Tag Archives: Android

Android Malware Alert

A report was just released regarding malware that targets Android, called Joker. This malware has been around since 2016, but it continues to be one of the major threats to Android devices. It can steal SMS messages, Contact lists, and device information. It can also sign up users for pricey subscription services such as Wireless Application Protocol (WAP) services. This malware gets added to applications that can be downloaded from the Google Play Store, and though Google has removed many of those apps, the malware keeps coming back. So how does it do what it does?

How it works

The apps that get the Joker malware are essentially “knock-offs” of legitimate apps that can fool people into downloading them. They do not directly contain the malware, instead they contain what is called a “dropper”, code which at some future time days or weeks later will contact a remote site and then download the actual malware. This dropper code is heavily obfuscated in a variety of ways. Sometimes the code is AES encrypted, other times it masquerades as legitimate files that are common in other applications such as JSON files and CSS. The download is frequently a *.dex file (Dalvik Executable) which is the native format now for Android applications. Joker can also use code injection to hide inside of legitimate third-party packages that reside on an Android phone, such as org.junit.internal, com.google.android.gms.dynamite, or com.unity3d.player.UnityProvider. The security research firm Zscaler issued the most recent report on this, and they explained some of the methods Joker uses to download the malware.

Direct Download

In this scenario, a URL is hidden in the code via string obfuscation. This is a technique for hiding executable code by making it hard for the code to be detected. The Sucuri site gives the example of calling PHP to execute the commands where the functions are broken up into 2-3 character chunks, each chunk inside single quotes, and separated by periods. PHP will then join the chunks, remove the single quotes, and execute the function just created.

Once the URL has been “decoded”, the app will contact a Command and Control (C&C) server to get another URL which will take them to the final download of the malware payload. It also supplies a JSON file that has the configuration information for the final download. Once the JSON file is downloaded and executed, the final download takes place.

One-Stage Download

This variant downloads a stager payload first, which then leads to the final download. The URL for the stager payload is encoded using AES encryption. There are two varieties of stager payload that Zcaler has noted, either an APK file or a *.dex file. This stager is responsible for obtaining the URL for the final payload download. The stager is also responsible for executing the final payload.

Two-Stage Download

In this variant, the infected app executes code to contact the C&C server, which replies by sending a message with the URL for the first stager payload which it hides in the location header. The first stager payload is downloaded and executed, which then downloads the second stager payload, which in turn contains the hard-coded URL for the final payload. That is then downloaded.

Final Payload

Regardless of the download method, the final payload of malware is the same. To begin with, it uses DES encryption to execute the C&C activities. And it uses string obfuscation techniques to hide all important strings.

If you want a more detailed description of all the things the final payload does, you can check this site using a browser that can translate from Chinese to English.

What can you do?

Given that this malware has been infecting apps in the Google Play Store for 5 years now, it does not seem like someone else is going to fix the problem. The Zscaler report says that Google has removed these apps, but cannot remove them from your phone if you had the misfortune to download one of them. Using an anti-malware app on your phone may help, but the techniques Joker uses to hide make it challenging to detect and remove.

Step one is to check if you have one of these apps and remove it manually from your phone. You can see the latest batch of 17 apps Zscaler found at this Web page. Once that is done, there are some common sense precautions you can take.

  • Be careful to only download and install apps that serve a genuine need. Downloading lots of apps willy-nilly will only increase your attack surface.
  • Carefully check the history of the app. If it is fairly new and has relatively few downloads, you should probably steer clear. Remember that Google does remove these apps from the Play Store as soon as they are aware of them, so they don’t tend to last long.
  • Stick with developers that have a good reputation and track record.
  • For apps you rarely use or haven’t used recently, consider uninstalling them. Remember it is about the size of the attack surface.
  • Pay attention to permissions. Every time you install an app, it asks you for permissions to do things. Most people just click OK without paying attention, and that is what malware authors rely on. If a solitaire app asks for permission to access your Contacts list and your SMS, you probably shouldn’t allow it.
  • Manage your existing permissions. A good thing Android 11 does is to allow you to remove permissions for apps you haven’t used in a while. You can read more about this and how to manage permissions in this TechRepublic article.

References

Android, Apple, and Market Dynamics

Or Why Tim Cook may be the world’s unluckiest man

Please understand that I don’t wish anything bad to Tim Cook. I’ve never met the man. But I am observing something about the market dynamics in the smartphone and tablet market that I have not yet seen anyone else talk about. Eric Raymond in his blog Armed and Dangerous has covered the idea of price pressures from Android affecting Apple, and I consider his blog required reading for anyone interested in this topic. But I think I can offer a slightly different take on the issue.

If we start with smartphones, Apple really kicked off this market, and raced to an early lead. The first iPhone was unveiled in January 2007, and there was nothing like it. This phone got 2.7% of the mobile phone market in 2007, 9.6% in 2008, and 15.1% in 2009. On November 5, 2007 the Open Handset Alliance was announced, and the very first version of Android unveiled. On September 23, 2008 the G-1 was released with Android 1.0.  In 2008 this gained Android only .5% of the mobile phone market, but this increased to 4.7% in 2009. So in 2009 we have a situation where Android’s market share is less than one-third of Apple’s. Yet by November 2010 Android pulled ahead (slightly) at 26% to Apple’s 25%. And by September 2011, 10 months later, Android is at 44.8% to Apple’s 27.4%. What makes this even more significant is that these share numbers are for the U.S., and it appears that Android is even more dominant in other countries.

If we look at the timeline, it looks like Apple is first to market, and holds a lead for nearly three years before the competition catches it. I think this may be significant for the tablet market. The iPad was introduced in January 2010. In the most recent figure I could find, which is for September 2011, it looks like 75% of the market is held by iPad, and 25% by Android. I think these numbers are pretty comparable to what we saw in the smartphone market if you allow for the fact the the market share numbers were for all mobile phones. Nokia was still selling candy bar phones in 2009, for instance. If we take the smartphone market in 2009 as a two-horse race between Apple and Android, it really looks very close to 75% Apple and 25% Android then as well. I point this out because  even as Android was starting to dominate sales in the smartphone market, I heard a number of people claim that the tablet market was different. But I never heard anyone give a compelling argument as to why the tablet market would be different. Maybe there will be a different outcome this time, but I’d like to hear a sane evidence-based argument before I believe it. If the pattern from the smartphone market is repeated, we could see something like a 50/50 split by the end of 2012, with Android pulling ahead to dominant position by the end of 2013.

Now at this point I have mostly recapped some numbers, but not added anything significant to Eric Raymond’s analysis. I think I can do that now by adding something based on the history of the consumer electronics market. Back in 1990 Professor Michael Porter at the Harvard Business School published a very important work called The Competitive Advantage of Nations. I used this book with some of my more advanced students because it had some great insights. Prof. Porter started with the insight that national economies are not the appropriate level of analysis, and that in specific markets a country might have an advantage while not having it in other markets. So he looked at a number of specific markets where one or another country dominated and asked why that was the case. In the market for consumer electronics, Japan was clearly dominant (remember that in 1990 Sony was still a major force, not a bumbling also-ran<g>). And why was that? Because of the intense competition within the domestic Japanese market. Japanese consumers would purchase the newest products with great fervor, and always demand newer, better products. The product cycles were a matter of months, while comparable US firms, for instance, were still operating with product cycles of years. As Prof. Porter noted, this placed huge pressure on Japanese companies, such that if they could succeed in the Japanese market they would find competition in the global market relatively “a piece of cake”.  And we now know that they basically eliminated the American firms in this market and took it over.

I think this example is relevant to the smartphone and tablet markets as well. I expect that the combination of rapid innovation, short product cycles, and price pressures will create further challenges for Apple. The competition is not from Japan this time, but from the countries that learned from Japan, which would be South Korea, Taiwan, and China. This is where you find the companies like Samsung, HTC, LG, Huawei, etc. HTC, for instance, doubled its shipments of phones from the first half of 2010 to the first half of 2011, and its product cycle is in the area of 6-12 months between concept and a product in the hands of the consumer, according to its COO, Matthew Costello (The Economist, 10/8/11) .  This is rapid, and it is only one company. Together, these companies represent the next wave of Asian Tigers, and they came to the top by out-competing the Japanese. Already in China, which by any measure is the biggest growth market for mobile, Samsung has a larger market share than Apple. Add in Motorola, and new entrants looking for a foothold, like Acer, and you have a lot of competition. These companies are releasing a new phone every month, and sometimes more than one. And any time a feature proves popular, it is quickly adopted by every manufacturer. As a result, the Android phones, which started playing catch-up, are now moving ahead of Apple. Already the technical specs for Android phones exceed those for Apple, and in terms of software it was notable that the latest version of iOS mostly played catch-up to Android.

One way to think about this is the contrast between Intelligent Design and Evolution. Apple is a very centralized tightly controlled ecosystem that represents the Intelligent Design side, while Android represents the Evolutionary approach. From this perspective, the fragmentation that some people complain about is not a failure, it is Android’s greatest strength. This is what lets Android move into every conceivable market segment, and is a central reason for Android having double Apple’s share in the smartphone market. And when you conceive of this as an Intelligent Design vs. Evolution competition, it is worth noting Leslie Orgel’s Second Rule: “Evolution is cleverer than you are.” Even if Apple’s designers are, pound-for-pound, better than anyone else’s designers, they can’t beat the frenzy of experimentation that comes from the Android market.

The next area worth looking at is China. This country is just starting to gear up for massive smartphone usage, and there is no doubt that large numbers of Chinese consumers appreciate the Apple products. After all, look at the many Apple stores there that are doing great business. Of course, Apple never heard of these stores until recently because they are all fakes. Still, imitation is the sincerest form of flattery. But the largest growth in the Chinese market is going to come from less expensive phones, and that is simply not in Apple’s DNA. In a Wall Street Journal article the Chinese market was analyzed and right now Samsung leads Apple slightly (15% to 13% respectively). But the really interesting development is the charge by Huawei,  ZTE, and other Chinese companies to develop smartphones aimed at the price point of 1000 yuan (around $157 at the time of the article). ZTE, for instance, has an order for 2 million 0f its Blade smartphone, priced at 999 yuan, or free with a 2-year contract. And these phones run Android. Computer maker Lenovo has also jumped in with an Android phone (the A60) with a price of 959 yuan. This kind of competition at the low end will be just as challenging for Samsung as for Apple, but it represents gains for Android.

In the tablet market, I expect similar dynamic for the same reasons. Too many analysts have looked at current market share declared “Game Over”, using statements like “There is no market for tablets, there is only a market for iPads.” This completely ignores the history of smartphones, and is, I believe, fundamentally mistaken. Android already has approximately 25% of the global tablet market. And just within the past couple of days (as I write this) comes the news that Amazon has increased its orders for the Kindle Fire for the second time, up to 5 million units. And this has not even been officially released yet, so they must be getting a lot of pre-orders. So if this follow the same pattern, and I see no reason why it shouldn’t, expect rough parity between Android and iOS in the tablet space by the end of 2012, with Android pulling ahead in 2013.

To get back to the subhead of this article, all of these factors were in play when Steve Jobs was still the CEO of Apple. If he had not gotten cancer, if he was still alive and running things at Apple, everything we have talked about would have happened pretty much on schedule. In fact, the dominant market share in smartphones going to Android did happen while Steve was in charge. For now, Apple is able to generate huge profits even as its market share is eroding, but that cannot hold up indefinitely either. Electronics companies all over the world can see the importance of the mobile space and want to be there. And Android is pretty much freely available to all of them. Chines companies that focus in driving down manufacturing costs (the story goes that if you ask any Chinese manufacturer what they plan to have as a marketing advantage, they all answer “Price”) will adopt Android because it gives them a software stack free of charge. Combine this innovation with Moore’s Law, and ask yourself what happens when the equivalent of a Samsung Galaxy Nexus is free with a contract, or perhaps $150-200 outright with no contract. There is no room for Apple’s margins in that scenario. And that is why I think Tim Cook may be the unluckiest guy in the world. When these things happen, no one will say that it was due to market forces that no one could have prevented. They will say that somehow Steve Jobs would prevented it, and that Tim Cook just was not up to the job.