Vulnerabilities / Threats
2/19/2016
03:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Trojan Xbot A Swiss-Army Knife Of Malicious Features

Malware can steal banking and card info, encrypt SD cards, intercept messages and more, say researchers at Palo Alto Networks

The creators of a new Android Trojan dubbed Xbot that has begun targeting victims in Australia and Russia appear to have throw in everything but the kitchen sink into the malware.

Security vendor Palo Alto Networks, which sounded the alert on it this week, described Xbot as capable of taking a variety of malicious actions, including stealing banking credentials and credit card data, remotely locking Android devices, encrypting data on external storage, and asking for ransom.

Xbot can also steal SMS messages and contact information from Android devices that it infects, intercept SMS messages before they hit the device, and extract the mobile transaction authentication numbers that banks sometimes require when logging into accounts.

So far, the malware appears to be targeting only Android users in Australia and Russia. The phishing pages that Xbot uses to try and trick victims into sharing bank account information and credit card data are designed to spoof the login pages of mobile apps belonging to seven major banks, six of which are based in Australia.

But the manner in which it is designed and the fact that new features are still being added to the malware suggest that Xbot can be easily repurposed to attack other targets, Palo Alto said. According to security researchers at the company, the malware could soon pose a problem for Android users everywhere.

Once installed on a system, Xbot connects with a command-and-control server and launches phishing attacks when a user interacts with Google Play or any of the banking apps on its target list. The pages are very convincing-looking fakes of the real Google Play interface for collecting card information and of the login pages of the banks.

The remote command-and-control server is designed to send a variety of instructions to Xbot, including those that ask the malware to turn the device into silent mode to change its password and to encrypt data on the phone’s external storage devices, like an SD card. The malware can serve up a ransom note and prevent users from exiting the screen. Though the note claims the encryption is unbreakable, in reality it can be easily overcome, the Palo Alto researchers said.

Like many other malware samples floating in the wild, Xbot too borrows its design and behavior from previous malware tools. The security researchers believe that Xbot is a successor to Aulrin, an equally nasty piece of malware that first surfaced in 2014 and featured many of the same capabilities present in Xbot. “The earliest sample of Xbot we found was compiled in May 2015 and while comparing Xbot to Aulrin, it seemed to us the author re-wrote Aulrin using a different language and framework,” Palo Alto researchers Cong Zheng, Zhi Xu and Claud Xiao said in their alert.

In the process, the author or authors of Xbot have also made it more complex, the researchers said. For example, the most recent versions of Xbot integrate an obfuscation tool called Dexguard that is legitimately used to prevent Android apps from being reverse-engineered.

For the moment at least, it is not entirely clear how Xbot is being distributed. But samples of it have been seen on a handful of URLs for several months, the researchers said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Janice, I think I've got a message from the code father!
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.