After the recent warning regarding spyware being sold by Italian company Hacking Team which can compromise iOS device, whether jailbroken or not; it was recently found that Google Play also under attack by the same Italian company.
The fake news app was downloaded up to 50 times before it was removed from Google Play on July 7.
The “BeNews” app is a backdoor app that uses the name of defunct news site “BeNews” to appear legitimate. Trend Micro found the backdoor’s source code in the leak, including a document that teaches customers how to use it.
Based on these, Trend Micro believes that the Hacking Team provided the app to customers to be used as a lure to download RCSAndroid malware on a target’s Android device.
The backdoor, ANDROIDOS_HTBENEWS.A, can affect, but is not limited to, Android versions starting from 2.2 Froyo to 4.4.4 KitKat.
Looking into the app’s routines, the app can circumvent Google Play restrictions by using dynamic loading technology. Initially, it only asks for three permissions and can be deemed safe by Google’s security standards as there are no exploit codes to be found in the app. However, dynamic loading technology allows the app to download and execute a partial of code from the Internet. It will not load the code while Google is verifying the app but will later push the code once the victim starts using it.
The source code of the backdoor and its server among the Hacking Team dump. The document labeled “core-android-market-master.zip” includes detailed instructions on how customers can manipulate the backdoor as well as a ready-made Google Play account they can use.
With the proliferation of efforts similar to Hacking Team’s, end users need to stay alert for updates on the security front. This includes the mobile landscape as well.
facebook
twitter
google+
fb share