Categories: Malware

Android Oldboot ,the bootkit already infected more than 500000 devices

Russian company Doctor Web detected Android.Oldboot, an Android Trojan that resides in the memory of infected devices and starts on OS bootstrapping.

The Russian security firm Doctor Web has detected the first mass distributed Android bootkit malware dubbed Android.Oldboot, its principal capability is to re-infect the Smartphone after reboot, even if all its components are deleted by the user.

Bootkit is a category of malware which infects the host at start-up and it is able to perform malicious activities, including data stealing, disk encryption, communicate with a remote C&C server and remove the application on the victim’s device.

According the statistics published by Doctor Web, the bootkit Android.Oldboot has compromised more than 350,000 android mobile. China (92 % share) is the country with the highest number of victims, but Android.Oldboot has been detected also in China, Italy , Spain, Germany, Russia, Brazil, the USA and some Southeast Asian countries.

The blog post reveals that the authors of Android.Oldboot adopted a very smart method to inject malicious code in the Android OS, it is able to place into the boot partition. Since Android.Oldboot is installed on the boot partition, formatting the device is not sufficient to eradicate the malware.

“To spread the Trojan, which entered the Dr.Web virus database as Android.Oldboot.1.origin, attackers have used a very unusual technique, namely, placing one of the Trojan components into the boot partition of the file system and modifying the init script which is responsible for the initialisation of OS components. When the mobile phone is turned on, this script loads the code of the Trojan Linux-library imei_chk (Dr.Web Anti-virus detects it as Android.Oldboot.1), which extracts the files libgooglekernel.so (Android.Oldboot.2) and GoogleKernel.apk (Android.Oldboot.1.origin) and places them in /system/lib and /system/app, respectively. ”

Android.Oldboot operates as background daemon that opens a communication channel with the command-and-controller server using libgooglekernel.so library, is it able in this way to receive commands to remove installed apps, install malicious apps and download.

A similar malware could be used to compromise a supply chain when the device is in the manufacturing stage, attackers could in this phase distribute infected Android firmware. Another good reason to avoid to install jailbreak firmware versions.

The data related to Android.Oldboot infections are worrying, more than 500.000 Android devices were compromised in the only China in the last six months, another factor to consider is that current mobile antivirus isn’t able to completely remove this malware from the victims Smartphone.

Fortunately, it seems that the infection is limited to Chinese manufacturers,

To avoid being a victim of the Android.Oldboot malware is recommended for users to don’t install applications from third party stores, users must refer only the official Google Play to limit their exposure, it is also suggested to disable the installation of apps from ‘Unknown Sources’.

Once a device is infected the last chance for the owner is to re-flash it using an official ROM.

Pierluigi Paganini

(Security Affairs – Mobile, Android.Oldboot)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.