By 
Beware of AbstractEmu, a new malware attacking Android devices.
The Nigerian Communications Commission (NCC) is alerting telecom consumers and other stakeholders to be wary of a new Android malware named ‘AbstractEmu.’ It can gain access to smartphones, take complete control of infected smartphones and silently modify device settings while simultaneously taking steps to evade detection.
In Nigeria, this discovery was announced recently by the Nigerian Computer Emergency Response Team (ngCERT), the national agency established by the federal government to manage the risks of cyber threats in the country.
The ngCERT also coordinates incident response and mitigation strategies to proactively prevent cyberattacks against Nigeria.
Global Alert: AbstractEmu distributed via Google Play Store, Amazon Appstore, Samsung Galaxy Store
There is already a global alert on the malware. According to SecurityWeek, malware hunters at Lookout Security discovered the Android rooting malware which has already managed to score tens of thousands of downloads through Google Play and third-party application stores. The “malware attempts to gain root access by exploiting several vulnerabilities identified in 2019 and 2020, as well as two from 2015.”
The report by Lookout Security suggests the malware operators were targeting users globally, SecurityWeek noted with users in 17 countries already affected – the United States has suffered the hardest hit.
In addition to Google Play Store, AbstractEmu has been found to be distributed via third-party stores such as the Amazon Appstore and the Samsung Galaxy Store, as well as other lesser-known marketplaces like Aptoide and APKPure. The apps include All Passwords, Anti-ads Browser, Data Saver, Lite Launcher, My Phone, Night Light and Phone Plus, among others.
The ngCERT advisory stated that a total of 19 Android applications that posed as utility apps and system tools like password managers, money managers, app launchers, and data saving apps have been reported to contain the rooting functionality of the malware.
According to the report, rooting malware although rare, is very dangerous. By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant itself dangerous permissions or install additional malware – steps that would normally require user interaction. Elevated privileges also give the malware access to other apps’ sensitive data, something not possible under normal circumstances.
Once installed, AbstractEmu leverages older Android security flaws to gain root permissions
The ngCERT advisory also captured the consequences of making their devices susceptible to AbstractEmu attack. Once installed, the attack chain is designed to leverage one of five exploits for older Android security flaws that would allow it to gain root permissions. It also takes over the device, installs additional malware, extracts sensitive data, and transmits to a remote attack-controlled server.
Additionally, the malware can modify the phone settings to give app ability to reset the device password, or lock the device, through device admin; draw over other windows; install other packages; access accessibility services; ignore battery optimisation; monitor notifications; capture screenshots; record device screen; disable Google Play Protect; as well as modify permissions that grant access to contacts, call logs, Short Messaging Service (SMS), Geographic Positioning System (GPS), camera, and microphone.
The ngCERT also asserts in the advisory that, while the malicious apps were removed from Google Play Store, the other app stores are likely distributing them. Consequently, the NCC wishes to reiterate a two-fold ngCERT advisory in order to mitigate the risks. The two-fold advisory include:
1. Users should be wary of installing unknown or unusual apps, and look out for different behaviours as they use their phones.
2. Reset your phone to factory settings when there is suspicion of unusual behaviours in your phone.
The NCC, in exercise of its mandate and obligation to the consumers, will continue to sensitise and educate telecoms consumers on any cyber threat capable of inflicting low or high-impact harms on their devices, whether discovered through the ngCERT or the telecom sector’s Centre for Computer Security Incident Response managed by the Commission.
Last October, the NCC alerted telecom consumers of the existence of new, high-risk and extremely-damaging, Android device-targeting malware called Flubot. The telecoms regulator outlined steps to prevent Android devices from being attacked by the virus.
IMAGE: Daily Express
