LevelDropper Autorooting Malware Spotted in Google Play

Google has been long touting the security measures that allowed it to diminish malware instances in Google Play, but malicious applications are still able to avoid these and slip into the storefront.

LevelDropper is the latest example of such a malicious application: it is distributed via Google Play, but its intentions aren’t good, as it can silently root the devices it has been installed on. According to Lookout security researchers, who discovered LevelDropper, this application represents a new and persisting trend in mobile threats, called autorooting malware.

Although it appeared harmless initially, the application revealed its malicious behavior when deeper analysis on it was performed, Lookout’s Colin Streicher explains in a blog post. LevelDropper was deemed malicious because it is able to silently root a device, which allows it to perform operations that wouldn’t be possible without additional privileges.

What Lookout researchers discovered was that this malware was silently rooting devices to install additional applications. Within 30 minutes after LevelDropper was launched for the first time on the compromised device, 14 new applications were installed without any kind of user interaction, researchers say.

As soon as the application is launched, the LocationServices window pops up blank, which indicates a potential crash that an attacker could leverage for privilege escalation. In this instance, the attackers designed the program so that it would gain root access to the package manager, because this is the only manner in which they could install new apps without alerting the user.

“The app never prompted the user to install the additional apps, which generally indicates that the application must have root access. It is not possible for an application to download and install additional apps without user interaction unless the app has root access to the package manager,” Lookout researchers explain.

Lookout also says that infected devices don’t show the usual signs that would indicate a rooted device, such as a superuser binary and a rewritten “install-system-recovery” script. What they did discover, however, was that the system partition was writable, although it is usually in read-only mode to prevent modifications.

Moreover, a closer look at the binary files contained in the application’s package revealed two privilege escalation exploits, along with some supporting package files, including SuperSU, busybox, and supolicy. Both of these exploits are using publicly available proof of concept code to gain root access on the compromised devices. LevelDropper also included additional APKs that leverage root privileges to display obtrusive ads that are difficult to avoid, researchers say.

Malicious applications that automatically root compromised devices were observed before, such as ShiftyBug, Shuanet, Shedun, and Brain Test, which was removed from Google Play in fall last year but returned in January. These programs not only root devices but, the same as LevelDropper, install additional applications on them.

“For now, it seems like these apps are being used to drive ad revenues. In cases like this, developers often integrate auto-rooting functionality to drive app installs which can drive both perceived popularity and ad revenue,” researchers say. The aforementioned Brain Test app was designed to leverage infected devices to download and write positive reviews of other malicious apps in Google Play.

LevelDropper is yet another example that malicious programs manage to slip into the Google Play store despite Google’s efforts to prevent that. Last week, Trend Micro researchers warned of Godless, a piece of mobile malware that leverages multiple rooting exploits and which already affected over 850,000 devices worldwide through malicious applications in prominent app stores, like Google Play.

Related: Google Increases Android Bug Bounty Payouts

Related: Android Spyware Snoops on Government, Military Security Job Seekers