Malware researchers are warning Android’s latest permission-granting model in version 6.0 Marshmallow is now targeted by Mobile malware authors
Android’s latest permission-granting model in version 6.0 Marshmallow is now reportedly being targeted by Mobile malware authors. The model will let users grant permissions only when it is required by the app, rather than accepting all on installation. Threats such as Android.Bankosy and Android.Cepsohord have already adopted this method in order to gain permission required to carry out malicious activities.
Prompting for permissions at runtime
In mobile phones running on Android 6.0 Marshmallow, apps request permissions that could pose a privacy risk at runtime and when they’re are required, instead of prompting the user for all of them at installation time.
If the app malware author forcefully sets the “target_sdk” attribute of an app to 22 in place of 23 to avoid requesting permissions at runtime, a user can then grant all requested permission at the time of the app’s installation, but users can also manually revoke permissions from any app, irrespective of the “target_sdk” values on devices running Marshmallow.
Since Marshmallow’s market share is increasing, and users are now learning to manually revoke permission, authors of malware families such as Android.Bankosy and Android.Cepsohord have now started porting their code to handle the current Android runtime permission model.
Handling of Marshmallow’s new permission model by Bankosy and Cepsohord Malware
Android.Bankosy is a well known financial Trojan which partially works with the new model by checking whether a permission is in a non-revoked state before execution of the malicious code. On the other hand, the Bankosy malware calls a special service code (*21*[DESTINATION NUMBER]#) in order to enable unconditional call forwarding on the compromised device. This feature is needed by the attacker to help conduct fraudulent transactions using the target’s information,
By using Marshmallow’s checkSelfPermission API, Bankosy’s authors updated the malware code to check whether the permission to call this number has been granted or not.
On the other hand, click-fraud malware Cepsohord takes a step ahead and fully handles the new permission model. It not only checks the permission’s authorization state but also prompts the user to authorize the permission in case it is in a revoked state.
Future of Android Malware.
Previously seen Android threats have the capability to update themselves so that they can survive new security measures on Google’s mobile operation system. Also, these threats can implement powerful social engineering, taking advantage of user lack of privacy awareness.
Mitigation
Symantec engineers recommend users keep software up to date, refrain from downloading apps from unfamiliar sites, only install apps from trusted sources, pay close attention to the permissions that apps request, install a suitable mobile security app to protect the device and data and make frequent backups of important data to stay protected from mobile threats.
Reference :
- http://www.symantec.com/connect/blogs/android-threats-evolve-handle-marshmallow-s-new-permission-model
- https://www.symantec.com/security_response/writeup.jsp?docid=2014-072316-5249-99
- https://www.symantec.com/security_response/writeup.jsp?docid=2016-051114-5305-99
Written by: Imdadullah Mohammed
Author Bio: Imdad is an Information Security Consultant, He is also a Moderator for Pune Chapter of Null – The open security community in India and Also member of Garage4hackers. A true open source and Information Security enthusiast. His core area of expertise includes Vulnerability Assessment and Penetration Testing of the Web application, Mobile application and Networks, as well as Server Hardening.
https://www.surveymonkey.com/r/secbloggerwards2016
Thank you
Pierluigi
(Security Affairs – MEDHOST, hacking)
The post Android 6.0 Marshmallow permission-granting model is under attack appeared first on Security Affairs.
