Over a dozen rogue Android utilities have been removed from the Google Play Store

Over a dozen rogue Android utilities have been removed from the Google Play Store

Tech Highlights:

  • “By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware — steps that would normally require user interaction,” observe the researchers. We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.

  • Researchers have been unable to determine the objectives of the threat actors behind the skillfully camouflaged virus. Security researchers assisted in the removal of 19 applications from the Google Play Store that loaded a rare rooting virus in order to seize control of the smartphone. AbstractEmu, a virus discovered by Lookout cybersecurity experts, rooted an infected Android smartphone to do a variety of harmful operations such as monitoring alerts, collecting screenshots, recording the screen, and even resetting the device’s password or locking it permanently.

The infected apps were disguised as utility apps, such as password managers, data savers, app launchers, and such, and were fully functional. Of the 19 apps that were taken down, the researchers claim that seven exhibited rooting capabilities, and one had clocked more than 10,000 downloads. The researchers claim that while rooting malware has all but disappeared in the last five years, AbstractEmu is proof that they aren’t dead yet. The researchers are also fascinated by the steps the malware takes to avoid detection by using code abstraction and anti-emulation checks.

Once on a device, AbstractEmu calls in the help of one of five exploits for older Android security flaws in order to root and take over the device. After gaining control, it collates all kinds of data about the device, and sends it to a remote server, and waits to receive additional payloads. “At the time of discovery, the threat actor behind AbstractEmu had already disabled the endpoints necessary to retrieve this additional payload from C2 [command-and-control server], which has prevented us from learning the ultimate aim of the attackers,” the researchers conclude. With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

We will be happy to hear your thoughts

      Leave a reply

      Tech Reviews, News and Guides
      Logo