Vulnerabilities / Threats

2/19/2016
03:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Trojan Xbot A Swiss-Army Knife Of Malicious Features

Malware can steal banking and card info, encrypt SD cards, intercept messages and more, say researchers at Palo Alto Networks

The creators of a new Android Trojan dubbed Xbot that has begun targeting victims in Australia and Russia appear to have throw in everything but the kitchen sink into the malware.

Security vendor Palo Alto Networks, which sounded the alert on it this week, described Xbot as capable of taking a variety of malicious actions, including stealing banking credentials and credit card data, remotely locking Android devices, encrypting data on external storage, and asking for ransom.

Xbot can also steal SMS messages and contact information from Android devices that it infects, intercept SMS messages before they hit the device, and extract the mobile transaction authentication numbers that banks sometimes require when logging into accounts.

So far, the malware appears to be targeting only Android users in Australia and Russia. The phishing pages that Xbot uses to try and trick victims into sharing bank account information and credit card data are designed to spoof the login pages of mobile apps belonging to seven major banks, six of which are based in Australia.

But the manner in which it is designed and the fact that new features are still being added to the malware suggest that Xbot can be easily repurposed to attack other targets, Palo Alto said. According to security researchers at the company, the malware could soon pose a problem for Android users everywhere.

Once installed on a system, Xbot connects with a command-and-control server and launches phishing attacks when a user interacts with Google Play or any of the banking apps on its target list. The pages are very convincing-looking fakes of the real Google Play interface for collecting card information and of the login pages of the banks.

The remote command-and-control server is designed to send a variety of instructions to Xbot, including those that ask the malware to turn the device into silent mode to change its password and to encrypt data on the phone’s external storage devices, like an SD card. The malware can serve up a ransom note and prevent users from exiting the screen. Though the note claims the encryption is unbreakable, in reality it can be easily overcome, the Palo Alto researchers said.

Like many other malware samples floating in the wild, Xbot too borrows its design and behavior from previous malware tools. The security researchers believe that Xbot is a successor to Aulrin, an equally nasty piece of malware that first surfaced in 2014 and featured many of the same capabilities present in Xbot. “The earliest sample of Xbot we found was compiled in May 2015 and while comparing Xbot to Aulrin, it seemed to us the author re-wrote Aulrin using a different language and framework,” Palo Alto researchers Cong Zheng, Zhi Xu and Claud Xiao said in their alert.

In the process, the author or authors of Xbot have also made it more complex, the researchers said. For example, the most recent versions of Xbot integrate an obfuscation tool called Dexguard that is legitimately used to prevent Android apps from being reverse-engineered.

For the moment at least, it is not entirely clear how Xbot is being distributed. But samples of it have been seen on a handful of URLs for several months, the researchers said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18913
PUBLISHED: 2019-03-21
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location with...
CVE-2018-20031
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2018-20032
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon t...
CVE-2018-20034
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2019-3855
PUBLISHED: 2019-03-21
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.