Slashdot Mirror
Symantec Identifies Android Trojans That Mutate With Every Download
angry tapir writes "Symantec researchers have identified a new premium-rate SMS Android Trojan that modifies its code every time it gets downloaded in order to bypass antivirus detection. This technique is known as server-side polymorphism and has already existed in the world of desktop malware for many years, but mobile malware creators have only now begun to adopt it."
X-Men: Androids
I do not need Norton Mobile, Avast is cheaper and just as good, so Symantec, stop using your fear tactics for advertising.
I had my carrier, Sprint, turn "premium rate" text messaging off completely. My phone is clean, but I don't have to worry about it anyway.
Also, it's worth noting that these guys don't need a virus to charge you for this stuff. About 2-3 times a year, I would get some charge on my bill from a joke line, horoscope line or whatever that I never signed up for through text messaging or any other way. The last time it happened, I explained to the customer service rep that I would never use this type of service and she suggested that I block it. I have not had another charge since.
There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
So they've discovered polymorphic viruses? You know, like in good old days of DOS where viruses were real viruses and not simple worms.
http://en.wikipedia.org/wiki/Polymorphic_code
cried Symantec...
"According to Armstrong, server-side polymorphism is not very widespread on the Android platform at the moment because most users get their apps through official channels and the current structure of the Android Market does not allow for a malware distribution scheme like this one."
You get what you pay for so think about why your still getting those pop-up porn ad's.
Never mind pop-ups. I want to know which virus it was that yanked out the comma from your first clause, changed "you're" to "your" and turned "ads" into "ad's." These make-me-type-like-a-12-year-old malware infestations have really taken over. Because there's certainly no other explanation.
Don't disappoint your bird dog. Go to the range.
Brings back memories of when I was in high school... I bought Mark Ludwig's book, 'The big black book of computer viruses'.
I didn't actually write any viruses from reading the book, just a fun boot sector program that displayed subliminal messages. It also happened to get installed on a few choice computers.
Here's his 'little black book' book: http://vxheavens.com/lib/vml00.html. Of course his work talked about polymorphism over a decade ago.
Sounds like Symantec's usual tactics of - create a terrible virus, tell everyone how bad it is, and only their products can protect you. This has been done before to try and sell AV. With Microsoft now having it's free Security Essentials, AV companies are getting desperate!
-- By all means let's be open-minded, but not so open-minded that our brains drop out.
Symantec Identifies Android Trojans That Mutate With Every Download
Symantec DEVELOPS Android Trojans That Mutate With Every Download
There - fixed that for ya'!
They interest me! (NSFW)
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Most infestations still come from compromised websites - research by AVG confirms that much, here:
http://betanews.com/2012/01/25/the-top-10-web-security-threats-you-should-avoid/
Pertinent quote/excerpt:
"The compromised website is still the most effective attack vector for hackers to install malware on your computer with 47.6 percent of all malware installs occurring in that manner, says security firm AVG. Another 10.6 percent are tricked into downloading exploit code -- many times, without their knowledge -- by clicking on links on pages to sites hosting malware... It also found that faked pharmacy sites are a popular attack method, seen in about 10.4 percent of all attacks. Fake antivirus scanners remain a popular malware injection method at 8.4 percent. "
---
* Fact is, what I noted, in compromised sites, comprises 77% of malware installations - not what users download & install themselves (ala shareware/freeware sites like download.com etc./et al)...
PC's &/or SmartPhones are NOT ALL THAT DIFFERENT EITHER really (smartphones are just smaller handheld personal computers nowadays in essence really).
APK
P.S.=> So, "all that said & aside" - Is an "appstore/walled garden" a BETTER/SAFER BET? Perhaps, & I'm not saying it's not a good idea to do that, but it's far from a 'permanent cure' vs. malware exploitations online (as long as there are fools making more malwares & bushwhacking users via compromised sites' code, that is)...
... apk
Viruses were never worms, and neither are trojans, which is what these are properly called.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
So that's why people treat C++ like some kind of virus! It's the damn polymorphism!
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Has anyone, anywhere ever intentionally used a "premium" SMS service?
Telecoms obviously need a regulatory smackdown requiring them not to act as payment processors.
You know, every time an AV story comes up, so does this stupid canard. AV companies have no real need to develop viruses and other malware - there are enough people doing that external to their companies to keep them quite busy enough all of their working hours and to allow them to continue making sales. And do you think these companies would risk the millions of dollars they make each year doing something as idiotic as this?
You may not like their products, but please... Your post (like the others of the same ilk that can be found on this thread) is just stupid.
That is all.
Got to have our dose of fear mongering from Symantec. I hate those vultures and I distrust everything they say.
Norton Mobile, slow you phone down and annoy you, for a cost, to protect yourself against stupidity... How many viruses can infect my phone if I never download the crapware that they need to do this ...Dancing Bunnies do not interest me
and for more bollywood movies go to pro.howublog.com
demonstrably possible, clearly worthwhile, and very well understood
You are wrong on two counts, partially wrong on the one remaining.
Possible? Yes, in one rare incident. Not possible over a longer timeframe, as Apple closes remote vulnerabilities quickly. It's tethered jailbreaks they tend to leave alone much longer and they don't present an infection vector. And because Apple pushes out updates they go out to almost all the devices over a short period of time.
But your other two points are really what is wrong:
"well understood" - actually most of the jail breakers are not that forthcoming with exact techniques. There is for example currently no "well understood" remote vulnerability on iOS.
"clearly worthwhile" - this is where you went really wrong.
Unlike Android where having malware run on a device can get you some financially positive results (like SMS while you are not looking, or replacing the system keyboard to capture banking passwords) none of that is possible if you trick a user into downloading a trojan or malware iOS app. You cannot send out an SMS without user intervention. It cannot even run in the background reporting things to a remote website.
Simply put, it's actually much more clear that there is no value in producing iOS malware, which is why none has been written to date. I'm sure if there were sufficient cause to do so we would have seen something by now but the security model has too many layers for malware writers to bother currently.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
You can't apply this technique to the android market as you have to upload your apk to their website, there it gets scanned and it appears in the market a few hours later. Relatively small threat, then.
How does 'server-side polymorphism` apply to a read-only bootable Ubuntu USB distro, which is the one I use here?
AccountKiller
FTFA "A special mechanism that runs on the distribution server modifies certain parts of the Trojan in order to ensure that every malicious app that gets downloaded is unique. "
So basically we're talking about "some guys website" hosting malware. This is not about Android Market.
Join the Slashcott! Feb 10 thru Feb 17!