Android Trojaner unterwegs …

Schon gestern las ich die Meldungen, dass einige Apps in den Market gelandet sein sollen, in denen ein Trojaner / Malware versteckt war. Allerdings habe ich gestern noch nicht an diesen Umfang geglaubt. Getarnt mit dem Namen und der Optik von Super Guitar Solo erschien beispielsweise die App Guitar Solo Lite im Market, die dann die schadhafte Software enthielt.

Google benötigte über eine Woche Reaktionszeit um auf Mails des Entwicklers hin die schadhafte App aus dem Market zu entfernen, nachdem dieser über Crashlogs der infizierten App informiert wurde, dass etwas nicht stimmt.

Die infizierten Apps sollen dabei die IMEI und IMSI der betroffenen Geräte an einen Server gesendet haben. Leider wurde auch ein versteckter Code entdeckt, der Inhalte aus dem Netz nachladen konnte und so ist nicht sichergestellt, was dort dann noch an schadhaftem Code runtergeladen wurde und damit übertragen oder angerichtet wurde.Die ganzen Apps erschienen unter drei verschiedenen Publishern im Market und müssten in der folgenden Liste von Symantec aufgelistet sein:

Publisher:
kingmall2010
Apps:

• 掷骰子 Version 2.4.1
• 多彩绘画 Version 1.2
• Advanced App to SD Version 1.0.1
• Magic Strobe Light Version 1.0.1
• Advanced Compass Leveler Version 1.1.1
• Super Stopwatch & Timer Version 4.3
• Sexy Legs Version 1.0.01
• Sexy Girls: Japanese Version 1.0
• Bowling Time Version 1.8
• 软件强力卸载 Version 4.2
• Music Box Version 2.5
• Best password safe Version 1.0.5
• 墨水坦克Panzer Panic Version 1.0.0
• 裸奔先生Mr. Runner Version 1.0
• Hot Sexy Girls Version 1.0
• Super sex sound Version 1.3
• 致命绝色美腿 Version 1.0.01
• Super Bluetooth Transfer Version 2.30.1
• Advanced File Manager Version 1.1.0
• Advanced Barcode Scanner Version 1.0.1
• Task Killer Pro Version 1.0.1

Publisher:
myournet
Apps:

• Spider Man Version 1.29
• 蜘蛛侠 Version 1.29
• Funny Paint Version 1.2
• Dice Roller Version 2.4.1
• 躲避弹球 Version 2.0.9
• Falling Ball Dodge Version 2.0.9
• Photo Editor Version 3.1.1
• Chess Version 2.6.1
• APP Uninstaller Version 1.6.0
• 几何战机_PewPew Version 1.5.3
• 下坠滚球_Falldown Version 1.0
• Falling Down Version 1.0
• Screaming Sexy Japanese Girls Version 1.0
• Hot Sexy Videos Version 0.1.10
• Super History Eraser Version 1.0.1
• Super Ringtone Maker Version 1.0.1
• Hilton Sex Sound Version 2.1.1
• Scientific Calculator Version 1.4.2
• Super Guitar Solo Version 1.0.1
• Super Sex Positions Version 1.0
• Advanced Currency Converter Version 1.0.1

Publisher:
we20090202
Apps:

• Basketball Shot Now Version 1.4.0
• Omok – Five in a Row Version 3.1.1
• Super Sexy Ringtones Version 3.1.4
• 手指赛跑 Finger Race Version 1.4.5
• Magic Hypnotic Spiral Version 2.0.0
• Quick Notes Version 2.1.1
• 投篮高手 Version 1.4.0
• Quick Delete Contacts Version 1.0
• Advanced Sound Manager Version 2.0.0
• Color Blindness Test Version 2.1.1

Anscheinend wurden die Apps schon vom Market gelöscht und angeblich auch per Remote-Wipe von den Endgeräten. Dennoch könnte die obige Liste zur Kontrolle oder zur Bestätigung helfen.

Hier noch eine Übersicht über die bisherigen Feststellungen aus meiner Quelle von vor einem Tag:

Link to publishers apps here. I just randomly stumbled into one of the apps, recognized it and noticed that the publisher wasn’t who it was supposed to be.

Super Guitar Solo for example is originally Guitar Solo Lite. I downloaded two of the apps and extracted the APK’s, they both contain what seems to be the „rageagainstthecage“ root exploit – binary contains string „CVE-2010-EASY Android local root exploit (C) 2010 by 743C“. Don’t know what the apps actually do, but can’t be good.

I appreciate being able to publish an update to an app and the update going live instantly, but this is a bit scary. Some sort of moderation, or at least quicker reaction to malware complaints would be nice.

EDIT: After some dexing and jaxing (where did I get these terms..) decompiling the code (with dex2jar and JD-GUI), the apps seem to be at least posting the IMEI and IMSI codes to ,which seems to be located in Fremont, CA.

EDIT2: The apps are also installing another embedded app (hidden as assets/sqlite.db), „DownloadProvidersManager.apk“. Not sure what it does yet on top of monitoring what apps the user installs.

EDIT3: I just received a reply to an e-mail I sent out to one of the developers affected:

„Yes, thank you, I was aware of it. I have been trying for more than a week now to get Google to do something about it. I’ve contacted them through every avenue I could think of, but haven’t had a response yet…until today. It seems the developer and all his apps have been removed from the market“

So Reddit seems to be Google’s preferred customer feedback channel ;-)

EDIT4: As noted in the comments below, the developer account and the apps have been removed from the market, and the links to the apps above do not work anymore. Also I’d like to give credit to the devs at Teazel for helping in identifying the exploit yesterday.

EDIT5: Some are asking whether something they installed and uninstalled a while back might have been one of the bad apps. According to Lookout Mobile Security these malicious apps were published on two additional dev accounts on top of the one I spotted. All three accounts have been wiped from the market, but info on the apps is still available on Appbrain: Myournet, Kingmall2010 and we20090202. Kingmall2010’s account seems to be the oldest of the bunch, according to Appbrain it started publishing around Feb 11th. The other two around Feb 23rd. So find the app from Appbrain on those accounts and check the publishing date. As for what to do if you know you’re infected – I’m hoping docgravel / Lookout can provide some insight soon. Check the comments.

EDIT6: Looking at the download counts for all three accounts on Appbrain. They’re lagging behind the real counts, as they don’t update daily, so when the Market’s real download counts for Myournet yesterday totalled at 50k-200k, Appbrain is only totalling to 10k to 35k. Even so, adding Kingmall2010’s download counts from Appbrain (48k to 224k) to those I nabbed from myournet’s account on Market yesterday brings the total downloads to 98k to 424k. And that estimate is probably on the low side.

EDIT7: Symantec: „If users feel that they may have installed one of these apps, they should also check com.android.providers.downloadsmanager (DownloadManageService) in the “running services“ settings of the phone“