Security boffins brew devilish Android rootkit
Experimental vileware turns your mobe into a TRAITOR
Computer scientists have identified a weakness in the Android mobile operating system that allows users to be tricked into silently installing hidden malware.
A research team led by Xuxian Jiang at North Carolina State University discovered that they could redirect a fandroid's touchscreen taps - a technique known as clickjacking - to inject a rootkit that can evade detection and maliciously alter the operation of the device.
Xuxian was able to develop a "proof-of-concept prototype rootkit that attacks the Android framework, rather than the underlying operating system kernel". The vulnerability was uncovered during a more general study into the security measures, or lack of, in various smartphone platforms.
The rootkit, which could be bundled with an app and is said to be undetectable by anti-virus packages, would allow an attacker to replace a smartphone's browser with a version that logs key strokes to capture bank card data and uploads them to a hacker-controlled website. The malign technology can hide or replace any or all of the apps on a smartphone, as illustrated in this video:
The clickjacking vulnerability is present in Android 4.0.4 (Ice Cream Sandwich) and earlier versions of the smartphone OS. The mechanism - described as a "user interface readdresing attack" - means the malware can be installed by a user thinking he or she is agreeing to some other action and without a reboot. No privilege escalation is needed, nor any nobbling of the operating system's core kernel.
"This would be a more sophisticated type of attack than we’ve seen before, specifically tailored to smartphone platforms," Xuxian explained in a NCSU blog post about the work. "The rootkit was not that difficult to develop, and no existing mobile security software is able to detect it."
"Now that we’ve identified the problem, we can begin working on ways to protect against attacks like these," he added. Xuxian is founder of the Android Malware Genome Project, a collaborative research effort into existing Android malware, launched in late May. ®
Re: Was Mr Xuxian's research
Well if it was, I doubt they would broadcast it all over the bloody Internet.
Chinese name != Commie terrorist (although Fox news would have you believe otherwise)
Re: These thingies are called "smart phones" ...
So if someone had been educated without computers, had a PHD in mathematics and had never used a smartphone, used one for the first time but ran a trojan then you would call them stupid?
This is nothing to do with intelligence, this is all about trust levels and experience of the device you are using. The person who has never used a device before won't know what is a normal prompt and what is a dubious one. If anything, Android's differing GUI front ends makes this a little more likely as there isn't one uniform interface.
... which is why...
It's a FAIL to use your smartphone to enter banking details, credit card numbers etc.
Any data which could potentially be used to defraud you - whether via rootkit, or losing your phone (or having it nicked) - should *never* be there in the first place.
Small transactions - sure, fine. Login to an App store, coupla quid, no information about your banking details should ever change hands in these transactions - unless your signing up - which shouldn't be done on your phone :)
Yes, I'm paranoid - it's *real* easy to lose a phone. It's also *real* easy for people to wijack you, unless your aware.