Following our initial post on the discovery of Android.Bgserv, Symantec has found additional Trojanized samples in the wild. After analysis of these new samples, it appears that the applications contain multiple bugs. In the case of the Trojanized version of Google’s Security Tool, we have confirmed after testing (with no surprise) that it does not have the ability to clean a system infected with Android.Rootcager.
The Trojanized applications also contain code to change an infected device’s APN settings. The screenshot below belongs to the threat code responsible for changing them. However, in our research we have not been able to identify the code being called at any time.
Our research also shows that even if this APN change code was called, the application's permissions would not allow the requested changes to take place. This can be seen in the screenshot below, showing the Trojanized application's manifest:
An application willing to change the APN settings is required to hold the “android.permission.WRITE_APN_SETTING” permission. We have also found some other pieces of interesting code within the threat that seem to be dormant. One example of this is seen in the screenshot below:
The purpose of this code seems to be to block incoming calls from specific telephone numbers. In this case, the telephone numbers in question seem to belong to a major Chinese telecom operator's customer care service.
Below is an image showing the command-and-control (C&C) server that is being used by this threat and an example of the information that is posted to the C&C server. At the time of writing, the C&C server was live but not serving commands.
Our overall analysis of this threat has shown it to be a potentially worrying threat. However, the threat's perpetrators have failed to fully implement all of the functionality within the infected applications, thereby lessening its potential impact as a threat.
Here are a few tips that may help to identify whether or not a device has been infected with Android.Bgserv. The legitimate Android Security tool was automatically pushed to infected users and did not require manual download. Also, it does not show up within the application menu, as opposed to the malicious one:
We can see the malicious service that has been started by the Trojanized tool running in the background as “BgService”:
Finally, to avoid becoming a victim of such malicious Android applications, we recommend that you only use regulated Android marketplaces for downloading and installing Android applications. Also, in the Android OS application settings there is an option to stop the installation of non-market applications, which can help to prevent against this type of attack. Checking user comments on the marketplace can also assist in determining if the application is safe. Lastly, always check the access permissions being requested during the installation of any Android applications. If they seem excessive for what the application is designed to do, it would be wise to stop installing the application.
Note: Special thanks to Irfan Asrar for all his input into this blog.