New Android Virus from China?

[Flipper]

At the company I work for, an email came out from our Care group that I thought everyone might find interesting. When I first read it, I immediately thought of the MIUI ROM from China that I recently installed....

"A new virus infecting the android based phones has been detected in china.It is being said that this is by far the most complicated and sophisticated Android virus that the security firm has come across.This virus is being dubbed as

 

[Rob]

Thanks for pointing this out. I think we actually covered this on Phandroid December 29th:
New Android Trojan Found | Android Phone Fans

It was brought public by Lookout Mobile Security in this blog post:
The Official Lookout Blog | Security Alert: Geinimi, Sophisticated New Android Trojan Found in Wild

Personally, I only download things from the Market that are proven, have a bunch of downloads, and comments seem to be generally positive. There's a lot to be said for power in numbers but yeah... people definitely need to be continually cautious.

Thanks for the info!

 

[AmneonX]

Thanks for pointing this out. I remember reading alittle on phandroid.com, however did not think much of it. I downloaded AVG to my phone a while back, and I hope that it continues to protect me.

 

[lordofthereef]

Whenever I see a post like this I don't know what to believe. I know there are a plethora of respected posters on this forum that seem to practically swear that android can't be hit by a virus like this since the user would need to permit it to happen. Is that statement BS? Just want to know what to believe!

 

[EarlyMon]

I think the takeaway is that malware is a problem anywhere.

Viruses are a class of that self-replicate.

This is a Trojan - it appears to be one thing, but it's another.

The distinction isn't philosophical or minor. Viruses are theoretically possible for any OS, but better *nix systems tend to be hardened against them by design.

Trojans are another matter. The reason that understanding the differences in these malware classes is of vital importance comes down to your first line of defense - user awareness.

That means recognizing that it can happen and what steps you can take to prevent it. Because these aren't self-replicating, their infection vector is the user granting permission.

What can you do?

1. Scruntinize the permissions of any app before installation.
2. Always Google for any app name before download, but add this term to your search: +malware
3. Always check the source of the company or website providing the app. In the Market, the dev's website is given - google for this term: whois www.dev-site-name.whatever - and look at the ownership or the source.
4. Consider rooting and installing DroidWall, the Android firewall. You know from Windows experience that firewalls aren't a lot - but sometimes they can make all of the difference. Don't allow outside requests in and scrutinize outgoing traffic.
5. Install ad blocker.
6. Ask in this forum if anyone's heard of the app and if they report positively. Ask if they've experienced any odd behavior, such as battery use or network lags since installing an app that you've never heard of and can't find in the press.
7. Deny application permission to track your location.
8. Deny your web browser the ability to store your passwords.
9. Never download an app from the internet - especially one you trust but think you're getting to save a buck. It can contain a payload as a reward for your greed at attempting to thwart copyrights and a righteous dev. This happens to be the popular infection vector for this particular Trojan, per Rob's post.
10. Never accept anything from the internet that you didn't initiate. This includes turning off your web popups and never opening attachments without knowing their content ahead of time, even if emailed from friends.

That's my Top Ten list for safety on any system.

 

[Flipper]

Whenever I see a post like this I don't know what to believe. I know there are a plethora of respected posters on this forum that seem to practically swear that android can't be hit by a virus like this since the user would need to permit it to happen. Is that statement BS? Just want to know what to believe!

Totally understand and couldn't agree more. I actually work for one of the big four carriers and although I don't work in customer care, this was forwarded to me by a guy who manages one of our call centers and stated that more and more people are calling, claiming that a "virus" has infected their phone. Escalation and investigation are continuing but he did say that the calls are on the rise with the center he manages.

Now, is it this new virus that everyone is calling about? Who knows? It was pointed out to me on XDA that the above story was also printed on MSNBC a while back so maybe there's just some paranoia going on.

I have to admit that before i read this story, I was freely downloading and installing any app outside of the market that I found on the internet that someone recommended or suggested and provided a link for. Reading this story will make me reconsider my actions.

 

[Flipper]

What can you do?

1. Scruntinize the permissions of any app before installation.
2. Always Google for any app name before download, but add this term to your search: +malware
3. Always check the source of the company or website providing the app. In the Market, the dev's website is given - google for this term: whois www.dev-site-name.whatever - and look at the ownership or the source.
4. Consider rooting and installing DroidWall, the Android firewall. You know from Windows experience that firewalls aren't a lot - but sometimes they can make all of the difference. Don't allow outside requests in and scrutinize outgoing traffic.
5. Install ad blocker.
6. Ask in this forum if anyone's heard of the app and if they report positively. Ask if they've experienced any odd behavior, such as battery use or network lags since installing an app that you've never heard of and can't find in the press.
7. Deny application permission to track your location.
8. Deny your web browser the ability to store your passwords.
9. Never download an app from the internet - especially one you trust but think you're getting to save a buck. It can contain a payload as a reward for your greed at attempting to thwart copyrights and a righteous dev. This happens to be the popular infection vector for this particular Trojan, per Rob's post.
10. Never accept anything from the internet that you didn't initiate. This includes turning off your web popups and never opening attachments without knowing their content ahead of time, even if emailed from friends.

That's my Top Ten list for safety on any system.

Thanks for the tips. Based on your list, I just installed droidwall.

 

[IOWA]

Thanks for pointing this out. I think we actually covered this on Phandroid December 29th:
New Android Trojan Found | Android Phone Fans

It was brought public by Lookout Mobile Security in this blog post:
The Official Lookout Blog | Security Alert: Geinimi, Sophisticated New Android Trojan Found in Wild

Personally, I only download things from the Market that are proven, have a bunch of downloads, and comments seem to be generally positive. There's a lot to be said for power in numbers but yeah... people definitely need to be continually cautious.

Thanks for the info!

Agreed on all points. It also displays what permissions apps use right in the market before you download.

For rooted users, you can use Droidwall to block any suspicious apps (I don't download them anyways, but it allows me to keep angry birds without fear of data mining. =P)

You can also download the Android SDK and watch in Logcat to see EXACTLY what the app is doing. If you see a wallpaper app (why do people download wallpaper apps??? ) Accessing your contacts/sms/cookies.. well.. probably a bad app eh?

 

[mrspeedmaster]

You can also download the Android SDK and watch in Logcat to see EXACTLY what the app is doing. If you see a wallpaper app (why do people download wallpaper apps??? ) Accessing your contacts/sms/cookies.. well.. probably a bad app eh?

Yeah, logcat is pretty much essential. I use it to debug my phone; finding bugs in lots of apps (especially in all the HTC Sense apps).

Unfortunately, I feel like my phone is always tethered to the SDK.

 

[EarlyMon]

aLogcat, free, and email yourself the logs.