Kaspersky Lab’s researchers have discovered that more and more cyber criminals are turning their attention to malicious software that is mining cryptocurrencies at the expense of users’ mobile devices.Learn more >
While observing the activity of several cybercriminal groups, Kaspersky Lab researchers have spotted unusual activity in a malicious script, on an infected website, which is putting Android users at risk. The script usually activates the download of Flash exploits, to attack Windows-users. However at some point it has been changed so it can check the type of device its victims are using, searching specifically for Android version 4 and older. Spotting the danger, Kaspersky Lab experts decided to delve deeper.
Infecting an Android device is much harder for criminals then infecting a Windows PC. The Windows OS - and a lot of widespread applications for it – contains vulnerabilities that allow malicious code to be executed without any interactions with a user. This is not generally the case with the Android OS, as any application installation requires confirmation from the owner of an Android device. However, vulnerabilities in the OS can be exploited to bypass this restriction. And, as our researchers discovered during their investigation, this does happen.
The script is a set of special instructions for execution in the browser, embedded in the code of the infected website. The first script was discovered while it was looking for devices operating on the old versions of Android OS. Two more suspicious scripts were also detected subsequently. The first one is able to send an SMS to any mobile number, while the other creates malicious files on the SD-card of the attacked device. That malicious file is a Trojan, and it has the ability to intercept and send SMS messages. Both malicious scripts are able to perform actions independently from the Android user: you would only need to occasionally visit an infected website, to be compromised.
This was made possible because cybercriminals have utilized exploits to several vulnerabilities in Android versions 4.1.x and older - CVE-2012-6636, CVE-2013-4710 and CVE-2014-1939 in particular. All three vulnerabilities were patched by Google between 2012 and 2014; but the risk of their exploitation still exists. For example, because of the Android ecosystem characteristics, many vendors producing Android-based devices are releasing the necessary security updates too slowly. Some don’t release updates at all because of the technical obsoleteness of a particular device model.
“The exploitation techniques we’ve found during our research were nothing new but borrowed from proof of concepts, previously published by white hat researchers. This means that vendors of Android devices should account for the fact that the publication of PoCs would inevitably lead to the appearance of “armed” exploits. Users of these devices deserve to be protected with corresponding security updates, even if the devices are no longer being sold at the time,” - said Victor Chebyshev, security expert at Kaspersky Lab.
In order to protect yourself from drive-by attacks, Kaspersky Lab experts advise the following:
- Keep your Android-based device software up-to-date by enabling the automatic updates function;
- Restrict the installation of applications from alternative sources to Google Play, especially if you’re managing a collection of devices used in corporate networks;
- Use a proven security solution. Kaspersky Internet Security for Android and Kaspersky Security for Mobile with Mobile Device Management are capable of detecting changes on the SD-card of device in real time, and thus protects users against the drive-by attacks described above.
Read more about drive-by attacks against Android-based devices on Securelist.com
Articles related to Virus News
Kaspersky Lab DDoS Intelligence quarterly report: amplification attacks and old botnets make a comeback
Kaspersky Lab has published its report looking at botnet-assisted DDoS attacks for the first quarter of 2018Learn more >
Kaspersky Lab researchers have discovered a new variant of the SynAck ransomware Trojan using the Doppelgänging technique to bypass anti-virus security by hiding in legitimate processes.Learn more >