First Malicious IRC Bot For Android Shows Up, Allows The Attacker Full Remote Control

acr1965 · Jan 13, 2012

http://www.androidpolice.com/2012/0...up-allows-full-remote-control-of-your-device/

We've seen our fair share of Android malware hit the scene, but the guys over at Kaspersky Labs have stumbled upon something rather alarming: the first IRC bot for Android. For those unaware, an IRC bot is a tool that provides automated function inside of an IRC channel. While very useful in many scenarios, IRC bots are also often used for malicious intent, such as the case at hand. It's worth noting here that, with the way this attack works, remote commands could be sent via any medium - SMS, webserver, etc. The attacker has just chosen IRC as the platform for this exploit.

Once installed, the malware (ironically) disguises itself as Madden NFL 12 - a seemingly trustworthy app. Unlike this guise may suggest, though, the application actually consists of three malicious components: a root exploit (using Gingerbreak - more on why that's important in a bit), an SMS Trojan, and the IRC bot. The files are extracted and stored in /data/data/com.android.bot/files as "header01.png," "footer01.png," and "border01.png" respectively. The directory is then given read/write/executable permissions.
Click to expand...

Log in or Sign up

First Malicious IRC Bot For Android Shows Up, Allows The Attacker Full Remote Control

acr1965 Registered Member

Log in or Sign up

First Malicious IRC Bot For Android Shows Up, Allows The Attacker Full Remote Control

acr1965 Registered Member

Useful Searches