More than 350,000 Android devices impacted by bootkit trojan

Share this article:

A particularly clever trojan has been discovered operating as a bootkit on more than 350,000 Android mobile devices, including a small percentage in the United States, according to a Friday post by Russian anti-virus company Dr. Web.

“To spread the trojan, which entered the Dr.Web virus database as Android.Oldboot.1.origin, attackers have used a very unusual technique, namely, placing one of the trojan components into the boot partition of the file system and modifying the [initialization] script which is responsible for the initialization of OS components,” according to the post.

What that means is that the trojan – which is designed to be able to download, install or remove certain applications on a device, according to the post – is extracted when the phone is turned on, thus making it hard to detect and less likely to be deleted.

According to the post, the threat is compounded because even if some parts of the malware are wiped from the mobile, a certain element will still remain in the system's memory and will reinstall every time the device is rebooted – creating a cycle of infection.

Dr. Web researchers have learned that the trojan is operating on roughly 350,000 devices, the majority of which are in China. A small percentage of victims were said to reside in Spain and an even smaller percentage were said to be in countries such as the United States, Germany and Brazil.  

“Reflashing a device with modified firmware that contains the routines required for the trojan's operation is the most likely way this threat is introduced,” according to the post.

Dr. Web did not respond to an SCMagazine.com request for comment.

Share this article:

Sign up to our newsletters

More in News

DDoS attacks remain up, stronger in Q2, report says

DDoS attacks remain up, stronger in Q2, report ...

Prolexic's second quarter DDoS report noted the proliferation of shorter attacks that ate up more bandwidth.

Superman soars above fellow superheroes as most toxic search term

A McAfee study found that searches pertaining to Superman exposed users to the most infected websites.

Black Hat talk on Tor weaknesses canceled

Black Hat organizers say legal counsel for the Software Engineering Institute and Carnegie Mellon University nixed the session.