While observing the activity of several cybercriminal groups, Kaspersky Lab researchers have spotted unusual activity in a malicious script on an infected web site that is putting Android users at risk. The script usually activates the download of Flash exploits to attack Windows-users.
However, at some point it has been changed so it can check the type of device its victims are using, searching specifically for Android version 4 and older. Kaspersky Lab experts decided to delve deeper.
Infecting an Android device is much harder for criminals then infecting a Windows PC. The Windows OS – and many widespread applications for it – contains vulnerabilities that allow malicious code to be executed without any interactions with a user.
This is not generally the case with the Android OS, as any application installation requires confirmation from the owner of an Android device. However, vulnerabilities in the OS can be exploited to bypass this restriction and, as our researchers discovered during their investigation, this does happen.
The script is a set of special instructions for execution in the browser, embedded in the code of the infected web site. The first script was discovered while it was looking for devices operating on the old versions of Android OS. Two more suspicious scripts were also detected subsequently.
The first one is able to send an SMS to any mobile number, while the other creates malicious files on the SD-card of the attacked device. That malicious file is a Trojan, and it has the ability to intercept and send SMS messages. Both malicious scripts are able to perform actions independently from the Android user: you would only need to occasionally visit an infected website, to be compromised.
This was made possible because cybercriminals have used exploits to several vulnerabilities in Android versions 4.1.x and older – CVE-2012-6636, CVE-2013-4710 and CVE-2014-1939 in particular.
All three vulnerabilities were patched by Google between 2012 and 2014; but the risk of their exploitation still exists. For example, because of the Android ecosystem characteristics, many vendors producing Android-based devices are releasing the necessary security updates too slowly. Some do not release updates at all because of the technical obsolescence of a particular device model.
“The exploitation techniques we’ve found during our research were nothing new but borrowed from proof of concepts, previously published by white hat researchers,” says Victor Chebyshev, security expert at Kaspersky Lab. “This means that vendors of Android devices should account for the fact that the publication of PoCs would inevitably lead to the appearance of “armed” exploits. Users of these devices deserve to be protected with corresponding security updates, even if the devices are no longer being sold at the time.”
In order to protect from drive-by attacks, Kaspersky Lab experts advise the following:
* Keep your Android-based device software up-to-date by enabling the automatic updates function;
* Restrict the installation of applications from alternative sources to Google Play, especially if you’re managing a collection of devices used in corporate networks;
* Use a proven security solution.