2-Extended Analysis-Full

Communities @ Risk 41EXTENDED ANALYSIS: 2.2 Cluster AnalysisThe malicious versions of both applications have the same functionality enumerated below:• On a periodic basis the user’s contacts, call history, SMS messages, and cellularnetwork configuration are written to an encrypted file called info.txt.• The malware periodically contacts the C2 server “android.uyghur.dnsd.me” to retrieveupdated configuration information, such as URLs and login credentials. This configurationinformation directs the malware to an upload location for the info.txt file. Thesite hosting the C2 appears to emulate the appearance of the Baidu website (a Chinesesearch engine), but includes encrypted configuration data hidden in the comments. Bymasking the C2 as a seemingly innocuous website, requests would appear to be legitimateon casual inspection. The configuration data contained in the comments directs themalware to upload captured data from the device to an FTP server and contain a pointerto a new C2 that would allow the attackers to change the C2 should that need arise.• The malware intercepts SMS messages and searches for a special code sent by theattacker, which, if detected, responds to the sender with the base station ID, tower ID,mobile network code and mobile area code of the infected phone in question. Thismessage is not displayed to the user, and they are never made aware of it.OBSERVATIONSThe compromised Android applications that we detected as part of our study, as wellas mobile malware described by other security researchers, show that mobile devicesare indeed targets for espionage attackers. These attacks serve as early examples of atrend that seems likely to grow alongside the rapid spread of mobile computing.As described above, there are particular security risks for users residing in locationswhere access to standard secure channels for installing mobile applications is restricted.As users are required to distribute and install APKs of unknown provenance,they are at increased risk of malicious applications, particularly if those applicationsuse fake certificates (as was the case in this attack).