36 Android Devices Now Come Infected with Malware

(WFLA – North Carolina) – According to the Mobile Threat Prevention department at Check Point Software Technologies Inc., Android users should beware of a set pre-installed malware that can wreak havoc on their lives. Check Point says they recently detected malware in 36 Android devices that came installed with the phone.

According to the findings, the malware was already present on the devices before the users received them. The malicious apps were not part of the official ROM supplied by the vendor, but were added somewhere along the supply chain. Six of the malware infections were added by to the device’s ROM using system privileges, meaning they couldn’t be removed by the user and the device had to be re-flashed.

Most of the malware found to be pre-installed on the devices were info-stealers and rough ad networks. One of them was Slocker, a well known mobile ransomware. Slocker uses the AES encryption algorithm to encrypt all files on the device and demand ransom in return for their decryption key. Slocker uses Tor for its C&C communications.

The most notable rough adnet which targeted the devices is the Loki Malware. This complex malware operates by using several different components; each has its own functionality and role in achieving the malware’s malicious goal. The malware displays illegitimate advertisements to generate revenue. As part of its operation, the malware steals data about the device and installs itself to system, allowing it to take full control of the device and achieve persistency.

The risk of pre-installed malware

As a general rule, users should avoid risky websites and download apps only from official and trusted app stores, like the Google Play Store. However, following these guidelines is not enough to ensure their security. Pre-installed malware can compromise the security even of the most vigilant users. In addition, a user who receives a device already containing malware will not be able to notice any change in the device’s activity which often occur once a malware is installed.

The discovery of the pre-installed malware raises some alarming issues regarding mobile security. Users could receive devices which contain backdoors or are rooted without their knowledge. To protect themselves from regular and pre-installed malware, users should implement advanced security measures capable of identifying and blocking any abnormality in the device’s behavior.

List of Malware APKs, Shas, and Affected Devices