Old Android devices at risk from automatically downloaded and executed malware

While observing the activity of several cybercriminal groups, Kaspersky Lab researchers have spotted unusual activity in a malicious script, on an infected website, which is putting Android users at risk.

The script usually activates the download of Flash exploits, to attack Windows-users. However at some point it has been changed so it can check the type of device its victims are using, searching specifically for Android version 4 and older. Spotting the danger, Kaspersky Lab experts decided to delve deeper.

Infecting an Android device is much harder for criminals then infecting a Windows PC. The Windows OS – and many widespread applications for it – contains vulnerabilities that allow malicious code to be executed without any interactions with a user. This is not generally the case with the Android OS, as any application installation requires confirmation from the owner of an Android device. However, vulnerabilities in the OS can be exploited to bypass this restriction and, as our researchers discovered during their investigation, this does happen.

The script is a set of special instructions for execution in the browser, embedded in the code of the infected website. The first script was discovered while it was looking for devices operating on the old versions of Android OS. Two more suspicious scripts were also detected subsequently. The first one is able to send an SMS to any mobile number, while the other creates malicious files on the SD-card of the attacked device. That malicious file is a Trojan, and it has the ability to intercepsw CVE-2012-6636, CVE-2013-4710 and CVE-2014-1939 in particular. All three vulnerabilities were patched by Google between 2012 and 2014; but the risk of their exploitation still exists. For example, because of the Android ecosystem characteristics, many vendors producing Android-based devices are releasing the necessary security updates too slowly. Some do not release updates at all because of the technical obsolescence of a particular device model.

“The exploitation techniques we’ve found during our research were nothing new but borrowed from proof of concepts, previously published by white hat researchers. This means that vendors of Android devices should account for the fact that the publication of PoCs would inevitably lead to the appearance of “armed” exploits. Users of these devices deserve to be protected with corresponding security updates, even if the devices are no longer being sold at the time,” said Victor Chebyshev, security expert at Kaspersky Lab.

In order to protect yourself from drive-by attacks, Kaspersky Lab experts advise the following: Keep your Android-based device software up-to-date by enabling the automatic updates function, Restrict the installation of applications from alternative sources to Google Play, especially if you’re managing a collection of devices used in corporate networks, Use a proven security solution. Kaspersky Internet Security for Android and Kaspersky Security for Mobile with Mobile Device Management are capable of detecting changes on the SD-card of device in real time, and thus protect users against the drive-by attacks described above.