Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

12/2/2019
04:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

StrandHogg Vulnerability Affects All Versions of Android

The bug enables malware to pose as any legitimate Android app, letting attackers track messages, photos, credentials, and phone conversations.

A newly discovered vulnerability in the Android operating system could let attackers abuse legitimate apps to deliver malware. In doing so, they could track users without their knowledge.

Researchers with Norwegian app security company Promon dubbed the bug "StrandHogg," an old Norse term for a Viking coastal raiding tactic. A successful attacker could exploit the vulnerability to take over a legitimate application and run malicious processes without the user's knowledge. StrandHogg has already been exploited in the wild, does not need root access to run, and affects all versions of Android, including Android 10, released in September.

If successful, the vulnerability could grant attackers access to private SMS conversations, photos, and login credentials. They could track a victim's movements, make and/or record phone calls, and spy through the smartphone's camera and microphone, the experts report.

Promon researchers found StrandHogg when its customer, an Eastern European security firm, noticed a trend of money being siphoned from accounts at Czech banks. They traced the root of the problem to StrandHogg, a vulnerability that can be exploited to trick Android users into thinking they're using a legitimate app while interacting with the overlay of a malicious one.

The researchers teamed up with US security firm Lookout, which confirmed 36 malicious apps are exploiting StrandHogg. All of the 500 most popular Android apps are at risk of having their processes abused by the vulnerability. Promon CTO Tom Lysemose Hansen says the bug has been undergoing analysis throughout the spring and summer, though malicious apps could have been exploiting the flaw long before this.

Researchers determined 60 separate financial firms are being targeted with apps designed to exploit this vulnerability. Among the 36 malicious apps exploiting StrandHogg are variants of the BankBot banking Trojan, which has been seen in attacks all over the world since 2017.

How It Works
StrandHogg exists in the Android OS, specifically in the way it switches from process to process for different applications. The weakness is in Android's multitasking system, or its ability to run several apps at the same time and switch from app to app on the screen. Android control setting taskAffinity lets any app, even malicious, take on any identity in the multitasking system.

As a result, malicious apps can request any permission while pretending to be legitimate. An attack could be designed to ask for permissions that seem natural for the targeted apps. By doing this, adversaries could lower the chance of victims realizing something is wrong. Users have no indication they're granting permission to a malicious app and not the authentic one.

"If it wanted to harvest different permissions – say it wants access to SMS and doesn't have that permission when downloaded – then, for example, it can wait until the end user clicks the SMS app and, at that point, take control, ask the user to give permissions, and as the end user clicks the app it provides those permissions," says Hansen. "The end user would believe he gave [permissions] to the SMS app ,but [he] really gave it to the malware app."

(Image: Promon)

(Image: Promon)

The malicious applications exploiting StrandHogg don't directly come from Google Play. Victims have to first download the legitimate application, which serves as a dropper to download future malware, Hansen explains. When the user taps the icon of a legitimate app, the interface of a malicious app instead appears on screen to request permissions or credentials, he continues.

"Just by looking at the first app, it can be very, very difficult to see something is wrong," Hansen adds.

The malware analyzed by Promon was installed through several dropper apps and hostile downloaders distributed on Google Play, researchers explain in a blog post on their findings. While these apps have since been taken down, dropper apps continue to be published and often fly under the radar, generating millions of downloads before they're spotted and deleted.

Promon reported the bug to Google over the summer. While the affected apps have been removed, the StrandHogg has not yet been fixed for any version of Android, researchers say. After 90 days, the problem had still not been addressed.

"We appreciate the researchers work, and have suspended the potentially harmful apps they identified," a Google spokesperson said in response. "Google Play Protect detects and blocks malicious apps, including ones using this technique. Additionally, we're continuing to investigate in order to improve Google Play Protect's ability to protect users against similar issues."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "A Cause You Care About Needs Your Cybersecurity Help."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...
CVE-2020-3115
PUBLISHED: 2020-01-26
A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi...
CVE-2020-3121
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplie...
CVE-2020-3129
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker c...
CVE-2020-3131
PUBLISHED: 2020-01-26
[CVE-2020-3131_su] A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability i...