Pierluigi Paganini
January 30, 2014
The Russian security firm Doctor Web has detected the first mass distributed Android bootkit malware dubbed Android.Oldboot, its principal capability is to re-infect the Smartphone after reboot, even if all its components are deleted by the user.
Bootkit is a category of malware which infects the host at start-up and it is able to perform malicious activities, including data stealing, disk encryption, communicate with a remote C&C server and remove the application on the victim’s device.
According the statistics published by Doctor Web, the bootkit Android.Oldboot has compromised more than 350,000 android mobile. China (92 % share) is the country with the highest number of victims, but Android.Oldboot has been detected also in China, Italy , Spain, Germany, Russia, Brazil, the USA and some Southeast Asian countries.
The blog post reveals that the authors of Android.Oldboot adopted a very smart method to inject malicious code in the Android OS, it is able to place into the boot partition. Since Android.Oldboot is installed on the boot partition, formatting the device is not sufficient to eradicate the malware.
“To spread the Trojan, which entered the Dr.Web virus database as Android.Oldboot.1.origin, attackers have used a very unusual technique, namely, placing one of the Trojan components into the boot partition of the file system and modifying the init script which is responsible for the initialisation of OS components. When the mobile phone is turned on, this script loads the code of the Trojan Linux-library imei_chk (Dr.Web Anti-virus detects it as Android.Oldboot.1), which extracts the files libgooglekernel.so (Android.Oldboot.2) and GoogleKernel.apk (Android.Oldboot.1.origin) and places them in /system/lib and /system/app, respectively. ”
Android.Oldboot operates as background daemon that opens a communication channel with the command-and-controller server using libgooglekernel.so library, is it able in this way to receive commands to remove installed apps, install malicious apps and download.
A similar malware could be used to compromise a supply chain when the device is in the manufacturing stage, attackers could in this phase distribute infected Android firmware. Another good reason to avoid to install jailbreak firmware versions.
The data related to Android.Oldboot infections are worrying, more than 500.000 Android devices were compromised in the only China in the last six months, another factor to consider is that current mobile antivirus isn’t able to completely remove this malware from the victims Smartphone.
Fortunately, it seems that the infection is limited to Chinese manufacturers,
To avoid being a victim of the Android.Oldboot malware is recommended for users to don’t install applications from third party stores, users must refer only the official Google Play to limit their exposure, it is also suggested to disable the installation of apps from ‘Unknown Sources’.
Once a device is infected the last chance for the owner is to re-flash it using an official ROM.
(Security Affairs – Mobile, Android.Oldboot)
