Lookout Mobile Security has discovered a new variant of the Legacy Native (LaNa) malware for Android which opens a backdoor to the device. Unlike previous versions of LaNa, where the device had to first be rooted and depended on user interaction, this new variant doesn’t require the user at all, and will work on non-rooted devices.
LaNa had previously masqueraded as a legitimate application and attempted to con the user into allowing it access to the SU command on rooted devices. Once SU access was granted, LaNa would open remote access to the phone allowing its controllers the ability to install additional software in the background. The catch with early variants of LaNa was that the device had to be rooted in order for this attack to work. This severely lowered the potential victim pool, as a majority of Android users do not jailbreak their devices.
Now, a newer variant of LaNa can gain root access by leveraging the GingerBreak exploit. Doing so removes the need for user interaction and opens the victim pool to anyone not patched against the vulnerability (anything prior to Android 2.3.4).
The new LaNa variant is hidden within a legitimate JPEG. There are two binaries embedded after the end-of-image marker in the file, one roots the device (GingerBreak) and the other establishes a connection to a remote server (the C&C).
“At this time, LeNa’s C&C seems to be focusing on pushing a single package to the device: com.the9.gamechannel, a Chinese-language alternative market that publishes Android games. This package is installed without the user’s knowledge and subsequently launched – the result being that this alternate market may be front-and-center on a device after a user leaves it unattended for a prolonged period of time. While it shares much of the same functionality as any mobile application store, this alternate market has not been designed to mimic the official Google Play market,” Lookout said in an advisory.
The latest LaNa variant has been spotted circulating within the non-official application channels, so the easiest way to avoid being infected is to download applications from Google Play, Lookout added.
“This latest version of LeNa has recently emerged in alternative markets, and it is not (at this time) believed to have been in the Google Play market. Among the apps in which this payload appears, however, is a fully functional copy of the recently released Angry Birds Space. The authors are undoubtedly hoping to capitalize on the latest release from this popular franchise to increase uptake on distribution.”
More from Steve Ragan
- Anonymous Claims Attack on IP Surveillance Firm Brickcom, Leaks Customer Data
- Workers Don’t Trust Employers with Personal Data: Survey
- Root SSH Key Compromised in Emergency Alerting Systems
- Morningstar Data Breach Impacted 184,000 Clients
- Microsoft to Patch Seven Flaws in July’s Patch Tuesday
- OpenX Addresses New Security Flaws with Latest Update
- Ubisoft Breached: Users Urged to Change Passwords
- Anonymous Targets Anti-Anonymity B2B Firm Relead.com
Latest News
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- UK Car Retailer Arnold Clark Hit by Ransomware
- Dealing With the Carcinization of Security
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Cyber Insights 2023 | Supply Chain Security
- Cyber Insights 2023 | Regulations
