พบแอพของแอนดรอยด์ ที่สามารถ root มือถือแอนดรอยด์ได้มากกว่า 90%

‘Godless’ Apps, Some Found In Google Play, Root 90% Of Android Phones (arstechnica.com)

Researchers have detected a family of malicious apps, some that were available in Google Play, that contain malicious code capable of secretly rooting an estimated 90 percent of all Android phones. In a recently published blog post, antivirus provider Trend Micro said that Godless, as the malware family has been dubbed, contains a collection of rooting exploits that works against virtually any device running Android 5.1 or earlier. That accounts for an estimated 90 percent of all Android devices. Members of the family have been found in a variety of app stores, including Google Play, and have been installed on more than 850,000 devices worldwide. Godless has struck hardest at users in India, Indonesia, and Thailand, but so far less than 2 percent of those infected are in the US. Once an app with the malicious code is installed, it has the ability to pull from a vast repository of exploits to root the particular device it’s running on. In that respect, the app functions something like the many available exploit kits that cause hacked websites to identify specific vulnerabilities in individual visitors’ browsers and serve drive-by exploits.

Affected apps that have been spotted in Google Play, Android’s marquee app store, are largely flashlight, Wi-Fi apps, as well as copies of popular games.

ยัม ยัม

มือถือแอนดรอยด์ใคร คลิกเว็บเอง เปิดโฆษณาเอง ฯลฯ โปรดระวัง

ขนาดตั้งใจจะ root เครื่องเอง ยังไม่ใช่ง่ายๆเลย ขั้นตอนหลายอย่าง และต้องทำให้ตรงรุ่นที่ใช้
ถ้าแอปมันเทพขนาด root ได้แทบทุกเครื่องนี่ไม่ธรรมดาละ น่าจะมั่วเขียนให้เวอร์มากกว่า
ถ้าบอกว่า อาศัยช่องโหว่ของเครื่องที่ root ไว้แล้ว แบบนี้พอเป็นไปได้มากกว่า

Godless is reminiscent of an exploit kit, in that it uses an open-source rooting framework called android-rooting-tools. The said framework has various exploits in its arsenal that can be used to root various Android-based devices. The two most prominent vulnerabilities targeted by this kit are CVE-2015-3636 (used by the PingPongRoot exploit) and CVE-2014-3153 (used by the Towelroot exploit). The remaining exploits are deprecated and relatively unknown even in the security community.

In addition, with root privilege, the malware can then receive remote instructions on which app to download and silently install on mobile devices. This can then lead to affected users receiving unwanted apps, which may then lead to unwanted ads. Even worse, these threats can also be used to install backdoors and spy on users.

This topic was automatically closed after 90 days. New replies are no longer allowed.