Malicious Google Play Apps Linked to SideWinder APT

Researchers have discovered an attack exploiting CVE-2019-2215, which leverages three malicious apps in the Google Play store to compromise a target device and collect users' data.

This threat is linked to the SideWinder advanced persistent threat (APT) group, report Trend Micro's Ecular Xu and Joseph Chen in a blog post. Sidewinder, a group detected by Kaspersky Labs in the first quarter of 2018, primarily targets Pakistani military infrastructure and has been active since at least 2012. Security researchers believe the threat group is associated with Indian espionage interests and has a history of targeting both Windows and Android devices.

CVE-2019-2215 was disclosed in October 2019 by Maddie Stone of Google's Project Zero. The zero-day local privilege escalation vulnerability affected hundreds of millions of Android phones at the time it was published. A patch was released in December 2017 for earlier Android versions; however, new source code review indicated newer versions of the software were vulnerable.

The use-after-free vulnerability is considered "high severity" and requires a target to download a malicious application for potential exploitation. An attacker would have to chain CVE-2019-2215 with another exploit to remotely infect and control a device via the browser or another attack vector. The bug allows for a "full compromise" of a vulnerable device, Stone explained.

While it was "highly likely" the bug was being used in attacks last October, this marks the first known active campaign using it in the wild, Xu and Chen report. This particular vulnerability exists in Binder, the main interprocess communication system that exists in Android, and the three malicious apps used in the attack were disguised as photography and file manager tools.

Android apps Camero, FileCrypt Manager, and callCam are believed to be related to the SideWinder group and have been active on Google Play since March 2019, based on one of the apps' certificate information. All have since been removed from the Play store.

CallCam is the payload app and is installed in two stages, the researchers explain. First a DEX file — an Android file format — is downloaded from the command-and-control server. The downloaded DEX file downloads an APK file and installs it after exploiting the device or employing accessibility. Camero and FileCrypt Manager both act as droppers. After downloading the DEX file from the C2 server, they call extra code to download, install, and launch the callCam app.

Researchers note the C2 servers used are suspected to be part of SideWinder's infrastructure. Further, a URL linking to one of the apps' Google Play pages is on one of the C2 servers.

SideWinder relies on device rooting as one of its tactics to deploy callCam without alerting the victim. The malware retrieves a specific exploit from the C2 server depending on the DEX the dropper downloads. This approach only works on Google Pixel (Pixel 2 and Pixel 2 XL), Nokia 3 (TA-1032), LG V20 (LG-H990), Oppo F0 (CPH1881), and Redmi 6A devices.

Over the course of its investigation, Trend Micro was able to download five exploits from the C2 server and found they used CVE-2019-2215 and MediaTek-SU to gain root privileges. Once they achieve this, the malware installs callCam, enables accessibility permissions, and launches.

Another approach is using the accessibility permission, a technique used by the FileCrypt Manager on Android phones running Android 1.6 or higher. After launch, FileCrypt asks the user to enable accessibility. When granted, this displays a full-screen overlay that says it requires further setup. In the background, the app is calling code from the DEX file so it can download more apps and install callCam. It enables the accessibility permission and launches the payload.

"All of this happens behind the overlay screen, unbeknownst to the user," Xu and Chen write.

After launch, the callCam icon is hidden on the target device and collects data in the background to send to the C2 server. This information includes location, battery status, files stored on the device, list of installed apps, account data, Wi-Fi data, and information related to the device, sensor, and camera. It also pulls data from WeChat, Outlook, Twitter, Yahoo Mail, Facebook, Gmail, and Chrome. CallCam encrypts all of this stolen data using RSA and AES encryption, and uses SHA256 to verify the data's integrity and customize the encoding routine.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "What Tools Will Find Misconfigurations in My AWS S3 Cloud Buckets?"