Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

2/19/2016
03:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Trojan Xbot A Swiss-Army Knife Of Malicious Features

Malware can steal banking and card info, encrypt SD cards, intercept messages and more, say researchers at Palo Alto Networks

The creators of a new Android Trojan dubbed Xbot that has begun targeting victims in Australia and Russia appear to have throw in everything but the kitchen sink into the malware.

Security vendor Palo Alto Networks, which sounded the alert on it this week, described Xbot as capable of taking a variety of malicious actions, including stealing banking credentials and credit card data, remotely locking Android devices, encrypting data on external storage, and asking for ransom.

Xbot can also steal SMS messages and contact information from Android devices that it infects, intercept SMS messages before they hit the device, and extract the mobile transaction authentication numbers that banks sometimes require when logging into accounts.

So far, the malware appears to be targeting only Android users in Australia and Russia. The phishing pages that Xbot uses to try and trick victims into sharing bank account information and credit card data are designed to spoof the login pages of mobile apps belonging to seven major banks, six of which are based in Australia.

But the manner in which it is designed and the fact that new features are still being added to the malware suggest that Xbot can be easily repurposed to attack other targets, Palo Alto said. According to security researchers at the company, the malware could soon pose a problem for Android users everywhere.

Once installed on a system, Xbot connects with a command-and-control server and launches phishing attacks when a user interacts with Google Play or any of the banking apps on its target list. The pages are very convincing-looking fakes of the real Google Play interface for collecting card information and of the login pages of the banks.

The remote command-and-control server is designed to send a variety of instructions to Xbot, including those that ask the malware to turn the device into silent mode to change its password and to encrypt data on the phone’s external storage devices, like an SD card. The malware can serve up a ransom note and prevent users from exiting the screen. Though the note claims the encryption is unbreakable, in reality it can be easily overcome, the Palo Alto researchers said.

Like many other malware samples floating in the wild, Xbot too borrows its design and behavior from previous malware tools. The security researchers believe that Xbot is a successor to Aulrin, an equally nasty piece of malware that first surfaced in 2014 and featured many of the same capabilities present in Xbot. “The earliest sample of Xbot we found was compiled in May 2015 and while comparing Xbot to Aulrin, it seemed to us the author re-wrote Aulrin using a different language and framework,” Palo Alto researchers Cong Zheng, Zhi Xu and Claud Xiao said in their alert.

In the process, the author or authors of Xbot have also made it more complex, the researchers said. For example, the most recent versions of Xbot integrate an obfuscation tool called Dexguard that is legitimately used to prevent Android apps from being reverse-engineered.

For the moment at least, it is not entirely clear how Xbot is being distributed. But samples of it have been seen on a handful of URLs for several months, the researchers said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5798
PUBLISHED: 2019-05-23
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVE-2019-5799
PUBLISHED: 2019-05-23
Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2019-5800
PUBLISHED: 2019-05-23
Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2019-5801
PUBLISHED: 2019-05-23
Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVE-2019-5802
PUBLISHED: 2019-05-23
Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.