- Joined
- Jul 28, 2007
- Messages
- 3,327
- Reaction score
- 3,055
McAfee is warning Android users over a new threat to the platform following the discovery of a malware attack that targets the contact lists of infected devices.
The company said that the malware is currently disguised as a Google Play application which streams Japanese-language video game trailers. Researchers estimate that as many as 70,000 handsets may be infected.
McAfee Labs malware researcher Carlos Castillo said that the attack can be spotted by its unusual requests for data access.
"When the application is about to be installed, two suspicious permissions, read contact data and read phone state and identity, are requested. Neither is needed for the principal purpose of the application, which is to display a video from the internet," Castillo said in a blog post.
"The reason for these requests becomes clear because the first action that the malware takes when it executes is to obtain, in the background, the following sensitive information from the device without the user’s consent."
Once the user's contact information has been gathered, the malware then uploads the data to a remote server and downloads a video which is displayed in order to hide the application's malicious activities.
Castillo said that McAfee has found 15 variants on the infection to date. The detected applications have been removed from Google's app store.
Malware has been an ongoing problem on the Android platform. The open nature of the platform's application services have allowed malware writers to submit Trojan attacks onto the service under the guise of legitimate mobile applications.
Source
The company said that the malware is currently disguised as a Google Play application which streams Japanese-language video game trailers. Researchers estimate that as many as 70,000 handsets may be infected.
McAfee Labs malware researcher Carlos Castillo said that the attack can be spotted by its unusual requests for data access.
"When the application is about to be installed, two suspicious permissions, read contact data and read phone state and identity, are requested. Neither is needed for the principal purpose of the application, which is to display a video from the internet," Castillo said in a blog post.
"The reason for these requests becomes clear because the first action that the malware takes when it executes is to obtain, in the background, the following sensitive information from the device without the user’s consent."
Once the user's contact information has been gathered, the malware then uploads the data to a remote server and downloads a video which is displayed in order to hide the application's malicious activities.
Castillo said that McAfee has found 15 variants on the infection to date. The detected applications have been removed from Google's app store.
Malware has been an ongoing problem on the Android platform. The open nature of the platform's application services have allowed malware writers to submit Trojan attacks onto the service under the guise of legitimate mobile applications.
Source
