First Google Android Bootkit Found

Security researchers at NQ Mobile say they have found the first piece of Android bootkit malware

Researchers at NQ Mobile have uncovered what they say may be the first Google Android bootkit.
Dubbed DKFBootKit, the malware was spotted on third-party app stores. It originated in China, something it has in common with 31 percent of mobile malware, notes Xuxian Jiang, NQ Mobiles chief scientist. In the past two weeks, DKFBootKit has infected more than 1,657 Android devices, he says.
DKFBootKit is able to steal personal information from user devices, says Jiang. More alarmingly, it is a bot client that can retrieve and run commands from remote C&C [command and control] servers.
DKFBootKit repackages legitimate apps by enclosing its own malicious payloads in them,
according to the company.
The apps are typically utility applications that require root privileges to work properly, such as the applications that provide license keys for some premium applications.
Based on our study, DKFBootKit adds a common background service to victim apps, which once run will release a hidden executable program, NQ Mobile noted in an advisory on the malware. This hidden program will check whether it has the root privilege. If not, it terminates itself. Otherwise, it mounts the system partition as writable, copies itself into the /system/lib directory, replaces several commonly-used utility programs (e.g., ifconfig and mount), and alters related daemons (e.g., vold and debuggerd) and bootstrap-related scripts.
The purpose seems to be to allow it to run before the Android framework is initialized to start other apps, according to NQ Mobile.
Its worth mentioning that because DKFBootKit utilizes the root privilege, it can execute arbitrary commands, according to the advisory. We are still in the process of actively monitoring DKFBootKit C&C servers. An initial investigation of these C&C servers show(s) that the related domains were registered in January, 2012.
NQ Mobile advises Android users to avoid downloading applications from untrusted sources, and to stay alert for unusual behavior.
Given the complex nature of the malware, we expect to see more attacks around the world, Jiang says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
First Google Android Bootkit Found