First Google Android Bootkit Found

Researchers at NQ Mobile have uncovered what they say may be the first Google Android bootkit.

Dubbed DKFBootKit, the malware was spotted on third-party app stores. It originated in China, something it has in common with 31 percent of mobile malware, notes Xuxian Jiang, NQ Mobile's chief scientist. In the past two weeks, DKFBootKit has infected more than 1,657 Android devices, he says.

"DKFBootKit is able to steal personal information from user devices," says Jiang. "More alarmingly, it is a bot client that can retrieve and run commands from remote C&C [command and control] servers."

DKFBootKit repackages legitimate apps by enclosing its own malicious payloads in them, according to the company. The apps are typically utility applications that require root privileges to work properly, such as the applications that provide license keys for some premium applications.

"Based on our study, DKFBootKit adds a common background service to victim apps, which once run will release a hidden executable program," NQ Mobile noted in an advisory on the malware. "This hidden program will check whether it has the root privilege. If not, it terminates itself. Otherwise, it mounts the system partition as writable, copies itself into the /system/lib directory, replaces several commonly-used utility programs (e.g., ifconfig and mount), and alters related daemons (e.g., vold and debuggerd) and bootstrap-related scripts."

The purpose seems to be to allow it to run before the Android framework is initialized to start other apps, according to NQ Mobile.

"It's worth mentioning that because DKFBootKit utilizes the root privilege, it can execute arbitrary commands," according to the advisory. "We are still in the process of actively monitoring DKFBootKit C&C servers. An initial investigation of these C&C servers show(s) that the related domains were registered in January, 2012."

NQ Mobile advises Android users to avoid downloading applications from untrusted sources, and to stay alert for unusual behavior.

"Given the complex nature of the malware, we expect to see more attacks around the world," Jiang says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.