Security researchers at NQ Mobile say they have found the first piece of Android bootkit malware
Researchers at NQ Mobile have uncovered what they say may be the first Google Android bootkit.
Dubbed DKFBootKit, the malware was spotted on third-party app stores. It originated in China, something it has in common with 31 percent of mobile malware, notes Xuxian Jiang, NQ Mobile's chief scientist. In the past two weeks, DKFBootKit has infected more than 1,657 Android devices, he says.
"DKFBootKit is able to steal personal information from user devices," says Jiang. "More alarmingly, it is a bot client that can retrieve and run commands from remote C&C [command and control] servers."
DKFBootKit repackages legitimate apps by enclosing its own malicious payloads in them, according to the company. The apps are typically utility applications that require root privileges to work properly, such as the applications that provide license keys for some premium applications.
"Based on our study, DKFBootKit adds a common background service to victim apps, which once run will release a hidden executable program," NQ Mobile noted in an advisory on the malware. "This hidden program will check whether it has the root privilege. If not, it terminates itself. Otherwise, it mounts the system partition as writable, copies itself into the /system/lib directory, replaces several commonly-used utility programs (e.g., ifconfig and mount), and alters related daemons (e.g., vold and debuggerd) and bootstrap-related scripts."
The purpose seems to be to allow it to run before the Android framework is initialized to start other apps, according to NQ Mobile.
"It's worth mentioning that because DKFBootKit utilizes the root privilege, it can execute arbitrary commands," according to the advisory. "We are still in the process of actively monitoring DKFBootKit C&C servers. An initial investigation of these C&C servers show(s) that the related domains were registered in January, 2012."
NQ Mobile advises Android users to avoid downloading applications from untrusted sources, and to stay alert for unusual behavior.
"Given the complex nature of the malware, we expect to see more attacks around the world," Jiang says.
Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024