Slashdot Mirror
New Android Trojan Fakes Device Shut Down, Spies On Users
An anonymous reader writes A new Android Trojan that tricks users into believing they have shut their device down while it continues working, and is able to silently make calls, send messages, take photos and perform many other tasks, has been discovered and analyzed by AVG researchers. They dubbed it, and AVG's security solutions detect it as PowerOffHijack.
Issue closed by NSA
If you really need privacy, you pull the phone battery....and if you might need privacy, you don't buy a phone that can't have its battery pulled.
Not really any solutions, as long as people are walking around with what amount to wireless microphones in their pockets this will always be a potetial problem.
"I opened my eyes, and everything went dark again"
Why is it so damned easy for malware to get root access, and so damned annoying for me to get it?
And, quite honestly, by how annoying and intrusive AVG was becoming when I got away from it ... do we have another source which confirms this?
I'm just not sure I trust them to be quite honest.
Lost at C:>. Found at C.
yes actually, but the NSA has been caught doing the last few times in a row, its not ignorant ot make that assumption.
This capability predates Android and was used against feature phones quite a number of years ago. The countermeasure then, as it is now, leave your phone elsewhere or pull the battery if you really need to be sure you aren't being monitored.
I think its fair to say that it takes a user to install it first, linux has pretty much always had trustworthy repositories, Google not so much.
I love some of the things you can add to chrome but there seems to be little to no security checking of what an app or extension does. That does worry me.
Blarney Quality Restaurant, Plants
The only AV products I've found which actually do anything are SpywareBlaster and Malwarebytes, because MB actually blocks by IPs, and SpywareBlaster doesn't actively run, but sets kill bits and blocklists in browsers.
However, with an adblocking browser extension, Web based malware should never hit your system in the first place, and with click to play functionality, should not have a chance of being activated... and with a VM or sandbox, even if the browser does get compromised, it won't get past that.
As for Android, the weakness is that a lot of Chinese stores have little to no curation or filtering out bad stuff. Google does a decent job in stomping out the bad stuff, but I still think they need to go with two tiers, one tier as things are currently, and one tier where developers have to agree to more stringent rules, and the software has to pass more tests... that way, if a user sticks to the more curated tier, there is less chance of an infection happening.
One note -- the exploits we read about with Android almost always are related to either pirate repositories or "app stores" with little to no moderation. Even something like Cydia's ecosystem would be highly unlikely to have malware like this ever hit it it in the first place, and if it did, the devs would have it pulled in minutes to hours.
As for AV software, I use it on machines to make legal eagles happy. I've yet to see it actually actively stop a compromise of a machine. At best, it is good for scanning for 1+ day stuff. The real defense are the IP blacklists, hosts files, kill bits (SpywareBlaster is quite useful), Web browser extensions and click-to-play. The best mitigation if an infection happens are sandboxes (SandboxIE), virtual machines, and jails. AV was useful back when one scanned a floppy with the latest copy of Doom on it, but these days, it is more for the checkbox in paperwork than actual protection.
yes actually, but the NSA has been caught doing the last few times in a row, its not ignorant ot make that assumption.
With a track history like the NSAs, it's not even an assumption. It's more like a statistical certainty.
That's because the malware, after having previously obtained root access
how did it get root? either the device was rooted and the user granted the app root privs (duh!), or they've discovered a hack to gain root on non-rooted devices. if it was the latter, we'd be hearing a lot more about it, and faking a phone shutdown is the least of our concerns.