Researchers have uncovered Android 2.3 malware known as “GingerMaster,” which takes advantage of a jailbreak exploit to gain root access and execute instructions from a remote server. Meanwhile, McAfee Labs says malware developers are focusing on Android more than any other platform — but adds that the number of actual threats found on smartphones in the wild remains small.

GingerMaster, a variant of the DroidKungFu malware that appeared earlier this year, has a root exploit that gives the attacker control of the infected device, Xuxian Jiang, an associate professor at North Carolina State University's department of computer science, wrote in a blog post Aug. 18. NC State researchers worked with mobile security vendor NetQin and discovered that GingerMaster wrapped malicious code around a jailbreak exploit for Android 2.3 devices.

"The GingerMaster malware is repackaged into legitimate apps," said Jiang. The applications masquerade as popular applications to encourage users to download it. The researchers also found that several mobile antivirus tools failed to detect the applications as malicious. 

Once the malicious application is downloaded and installed onto a device, it gains root privileges and transmits data to a remote server, the researchers said. The information stolen includes the user identifier, SIM card number, telephone number, IMEI number, IMSI number screen resolution and local time, according to another blog posting by Vanja Svajcer, a principal virus researcher in SophosLabs.

Downloading an app displaying these models could infect your phone

Svajcer analyzed the application, which claims to display "Beauty of the Day" pictures (above). Available from a Chinese alternative Android Market, the application requested 16 different permissions from the user upon installation, including the ones to read logs, access the Internet, write to the SD card, access the file system and access owner data.

Once installed, GingerMaster will also attempt to install a root shell into the system partition for later use. The malware also installs various utilities onto the partition, "supposedly to make removal more difficult" and for additional functionality, Svajcer said. Once a malicious process gets roots, "its powers are potentially unlimited," he said.

With control over the mobile device, GingerMaster contacts the remote command-and-control server for follow-up instructions. It can download and install applications on its own without the user's permission, Jiang found.

GingerMaster may compromise Android 2.2 and earlier devices with some adjustments, Jiang said. Even though Google has updated Gingerbread several times since it was released in December, many carriers have not yet updated their devices to the latest version of 2.3.3 or to 2.3.4. Jiang's team also found other DroidKungFu variants in alternate Android application stores that used similar root exploits for earlier versions of Android.

It's "exceptionally difficult" to gauge the impact of Android malware distributed outside the official Android market, Tim Armstrong, a malware researcher at Kaspersky Lab, told eWEEK. "Due to the fact that new variants keep arriving, we can assume there is money being made, and users being infected, or the malware authors would likely move onto other platforms," Armstrong said.

Users should avoid alternative Android Marketplaces unless they have "strong evidence" the applications are trustworthy, Svajcer recommended. Kaspersky's Armstrong pointed out that the term "alternative markets" also includes independent Websites, forums, peer-to-peer sharing sites and even email, as users can install applications from all these sources.

More importantly, users should look at the permissions list and avoid installing applications that request more than what seems reasonably necessary. GingerMaster is an application that downloads pictures from a Website, Svajcer said, adding, "Why would it need permissions such as WRITE_USER_DATA and MOUNT_UNMOUNT_FILESYSTEMS?"

Android is most-attacked mobile platform, but that still doesn't amount to much

Out of about 1,200 mobile malware samples that McAfee Labs collected and analyzed in the second quarter of 2011, about 60 percent were aimed at Android, McAfee said in its 2011 Threats Report for the second quarter [PDF link]. While mobile malware remains a tiny fraction of the overall malware market, Android is clearly the criminals' favorite target, McAfee said.

Android malware jumped 76 percent since the first quarter, according to the report. However, that number sounds bigger than it really is, as McAfeeLabs identified only 44 total Android threats this spring.

To put that figure in context, McAfee collects about 2 million new malware samples, regardless of platform, every month and found 12 million unique types of malware in the first half of 2011. Researchers expect to have 75 million samples by the end of the year.

Android "could become an increasing target for cybercriminals — affecting everything from calendar apps to comedy apps to SMS messages to fake Angry Birds updates," McAfee stated.

Attackers wouldn't be focusing on a platform if they weren't making money, and the malicious apps don't need to be that widespread to be worthwhile, Tim Armstrong, a malware researcher at Kaspersky Lab, told eWEEK. An early Android malware sample, FakePlayer Trojan, charged users $5 to $6 per SMS message it sent out. Even if only a thousand users installed the app, that's $5,000 to $6,000 going to the attacker's pocket, and "that's if the app only worked once," Armstrong noted.

Mobile platforms were under attack from "for-profit mobile malware" such as SMS-sending Trojans and smartphone exploits, researchers wrote. Malware developers are targeting Android more than Symbian and J2ME (Java Micro Edition), but the total number of Android malware still lags behind those two mobile platforms. McAfee's numbers suggest that as Symbian devices lose popularity and Android gains more mobile market share, that will soon change.

Google's Android operating system rose to 52 percent of units sold for the second quarter, according to the latest numbers from The NPD Group.

"This increase in threats to such a popular platform should make us evaluate our behavior on mobile devices and the security industry's preparedness to combat this growth," McAfee researchers wrote in the report.

As more employees use their personal Android devices at work to access corporate resources, such as email, it's imperative that enterprises be aware of the risks and take steps accordingly to protect the devices. Recently, a number of wireless carriers, including Sprint and AT&T, announced partnerships to provide mobile security offerings.

For several quarters, McAfee researchers have noticed that malware developers are focusing more on exploits targeting vulnerabilities in Adobe products rather than Microsoft products.

"This trend does not prove that Adobe's technologies are more vulnerable or have more coding bugs than Microsoft's," the report said. Adobe has one of the most popular products in the world, and criminals "target what is popular and in wide use," the researchers wrote.

Rootkits were also highly popular in the spring, as criminals used them to make other malware stealthier and more persistent. The better hidden the malware is, the longer it can engage in malicious activity, the researchers wrote. The most common encountered were Koutodoor and TDSS.

"Rootkits have seen their busiest-ever six months, up almost 38 percent over 2010," the report found.

Fahmida Y. Rashid is a writer for eWEEK.

---

This article was originally published on LinuxDevices.com and has been donated to the open source community by QuinStreet Inc. Please visit LinuxToday.com for up-to-date news and articles about Linux and open source.