Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

New Android Malware Targets Non-Rooted Devices

Lookout Mobile Security has discovered a new variant of the Legacy Native (LaNa) malware for Android which opens a backdoor to the device. Unlike previous versions of LaNa, where the device had to first be rooted and depended on user interaction, this new variant doesn’t require the user at all, and will work on non-rooted devices.

Lookout Mobile Security has discovered a new variant of the Legacy Native (LaNa) malware for Android which opens a backdoor to the device. Unlike previous versions of LaNa, where the device had to first be rooted and depended on user interaction, this new variant doesn’t require the user at all, and will work on non-rooted devices.

LaNa had previously masqueraded as a legitimate application and attempted to con the user into allowing it access to the SU command on rooted devices. Once SU access was granted, LaNa would open remote access to the phone allowing its controllers the ability to install additional software in the background. The catch with early variants of LaNa was that the device had to be rooted in order for this attack to work. This severely lowered the potential victim pool, as a majority of Android users do not jailbreak their devices.

Now, a newer variant of LaNa can gain root access by leveraging the GingerBreak exploit. Doing so removes the need for user interaction and opens the victim pool to anyone not patched against the vulnerability (anything prior to Android 2.3.4).

The new LaNa variant is hidden within a legitimate JPEG. There are two binaries embedded after the end-of-image marker in the file, one roots the device (GingerBreak) and the other establishes a connection to a remote server (the C&C).

“At this time, LeNa’s C&C seems to be focusing on pushing a single package to the device: com.the9.gamechannel, a Chinese-language alternative market that publishes Android games. This package is installed without the user’s knowledge and subsequently launched – the result being that this alternate market may be front-and-center on a device after a user leaves it unattended for a prolonged period of time. While it shares much of the same functionality as any mobile application store, this alternate market has not been designed to mimic the official Google Play market,” Lookout said in an advisory.

The latest LaNa variant has been spotted circulating within the non-official application channels, so the easiest way to avoid being infected is to download applications from Google Play, Lookout added.

“This latest version of LeNa has recently emerged in alternative markets, and it is not (at this time) believed to have been in the Google Play market. Among the apps in which this payload appears, however, is a fully functional copy of the recently released Angry Birds Space. The authors are undoubtedly hoping to capitalize on the latest release from this popular franchise to increase uptake on distribution.”

Written By

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

South Dakota Gov. Kristi Noem says her personal cell phone was hacked and linked it to the release of documents by the January 6...

Cybercrime

A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Application Security

Software maker Adobe on Tuesday released security patches for 29 documented vulnerabilities across multiple enterprise-facing products and warned that hackers could exploit these bugs...