New Android Malware Targets Non-Rooted Devices

Lookout Mobile Security has discovered a new variant of the Legacy Native (LaNa) malware for Android which opens a backdoor to the device. Unlike previous versions of LaNa, where the device had to first be rooted and depended on user interaction, this new variant doesn’t require the user at all, and will work on non-rooted devices.

LaNa had previously masqueraded as a legitimate application and attempted to con the user into allowing it access to the SU command on rooted devices. Once SU access was granted, LaNa would open remote access to the phone allowing its controllers the ability to install additional software in the background. The catch with early variants of LaNa was that the device had to be rooted in order for this attack to work. This severely lowered the potential victim pool, as a majority of Android users do not jailbreak their devices.

Now, a newer variant of LaNa can gain root access by leveraging the GingerBreak exploit. Doing so removes the need for user interaction and opens the victim pool to anyone not patched against the vulnerability (anything prior to Android 2.3.4).

The new LaNa variant is hidden within a legitimate JPEG. There are two binaries embedded after the end-of-image marker in the file, one roots the device (GingerBreak) and the other establishes a connection to a remote server (the C&C).

“At this time, LeNa’s C&C seems to be focusing on pushing a single package to the device: com.the9.gamechannel, a Chinese-language alternative market that publishes Android games. This package is installed without the user’s knowledge and subsequently launched – the result being that this alternate market may be front-and-center on a device after a user leaves it unattended for a prolonged period of time. While it shares much of the same functionality as any mobile application store, this alternate market has not been designed to mimic the official Google Play market,” Lookout said in an advisory.

The latest LaNa variant has been spotted circulating within the non-official application channels, so the easiest way to avoid being infected is to download applications from Google Play, Lookout added.

“This latest version of LeNa has recently emerged in alternative markets, and it is not (at this time) believed to have been in the Google Play market. Among the apps in which this payload appears, however, is a fully functional copy of the recently released Angry Birds Space. The authors are undoubtedly hoping to capitalize on the latest release from this popular franchise to increase uptake on distribution.”