New malware 'takes over' Android smartphones

Android smartphone. (Duncan Alfreds, Fin24)
Android smartphone. (Duncan Alfreds, Fin24)

Cape Town – Android smartphones running older versions of the operating system are at risk from a family of Trojan malware that could take over the functioning of a phone.

According to security firm Kaspersky Lab, the malware consists of a collection of three families - Ztorg, Gorpo and Leech - dubbed “Triada”.

The malware is propagated when people download applications via untrusted sources and Kaspersky said the software grants itself super user rights, which allow cyber criminals to install any software on a phone without the owner’s consent or knowledge.

It affects smartphones running Android operating systems 4.4.4 or earlier.

“The Triada of Ztrog, Gorpo and Leech marks a new stage in the evolution of Android-based threats. They are the first widespread malware with the potential to escalate their privileges on most devices,” said Nikita Buchka, junior malware analyst at Kaspersky Lab.

Once Triada has loaded itself on to a device, it installs a backdoor and activates two modules that have the ability to download, install and launch applications.

Difficult options

READ: Data breaches spook SA's online buyers

“A distinguishing feature of this malware is the use of Zygote - the parent of the application process on an Android device - that contains system libraries and frameworks used by every application installed on the device. In other words, it’s a demon whose purpose is to launch Android applications,” Kaspersky said in a statement.

The software also able to modify other applications such as SMS. Should a user make an in-app purchase via SMS, criminals are able to redirect the funds to themselves, rather than developers.

The company said that users are faced with either “rooting” Android devices or jailbreaking the Android operating system to get rid of Triada.

Kaspersky Lab found that nearly half of the top 20 Trojans in 2015 were able to grant themselves super user rights.

“The complexity of the Triada Trojan’s functionality proves the fact that very professional cyber criminals, with a deep understanding of the targeted mobile platform, are behind this malware,” said Kaspersky.


- Follow Duncan on Twitter

ZAR/USD
16.62
(+0.64)
ZAR/GBP
21.53
(+0.29)
ZAR/EUR
19.53
(+0.36)
ZAR/AUD
11.97
(+0.07)
ZAR/JPY
0.16
(+0.63)
Gold
1898.46
(+0.58)
Silver
23.69
(+1.52)
Platinum
899.00
(+1.03)
Brent Crude
42.12
(+1.78)
Palladium
2311.01
(+0.86)
All Share
54790.08
(+0.97)
Top 40
50466.47
(+0.85)
Financial 15
10301.90
(+2.28)
Industrial 25
73699.97
(+0.70)
Resource 10
53752.96
(+0.69)
All JSE data delayed by at least 15 minutes morningstar logo
Company Snapshot
Voting Booth
Do you think it was a good idea for the government to approach the IMF for a $4.3 billion loan to fight Covid-19?
Please select an option Oops! Something went wrong, please try again later.
Results
Yes. We need the money.
11% - 1400 votes
It depends on how the funds are used.
73% - 9070 votes
No. We should have gotten the loan elsewhere.
16% - 1996 votes
Vote