Researchers Identify New Android Spyware That Can Steal Data and Record Audio.Google Announces Client-Side Encryption for Gmail Corporate Users.Iranian Atomic Energy Agency Hit by Hackers Stolen Data Gets Distributed Internationally.Researchers have not shared any info on the malware's distribution methods, but taking into account that the malware has a Chinese name and that there's no Play Store in China, the malware's authors may be distributing the malicious app via third-party stores and links on Android app forums. A theory for this design choice would be that attackers are collecting private conversations, images, and videos, in an attempt to identify sensitive data that they could later leverage in extortion attempts, especially against high-profile victims. It is strange that Android malware only comes with one single functionality, that to extract and exfiltrate IM data. For example, the malware uses anti-emulator and debugger detection techniques to evade dynamic analysis, and also hides strings inside its source code to thwart lackadaisical code reversing attempts. Trustlook researchers say that despite the singular focus on stealing IM data, the malware uses a few advanced evasion techniques. Simple features, but advanced evasion techniques Researchers spotted the malware inside a Chinese app named Cloud Module (in Chinese), with the package name. The malware retrieves the IP of this server from a local configuration file.įacebook Messenger, Skype, Telegram, Twitter, WeChat, Weibo, Viber, Line, Coco, BeeTalk, Momo, Voxer Walkie Talkie Messenger, Gruveo Magic Call, TalkBox Voice Messenger Second, the malware can extract data from the following Android IM clients, data that it will later upload to a remote server. The code will attempt to modify the "/system/etc/install-recovery.sh" file, which if successful, would allow the malware execute with every boot. The first is to gain boot persistence by unpacking code from an infected app's resources. This new trojan is quite simple in its design, researcher from cyber-security firm Trustlook said in a report published on Monday.
Security researchers have found a new Android malware strain that has been designed to steal data from mobile instant messaging clients.
0 kommentar(er)
