TheAndroid.DDoS.1.origin, a new malware detected on Android mobile

In line with expectations a new cyber threat is menacing the mobile, in particular the most diffused OS, Android. The Russian anti-virus vendor Doctor Web has detected a new malware, dubbed TheAndroid.DDoS.1.origin, that target Android mobile allowing the attacker to carry out mobile denial of service attacks.

Currently is not known how the trojan has infected mobile devices but security experts believe that it appears to disguise itself as a legitimate Google Play, adopting a social engineering technique.

The malicious code is very cunning, it works silently in background, hidden to the mobile user, and once the victim has been infected it contacts the Command & Control server communicating a series of information on the devices such as its phone number. The phone number is used by hackers to send commands to the device via SMS.

TheAndroid.DDoS.1.origin malware creates an icon on the desktop equal to the Google Play one, when user clicks on it the malicious code is executed, but the shortcut also opens the legitimate Google Play in order to avoid raising any suspicion.

android_ddos2

One of the principal features of the malware is its capability to transform the mobile device in a bot to conduct DDoS attack, once the C&C server send to the phone the DDoS command , TheAndroid.DDoS.1.origin starts to flood the target address with data packets.

Doctor Web blog post states:

“Activities of the Trojan can lower performance of the infected handset and affect the well-being of its owner, as access to the Internet and SMS are chargeable services. Should the device send messages to premium numbers, malicious activities will cost the user even more.“

Another monetization schema implemented by criminals consists to sending out SMS messages to certain numbers to sign up the victim for premium mobile services, SMS can be sent to premium rate numbers charging the fraudsters’ wallet.

To avoid similar cyber threat it is fundamental that mobile users follow few simple best practices such as never jailbreak the phone neither download applications from third part Appstore and of course install a security software also on the mobile. Another valid suggestion for user is to be sure of the content he download verifying its reputation controlling app rating and user reviews, and of course be aware of any request the apps make asking for various permissions.

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.