Connect with us

Hi, what are you looking for?


Mobile & Wireless

LevelDropper Autorooting Malware Spotted in Google Play

Google has been long touting the security measures that allowed it to diminish malware instances in Google Play, but malicious applications are still able to avoid these and slip into the storefront.

Google has been long touting the security measures that allowed it to diminish malware instances in Google Play, but malicious applications are still able to avoid these and slip into the storefront.

LevelDropper is the latest example of such a malicious application: it is distributed via Google Play, but its intentions aren’t good, as it can silently root the devices it has been installed on. According to Lookout security researchers, who discovered LevelDropper, this application represents a new and persisting trend in mobile threats, called autorooting malware.

Although it appeared harmless initially, the application revealed its malicious behavior when deeper analysis on it was performed, Lookout’s Colin Streicher explains in a blog post. LevelDropper was deemed malicious because it is able to silently root a device, which allows it to perform operations that wouldn’t be possible without additional privileges.

What Lookout researchers discovered was that this malware was silently rooting devices to install additional applications. Within 30 minutes after LevelDropper was launched for the first time on the compromised device, 14 new applications were installed without any kind of user interaction, researchers say.

As soon as the application is launched, the LocationServices window pops up blank, which indicates a potential crash that an attacker could leverage for privilege escalation. In this instance, the attackers designed the program so that it would gain root access to the package manager, because this is the only manner in which they could install new apps without alerting the user.

“The app never prompted the user to install the additional apps, which generally indicates that the application must have root access. It is not possible for an application to download and install additional apps without user interaction unless the app has root access to the package manager,” Lookout researchers explain.

Lookout also says that infected devices don’t show the usual signs that would indicate a rooted device, such as a superuser binary and a rewritten “install-system-recovery” script. What they did discover, however, was that the system partition was writable, although it is usually in read-only mode to prevent modifications.

Moreover, a closer look at the binary files contained in the application’s package revealed two privilege escalation exploits, along with some supporting package files, including SuperSU, busybox, and supolicy. Both of these exploits are using publicly available proof of concept code to gain root access on the compromised devices. LevelDropper also included additional APKs that leverage root privileges to display obtrusive ads that are difficult to avoid, researchers say.

Advertisement. Scroll to continue reading.

Malicious applications that automatically root compromised devices were observed before, such as ShiftyBug, Shuanet, Shedun, and Brain Test, which was removed from Google Play in fall last year but returned in January. These programs not only root devices but, the same as LevelDropper, install additional applications on them.

“For now, it seems like these apps are being used to drive ad revenues. In cases like this, developers often integrate auto-rooting functionality to drive app installs which can drive both perceived popularity and ad revenue,” researchers say. The aforementioned Brain Test app was designed to leverage infected devices to download and write positive reviews of other malicious apps in Google Play.

LevelDropper is yet another example that malicious programs manage to slip into the Google Play store despite Google’s efforts to prevent that. Last week, Trend Micro researchers warned of Godless, a piece of mobile malware that leverages multiple rooting exploits and which already affected over 850,000 devices worldwide through malicious applications in prominent app stores, like Google Play.

Related: Google Increases Android Bug Bounty Payouts

Related: Android Spyware Snoops on Government, Military Security Job Seekers

Written By

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn about active threats targeting common cloud deployments and what security teams can do to mitigate them.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Samsung smartphone users warned about CVE-2023-21492, an ASLR bypass vulnerability exploited in the wild, likely by a spyware vendor.

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Fraud & Identity Theft

A team of researchers has demonstrated a new attack method that affects iPhone owners who use Apple Pay and Visa payment cards. The vulnerabilities...

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

Asus patched nine WiFi router security defects, including a highly critical 2018 vulnerability that exposes users to code execution attacks.