More than 350,000 Android devices impacted by bootkit trojan

Share this article:

A particularly clever trojan has been discovered operating as a bootkit on more than 350,000 Android mobile devices, including a small percentage in the United States, according to a Friday post by Russian anti-virus company Dr. Web.

“To spread the trojan, which entered the Dr.Web virus database as Android.Oldboot.1.origin, attackers have used a very unusual technique, namely, placing one of the trojan components into the boot partition of the file system and modifying the [initialization] script which is responsible for the initialization of OS components,” according to the post.

What that means is that the trojan – which is designed to be able to download, install or remove certain applications on a device, according to the post – is extracted when the phone is turned on, thus making it hard to detect and less likely to be deleted.

According to the post, the threat is compounded because even if some parts of the malware are wiped from the mobile, a certain element will still remain in the system's memory and will reinstall every time the device is rebooted – creating a cycle of infection.

Dr. Web researchers have learned that the trojan is operating on roughly 350,000 devices, the majority of which are in China. A small percentage of victims were said to reside in Spain and an even smaller percentage were said to be in countries such as the United States, Germany and Brazil.  

“Reflashing a device with modified firmware that contains the routines required for the trojan's operation is the most likely way this threat is introduced,” according to the post.

Dr. Web did not respond to an SCMagazine.com request for comment.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

President signs Executive Order to improve payment security

President signs Executive Order to improve payment security

President Obama signed an Executive Order at the Consumer Financial Protection Bureau calling for enhanced security measures, including microchips and PINs.

Security, tech firm coalition fights Hikit actors, other advanced groups

Security, tech firm coalition fights Hikit actors, other ...

The coalition began as an effort to stop the spread of the Hikit trojan, previously known for targeting U.S. defense contractors.

Phishing email delivers keylogger malware, also takes screenshots

Phishing email delivers keylogger malware, also takes screenshots

The malware has various features, including the ability to start persistently, take screenshots and bypass user access controls.