Beware DKFBootKit
Another week, another story of potentially major Android malware out in the wild. The latest batch comes to us courtesy of Dr. Xuxian Jiang a professor at North Carolina State University and the chief scientist for NQ Mobile. The new malware strain is known as “DFKBootkit” and is described by Jiang as “the closest attempt by malware authors to create a full-fledged bootkit on Android.” NQ says the malicious code has already infected 1,657 Android devices in the past two weeks and has appeared on at least 50 different mobile apps. Here’s NQ’s brief description of how the malware works:
Based on our analysis, DKFBootKit repackages legitimate apps by enclosing its own malicious payloads in them. However, the victim apps it chooses to infect are utility apps which require the root privilege to work properly. In the samples we analyzed, the infected apps range from ones managing apps installed on the phone, unlocking popular games, to others providing the license keys for some (premium) paid apps. These apps seem to have legitimate reasons to request root privilege for their own functionality. It is also reasonable to believe that users will likely grant the root privilege to these apps. However, DKFBootKit makes use of the granted root privilege for other malicious purposes, namely comprising the system integrity. We believe DKFBootKit is much more stealthy than the earlier DroidKungFu variants, which rely on existing exploits to gain root privilege. In the following, we show a screenshot of one DKFBootKit-infected sample that intends to provide the license key for a paid version of ROM management app.
Eep.
In order to avoid being infected by this beast, NQ recommends three commonsense steps: First, don’t download any apps from sketchy app stores; second, don’t accept app permissions from unknown sources and always be sure to read the permissions an app is requesting; and third, download a security app that can scan your apps for you to search for malicious code.
Here’s a link to the full report if you’re interested in wading into more of the details.
