Malware devs already bypassed Android 13's new security feature

guest · Aug 17, 2022

August 17, 2022

Android malware developers are already adjusting their tactics to bypass a new 'Restricted setting' security feature introduced by Google in the newly released Android 13.

Android 13 was released this week, with the new operating system being rolled out to Google Pixel devices and the source code published on AOSP.
As part of this release, Google attempted to cripple mobile malware that attempted to enable powerful Android permissions, such as AccessibilityService, to perform malicious, stealthy behavior in the background.
Click to expand...

However, analysts at Threat Fabric today say malware authors are already developing Android malware droppers that can bypass these restrictions and deliver payloads that enjoy high privileges on a user's device.

In Android 13, Google's security engineers introduced a 'Restricted setting' feature, which blocks sideloaded applications from requesting Accessibility Service privileges, limiting the function to Google Play-sourced APKs.
However, researchers at ThreatFabric were able to create a proof-of-concept dropper that easily bypassed this new security feature to gain access to Accessibility Services.
Click to expand...

Bypassing Android's Restricted settings
In a new report released today, Threat Fabric has discovered a new Android malware dropper that is already adding new features to bypass the new Restricted setting security feature.

While following the Xenomorph Android malware campaigns, Threat Fabric discovered a new dropper still under development. This dropper was named "BugDrop" after the many flaws that plague its operation at this early phase.
This novel dropper features code similar to Brox, a freely distributed malware development tutorial project circulating on hacker forums, but with a modification in one string of the installer function.
Click to expand...

Hadoken group
BugDrop is still a work in progress by a group of malware authors and operators named 'Hakoden,' who are also responsible for creating the Gymdrop dropper and the Xenomorph Android banking trojan.

When BugDrop is ready for mass deployment, it is expected to be used in Xenomorph campaigns, enabling on-device credential theft and fraud behavior on the most recent Android devices.
Click to expand...

ThreatFabric: 2022 mobile threat landscape update

Finally, we will present a brief overview on how Google has introduced several updates in Android 13 that are designed to protect users against malware misusing Accessibility Service. However, our research team has successfully overcome these limitations and managed to avoid the new restrictions added in the new OS version.
Click to expand...

Log in or Sign up

Malware devs already bypassed Android 13's new security feature

guest Guest

Log in or Sign up

Malware devs already bypassed Android 13's new security feature

guest Guest

Useful Searches