious Android application out of China using the new trick to receive instructions, and appears to be the first time Android malware implemented this kind of technique to communicate with its server."
The obvious solution is to use something that is at once ubiquitous and innately evil, like twitter or facebook.
Imagine the new 'activates malware' hashtag!
Hehe, I thought for a moment it was being used as a Command & Conquer server...
Android wouldn't be having this problem if it ran a HURD kernel...
> : )
PS: I don't reply to ACs.
This actually makes sense considering that so many "computers" being manufactured for the Chinese market are now Android based. Yes, Microsoft is freaking out and trying to get their OS on ARM because of all the ARM based Android tablets, micro-books, or net-books that are on the market in China are eating their market share for "real" computers. Why spend almost a months disposable income on a machine capable of running a pirated copy of Windows XP when you can spend 1/5 to 1/3 that amount on a fully featured Android tablet/palm-top/micro-book/whatever? The idea of malicious keywords also makes some of the webforum spam I have seen recently. Interesting.
You first have to install a the app from an untrusted site and ignore the page full of warnings the OS throws at you before this can do anything. Seriously, look at the screen shot in the FA. You have to agree that the app can make outgoing phone calls. If you click through that many warnings I would hardly call this malware. Its doing exactly what it says it will do.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
and appears to be the first time Android malware implemented this kind of technique to communicate with its server.
correction, this is the first time those security researchers have found this implementation. this isn't exactly rocket science.
Anons need not reply. Questions end with a question mark.
What if they completed the hand of nod?
I read TFA and all I got was this lousy cookie
Why aren't all malware creators doing this?
Short answer: Higher barriers to entry on malware^W Windows environment programming.
Things get tricky when you're a beginner coder who must do native Windows programming, and need network connectivity. After decades of 'progress' those Windows viruses you're hinting that we create in our sleep are still almost exclusively nasty DOS-using compilations and/or assembly-based. As such, they require some very low level coding since VBS has stopped being the malware tool of choice due to e-mail policies in newer programs.
So, what does Android offer? Because Android isn't windows... Android programs run on Java. Java provides well-understood APIs and has a slew of shared libraries out there. Apparently even virus writers don't want to acquire a masters in the arcaneness of [embedded] C to succeed in rooting your machine^Wproprietary-android-phone via a network.
And to add to the answer above, a Windows creator would try phones because of this next one: "Lack of phone antiviruses." The kind of stuff that you create on Windows would easily get blacklisted and REMOVED by every tool in existence under Windows given enough days. But Android is linux. And linux doesn't "Sell" antiviruses (with capital S.) And Apps won't have root access under your carrier to help you clean the phone properly anyway. And lastly, most phones' Android builds are NEVER auto-updated by the carriers.
Ok, so let me get this right. You have to agree to permissions for everything an android app does?
Yes.
Do you just spend your whole life agreeing to stuff on your phone?
[Sarcasm]Yes that's right, because I spend every waking moment installing apps on my phone...[/Sarcasm]
I'll take my iPhone, it works, and it always works thank you.
Ok, so let me get this right. You hand over ALL your trust to the app store, and you don't care what permissions an app gets. Because the iDrones at the app store would never make a mistake and let a bad app through, right? You have an iProduct because you like it simple, and reviewing what an app has permission to do while you're installing it is far too complicated for you?
No, no, he thinks we should google china from orbit. The ISS has an internet connection, doesn't it? Though I don't know what the astronauts should do with fine ceramic dinner plates.