New Android Trojan Fakes Device Shut Down, Spies On Users

An anonymous reader writes A new Android Trojan that tricks users into believing they have shut their device down while it continues working, and is able to silently make calls, send messages, take photos and perform many other tasks, has been discovered and analyzed by AVG researchers. They dubbed it, and AVG's security solutions detect it as PowerOffHijack.

Comments

not-a-bug; wont-fix

[sbrown7792]

Issue closed by NSA

Re:not-a-bug; wont-fix

[ShanghaiBill]

This sounds much more like something the Chinese government would do

It sounds more like something an anti-virus company like AVG would make up to get publicity and boost sales. If this was something real, they should name the app (they don't) and/or describe a plausible mechanism. An Android app can detect a hard power down (so that it can save data or whatever) but it cannot stop or delay it. So the only way it could work is to trick the user into releasing the power button too early.

This is why.....

[TheCarp]

If you really need privacy, you pull the phone battery....and if you might need privacy, you don't buy a phone that can't have its battery pulled.

Not really any solutions, as long as people are walking around with what amount to wireless microphones in their pockets this will always be a potetial problem.

Re:This is why.....

[Iamthecheese]

Requiring an action as inconvenient as partially dismantling the device in order to not experience undesired operation is a piss-poor design.

Re:This is why.....

[GrumpySteen]

They could have an untrustworthy mobile hidden in an orifice. Best don the latex and do a thorough cavity search!

Re:This is why.....

[markdavis]

I think you hit on the solution: A hard power switch.

And better yet, also add: A hard microphone switch and a physical shutter for the cameras. I wouldn't mind having a hard radio switch and/or GPS switch too.

No software can work around that when you need real privacy.

WTF?

[gstoddart]

Why is it so damned easy for malware to get root access, and so damned annoying for me to get it?

And, quite honestly, by how annoying and intrusive AVG was becoming when I got away from it ... do we have another source which confirms this?

I'm just not sure I trust them to be quite honest.

Re:WTF?

[AmiMoJo]

There is nothing to see here. The malware doesn't get root. It's just a normal app that simulates shutdown, like those lame joke apps we used to write back in the day that mimic the DOS format command output or Netware login screen. The user has to be simultaneously knowledgeable enough to enable app installation from sources other than Play and extremely dumb to install an app requiring so many permissions and from a dubious source.

The malware doesn't do anything a normal app can't. No exploits, it just makes the screen completely black and starts sending text messages (which the user gave it permission to do), while hoping you don't press the home key and discover the ruse.

Re:Don't be silly

[blackest_k]

I think its fair to say that it takes a user to install it first, linux has pretty much always had trustworthy repositories, Google not so much.

I love some of the things you can add to chrome but there seems to be little to no security checking of what an app or extension does. That does worry me.

Re:Fuck off.

[Anonymous Coward]

yes actually, but the NSA has been caught doing the last few times in a row, its not ignorant ot make that assumption.

With a track history like the NSAs, it's not even an assumption. It's more like a statistical certainty.