Steals information when a user connects the device via USB to a Windows machine
SECURITY FIRM F-Secure has discovered an Android app
that turns a mobile device into a hacking tool that is capable of
stealing information from a connected Windows PC.
The company said in a blog post today that its security response
analysts came across the app in an analysis on a Chinese language forum
over the weekend. It found that, when executed, the sample, which is
detected as "Hack-Tool:Android/UsbCleaver.A", installs an app named
USBCleaver on the victim's device.
When that app is launched, it directs the user to download a ZIP file
from a remote server, and then unzips the downloaded file to
"/mnt/sdcard/usbcleaver/system folder".
The files saved are utilities used to retrieve information when the
user connects the device via USB to a Windows PC machine, and can grab
browser passwords along with stored WiFi keys and network information.
"To run the utilities, the sample creates an autorun.inf and go.bat file at '/mnt/sdcard'," F-Secure explained in a Labs blog post.
"When the device is connected to a Windows computer, the autorun script
gets triggered, which then silently runs the go.bat file in the
background, which in turn runs the specified files from the
usbcleaver/system folder."
The collected details are stored on the device at
"/mnt/sdcard/usbcleaver/logs" and can be viewed in the "Log Files"
button to view the information retrieved from the PC.
F-Secure said that this attack can be blocked by disabling Autorun by
default, as doing so can block USBCleaver's Windows infecting routine.
"This isn't the first Android trojan reported this year with PC
infecting capabilities, since that 'distinction' belongs to the
trojan-spy apps family we detect as Sscul," F-Secure warned.
"Unlike the Sscul malware however, which is more focused on remote
eavesdropping, USBCleaver seems to be designed to facilitate a targeted
attack by gathering details that would be helpful in a later
infiltration attempt."
No comments:
Post a Comment