Some Android smartphones have already been infected. The Midnight Mimosa malware was hiding in factory firmware, gained system rights and did not remove through the settings. The researchers found out how the infected devices were used without the knowledge of the owners.
The campaign was revealed by Bitdefender specialists who noticed the suspicious activity of the application com.android.system.lite. The program hid the icon, posed as a system component and secretly installed applications. Later found related modules com.android.sys.prot and com.android.sys.gmsprot. The malware worked on inexpensive devices with MediaTek chips.
Midnight Mimosa was built into the system section and signed with the platform key. Android allowed it to delete and install applications without confirmation of the owner, as well as to issue permits to them. A similar scheme was previously found in Keenadu. Resetting to factory settings does not remove files from the system partition, so standard cleaning does not solve the problem.
The attackers used at least 32 additional applications. Under the guise of weather forecasts, software locks, file manager and text recognition, the malware loaded the advertisements in the invisible windows and twisted the clicks. Other modules made smartphones proxy nodes and passed someone else's traffic through their connections. Potentially, such a network can be used for DDoS attacks.
Before installing the module, the malware disabled Google Play, probably to get around the Play Protect and then turned on the store back. Some samples indicated Google Play as a source of installation, although they did not have a special signature of the store. The Malware also requested access to SMS, notifications and Android special features. The researchers did not record that the intruders used such possibilities.
In two years, experts have seen thousands of infected vehicles in more than 150 countries. Most of the cases were in Mexico, France and Italy. Among the models were Doogee S200 X and Cubot KINGKONG X, as well as cheap fakes that posed as Samsung Galaxy and iPhone. But the findings do not mean that all the devices of these brands are infected.
Google Play also found 13 applications with the same advertising fraud code. The store versions did not have such wide rights, but advertising appeared even outside their interface. When analyzing the firmware, Bitdefender discovered certificates with the name Shenzhen Zediel, but their presence does not prove the company's involvement in the spread of the malware.
At what stage of supply the malware fell into the firmware, it is unknown. For complete cleaning, you need a proven system image or disconnect the component through ADB, which is difficult for most buyers. The problem resembles the previous cases with Triada, and the main way to protect buyers lies on the side of manufacturers and sellers of devices.
The campaign was revealed by Bitdefender specialists who noticed the suspicious activity of the application com.android.system.lite. The program hid the icon, posed as a system component and secretly installed applications. Later found related modules com.android.sys.prot and com.android.sys.gmsprot. The malware worked on inexpensive devices with MediaTek chips.
Midnight Mimosa was built into the system section and signed with the platform key. Android allowed it to delete and install applications without confirmation of the owner, as well as to issue permits to them. A similar scheme was previously found in Keenadu. Resetting to factory settings does not remove files from the system partition, so standard cleaning does not solve the problem.
The attackers used at least 32 additional applications. Under the guise of weather forecasts, software locks, file manager and text recognition, the malware loaded the advertisements in the invisible windows and twisted the clicks. Other modules made smartphones proxy nodes and passed someone else's traffic through their connections. Potentially, such a network can be used for DDoS attacks.
Before installing the module, the malware disabled Google Play, probably to get around the Play Protect and then turned on the store back. Some samples indicated Google Play as a source of installation, although they did not have a special signature of the store. The Malware also requested access to SMS, notifications and Android special features. The researchers did not record that the intruders used such possibilities.
In two years, experts have seen thousands of infected vehicles in more than 150 countries. Most of the cases were in Mexico, France and Italy. Among the models were Doogee S200 X and Cubot KINGKONG X, as well as cheap fakes that posed as Samsung Galaxy and iPhone. But the findings do not mean that all the devices of these brands are infected.
Google Play also found 13 applications with the same advertising fraud code. The store versions did not have such wide rights, but advertising appeared even outside their interface. When analyzing the firmware, Bitdefender discovered certificates with the name Shenzhen Zediel, but their presence does not prove the company's involvement in the spread of the malware.
At what stage of supply the malware fell into the firmware, it is unknown. For complete cleaning, you need a proven system image or disconnect the component through ADB, which is difficult for most buyers. The problem resembles the previous cases with Triada, and the main way to protect buyers lies on the side of manufacturers and sellers of devices.
