Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New 'unremovable' xHelper malware has infected 45,000 Android devices

zdnet.com

Post reply on HN
Print view View original

81–90 of 110 posts

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#81

Post by scarface74 »

Godel_unicode wrote: post #62
afro88 wrote: post #34

Earlier quoted context omitted.

Links please

https://www.wired.com/story/apple-app-store-malware-click-fr... https://us.norton.com/internetsecurity-emerging-threats-ios-...

From the article

While they were live, they didn’t steal data or gain control of a victim’s device, ....And while the worst effects you’d feel as a victim in this case would be a quicker battery drain and a higher data bill, this latest wave of iOS malware is most notable not for what it does but for how it got there.

Which is a far cry from an unremovable app. It didn’t even get outside of the sandbox and wasn’t an escalation of privilege attack.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#82

Post by yc12340 »

dclusin wrote: post #5
redm wrote: post #2

I know IOS isn't perfect, however, when I read articles like this, I just have to smile. There's something to be said for a tightly controlled platform and ecosystem.

It seems like they could get a better outcome by having levels of trust for unsanctioned apps. Like the default for side-loaded apps would be just as an app only. No background processing, notifications, loading services. To get the latter functionality you could make the user jump through a bunch of hoops with nasty warning messages or even just not allow it.

According to claims on Reddit, this malware can re-enable "Allow installing untrusted apps" checkbox after user unchecks it.

This and it's ability to survive factory reset may indicate, that xhelper can gain complete control over device (probably via improperly built firmware or unpatched root exploits). No amount of sandbox enhancements can stop this kind of priviledge escalation.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#83

Post by aloknnikhil »

jessaustin wrote: post #58
tinus_hn wrote: post #27

Earlier quoted context omitted.

The people who made choices that enable these issues, while complaining about other options that prevent these issues?

One needn't badmouth iOS in order to use Android. Indeed, many who use Android don't know that iOS exists.

Or cannot afford an iPhone. Android brought smartphones to the masses. It's a lack of choice at that price point.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#84

Post by piracy1 »

hunter2_ wrote: post #72
buildzr wrote: post #63

Earlier quoted context omitted.

All they'd have to do in order to survive a factory reset is to write to the /system partition, which contains the main OS. A factory reset only wipes /data and a few caches. Writing to /system requires it to be mounted read/write and permissions to do so, so they'd need a root exploit in order to pull it off, but there's quite a few to choose from especially as devices age and given that they're doing this outside P…

Is side loading the only way that code requiring root can easily get on a phone though? What about USB debugging?

No. The play store does not check very well and is pretty easy to bypass. Up until recently you could just download .dex (android equivalent of .jar) files into your apps resources at run time then call the classloader. Then for their runtime scan you can either just wait to put the real code online or have a hardcoded switch to execute the main function based on like an NTP server saying it's past X day. I think that is why they removed calls to the classloader from android. There's a few other ways to do basically that that still work but I'm not sharing those for free.

IMO There is a slight flaw to how this question is worded. It's not that they block you from running code that you need to be root to run (you'll just get insufficient perms errors) it's just that you're not root. You could write the code to write to /system, and it will run it just will not work. Thus, you need to utilize some sort of local privilege escalation. That is it's own equally semi-sticky wicket.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#85

Post by tgsovlerkhgsel »

paulmd wrote: post #6

Wonder if it's written itself into recovery. Or the SIM card/baseband - SIM card in particular usually includes functionality for triggering a sideload of apps (eg for carrier apps), sending notifications, etc into the main SOC so it fits. Maybe the second instance of SIM card malware ever. https://www.youtube.com/watch?v=31D94QOo2gY There are only so many places it can be hiding if it's surviving a factory reset. --…

While there are theoretically many places it could hide in, the system partition or recovery seem the only realistic ones.

And recovery is already a stretch IMO.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#86

Post by baroffoos »

40four wrote: post #48

I'm really confused. How is it possible something like this survives a factory reset? To be fair, I have a very limited knowledge of hardware like this, but my assumption is a factory reset should remove EVERYTHING that didn't come on the phone put of the box. Some other comments are questioning weather this is happeneing to 'budget' devices sold by sketchy manufacturers. Would that explain something like this. I sur…

>but my assumption is a factory reset should remove EVERYTHING that didn't come on the phone put of the box

A simple proof that this isn't the case is the fact that factory resets do not revert your phone back to the same OS version as it came with out of the box and it does not download an OS image to install. The only device I know that does this is macbooks have a built in recovery which can be used to download a fresh OSX image and install that.

On an unrooted/unexploited phone a factory reset should remove every bit of data bad app has access to. On a rooted phone you can wipe everything by downloading the vendor image (Google supplies these but not all OEMs do) and then you can flash that over the entire phone which replaces everything on the storage.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#87

Post by baroffoos »

jklinger410 wrote: post #52
40four wrote: post #48

I'm really confused. How is it possible something like this survives a factory reset? To be fair, I have a very limited knowledge of hardware like this, but my assumption is a factory reset should remove EVERYTHING that didn't come on the phone put of the box. Some other comments are questioning weather this is happeneing to 'budget' devices sold by sketchy manufacturers. Would that explain something like this. I sur…

Probably calling as pre-installed service in the ROM. Definitely baked in by the manufacturer.

Certainly the most likely case. Laptop OEMs have been bundling malware for a long time now.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#88

Post by baroffoos »

43920 wrote: post #67
tyingq wrote: post #66

Sounds big, but likely paltry compared to active Android devices. That said, for other reasons that are more compelling, Apple is killing Google on "captive portal advantages". Google needs to dedicate more resources to both the PlayStore and the Chrome Extension store for many, many, reasons. They are not getting the inflection point of their "automation is fine" approach. In other words, the conclusion is right, bu…

This doesn't really seem like a detection issue, but more of a design issue that Google needs to fix. Why is an app able to display ads across the system, even when you aren't running it? And how is it even possible for an app to make itself uninstallable?

>Why is an app able to display ads across the system

There is a permission on android called "Draw over other apps" which is disabled by default now when you install the app but the app can open a popup asking you to enable it which android warns you against accepting.

The valid use cases for this permission is you could have PIP for videos.

Yes its pretty bad but its not like any app can just draw adverts over the screen.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#89

Post by wnevets »

>According to Malwarebytes, the source of these infections is "web redirects" that send users to web pages hosting Android apps. These sites instruct users on how to side-load unofficial Android apps from outside the Play Store. Code hidden in these apps downloads the xHelper trojan.

Ok, maybe don't do that?

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#90

Post by Godel_unicode »

scarface74 wrote: post #81
Godel_unicode wrote: post #62

Earlier quoted context omitted.

https://www.wired.com/story/apple-app-store-malware-click-fr... https://us.norton.com/internetsecurity-emerging-threats-ios-...

From the article While they were live, they didn’t steal data or gain control of a victim’s device, ....And while the worst effects you’d feel as a victim in this case would be a quicker battery drain and a higher data bill, this latest wave of iOS malware is most notable not for what it does but for how it got there. Which is a far cry from an unremovable app. It didn’t even get outside of the sandbox and wasn’t an…

The comments upstream are debating whether there's been malware on the app store. There has. Goal posts aside, it's worth remembering that no app review process is infallible, including Apple's.
Post reply on HN