You are not logged in to Prodigits. Please register or login. You are not logged in to Prodigits. Please register or login.
Subject: Malicious IRC Android Virus
Replies: 6 Views: 468
navigato 14.01.12 - 06:41am
First Malicious IRC Bot for Android is detected which allows the attacker full remote control of your device. an (Internet Relay Chat) IRC bot is a tool that provides automated function inside of an IRC channel. (Internet bots, also known as web robots, WWW robots or simply bots, are software applications that run automated tasks over the Internet.) * +
navigato 14.01.12 - 06:44am
Once installed, the malware disguises itself as Madden NFL 12. The application actually consists of three malicious components: a root exploit (using Gingerbreak), an SMS Trojan, and the IRC bot. The files are extracted and stored in /data/data/com.android.bot/files as header01.png, footer01.png, and border01.png respectively. The directory is then given read/write/ executable permissions. * +
navigato 14.01.12 - 06:47am
The root exploit (header01.png) is first executed in order to give the device root access - a requisite for the SMS Trojan and IRC bot to function. Fortunately, the root method used - Gingerbreak - has been patched for quite sometime now so most devices are left unaffected by the root attempt. * +
navigato 14.01.12 - 06:50am
If the device is already rooted when the exploit attempts to run, it will request Super User access, thus prompting the user. If this request is denied, then the app won't be able to progress any further. if the device is successfully rooted by malware, it will then execute the second file: the SMS Trojan (footer01.png). Once executed, the Trojan discovers the device's country and send SMS message to an applicable premium rate number * +
navigato 14.01.12 - 06:52am
After that, the IRC bot connects to a remote IRC server (which is down) with a random nickname. From there it can receive and execute any shell command, basically giving the attacker control of the whole system. * +
navigato 14.01.12 - 06:55am
Details Here http://is.gd/ircbot and here Kaspersky's Secure List blog http://is.gd/kisavslb * +
dogmonke 15.01.12 - 12:11pm
Thanks for the heads up brother. *
+ refresh
+ my page
+ functions
3 search
4 submit a reply
+ bookmark
8 Android Forum
9 Forum Index
