An Old Android Virus is Reinstalling Itself Even After Factory Resets (inputmag.com) 58
A particularly persistent malware infection has been spreading amongst Android phones -- and removing it only seems to bring it back with a vengeance. From a report: The Trojan xHelper, which Malwarebytes first wrote about last year, is reportedly re-spawning on devices where it's already been removed. If virus-removal software doesn't take care of a nasty infection, a hard reset will usually do the trick. But users report that even a full factory reset of an infected device doesn't wipe xHelper out completely. Within an hour the malware is usually back and ready to wreak havoc. Here's how to remove it.
Re: (Score:3)
Re: (Score:2)
My dumbphone is safe.
Re: (Score:3, Funny)
I don't use a phone either. Nor a computer, for that matter. In fact, I don't even use the internet! Did I mention that I don't watch TV and I'm vegan?
Re: Hahahaha (Score:2)
Re: Hahahaha (Score:2)
So is my iPhone.
Re: (Score:2)
Re: (Score:2)
It actually wouldn't surprise me if it's possible. It's digital, I'm sure, and receives signaling data - maybe even texts and Bluetooth? Being a low-margin, non-connected device, it's probably never had a code audit, or even a serious look-see. I'd not be at all surprised if there were some low-hanging fruit to be plucked.
That said, it's certainly not worth anyone's time to do it, except maybe bragging rights, so as a practical matter, you're pretty safe.
Re: (Score:1)
Factory resets are insufficient (Score:2)
What you need is a complete reload - and all phone manufacturers should provide full software load images to allow you to really clear your phone.
"OLD" (Score:2)
Malware from May 2019 is now considered "OLD". Wow.
Re: (Score:2)
Malware from May 2019 is now considered "OLD". Wow.
When anti-virus and malware updates are checked hourly and delivered daily, why would it not? This is an obscenely dynamic environment.
Hell, we often see firmware alerts more often than that.
Re: (Score:2)
Re: (Score:2)
So basically, smartphones are The Borg.
Re: (Score:3)
What is Google doing to address this attack vector (Score:3, Interesting)
Re: (Score:2)
Is Google actively working on the issue, to block all but specific files from lingering after a reset? This is important, as I like Android but will switch to an iPhone if Google can't do a much better job. Come on Google. Do your best, not 98% of the best.
That's assuming Google takes responsibility.
Google is the OEM provider of the OS. That doesn't mean they're the ones ultimately responsible (which is a large part of this problem with Android OS). The phone manufacturer all the way up to the service provider may also have responsibility here as well. Change the OEM version in any way, and you've allowed the OEM to essentially weasel out of being responsible, while also giving them a finger to point at others.
This is also why some prefer Apple. One throa
Re: (Score:2)
But this exploit is using a flaw in the OS provided by the OEM to by pass a factory reset. The OS somehow provides a mechanism for flagging files stored on one device as actually belonging to another device. So files stored on the phone somehow get flagged as being stored on a non-existent SD card. So when the phone goes into factory reset, it resets the data on the phone. Since the files in question are to the OS stored on an SD card, those files are left alone. There's a flaw in some layer of the OS
Re: (Score:2)
But this exploit is using a flaw in the OS provided by the OEM to by pass a factory reset. The OS somehow provides a mechanism for flagging files stored on one device as actually belonging to another device. So files stored on the phone somehow get flagged as being stored on a non-existent SD card. So when the phone goes into factory reset, it resets the data on the phone. Since the files in question are to the OS stored on an SD card, those files are left alone. There's a flaw in some layer of the OS that the OEM is providing that's allowing this to happen. Clearly the OS maker has the responsibility to patch this.
While your analysis may be accurate (to which I would agree with you), good luck finding responsibility in a sea of Android finger-pointing.
(Example bullshit OEM response): "Well, why didn't you have an SD slot?"
Re: (Score:2)
> While your analysis may be accurate (to which I would agree with you), good luck finding responsibility in a sea of Android finger-pointing
It sounds like it's doing the kind of wipe that preserves /data/sdcard, for people to keep their data. Something must be interacting with that data to get it to reinfect.
e.g. a media buffer overflow exploit can exploit the Google media Indexer. If it's not vulnerable at Google's current patchlevel then it's the OEM's fault. It it is vulnerable at the current patch
Re: (Score:1)
You want an OS update from an Android phone? Good luck with that. Apple does 5 years of updates for iPhone.
Re: What is Google doing to address this attack ve (Score:2)
Now, recently, Apple stopped updating the iPhone 6, but I'm quite sure that it was for sale less than 2 years ago.
Add to that that my OnePlus 3T is supported by Lineage OS (my re
Re: (Score:2)
My now 4 year old Samsung phone is on the latest security patch level. Apple may provide full OS updates for 5 years and Android may not, but that has nothing to do with security as just like on a PC the security updates are completely independent of the OS version of Android.
Re: (Score:2)
It doesn't appear to be OS related but rather Play Store related. Google provides security updates for all phones for any part of the system it can keep up to date over the play store, which these days are a large part of the network facing features.
I'll bet you a Marsbar that fixing this doesn't even need a user to apply a security update (which many vendors offer for 5 years as well and has nothing to do with OS version).
Re: (Score:2)
> I like Android but will switch to an iPhone if Google can't do a much better job
Most of the world's Android customers can't afford to make this threat. But since you are you should ask why Apple has a trillion dollars and won't effectively counter Cellebrite before making any decisions.
Re: (Score:3)
Probably. Fixing bugs takes time and isn't usually very exciting, it's unlikely that any of the bugfixing process would get any media coverage. It might get another story once they actually fix the bug, but that may be a while.
Re: (Score:1)
Re: (Score:2)
Is Google actively working on the issue, to block all but specific files from lingering after a reset?
Nothing lingers after reset. Android has a read only partition and a writable partition. A factory reset completely nukes the writable one. Read the linked article. The malware was NOT present after a reset but reinstalled itself through Google Play via some vector, most likely the malware alters something in the user's Google account that triggers a reinstall.
Factory Reset not a Factory Reset (Score:1)
This would only happen, of course, if the "Factory Reset" did not actually "reset" the device to a factory state. Either the "Factory Reset" does not function properly (a Google/Android bug by not removing *all* files not part of the factory image) *or* the user only chose to do a partial "Factory Reset".
The article is unclear as to whether the luser failed to do a full "Factory Reset" or if the "Factory Reset" is itself defective.
Re: (Score:2)
I just tried doing a "Factory Reset" on my old Samsung Galaxy S3 and sure enough, the "Factory Reset" reformatted the filesystem and restored the device to a "Factory" state. Nothing survived. No files on internal storage were preserved. Nada. Zilch. ZIppo.
So it would appear that the luser in the article did not actually perform a Factory Reset. They did something else which they thought was a Factory Reset but was not, actually, a Factory Reset.
Re: (Score:2)
Re: (Score:2)
It's not a datapoint, it's the fundamental way Android works. The factory image resides on a read only partition on the device. Any user changes reside on another partition and that partition gets formatted during a factory reset. Back 100% to factory conditions including wiping the malware. Read the link in the summary it even mentions that the malware is not initially present after a factory reset, and that it is triggered through Google Play indicating that it is related to the user account, and I'll bet
Re: (Score:2)
They weren't using a Samsung; their vendor's "Factory Reset" may be less complete than yours. While this would still mean the user did something they thought was FR but not actually FR it is not necessarily the fault of the user.
Re: (Score:2)
their vendor's "Factory Reset" may be less complete than yours.
Factory resetting *any* Android device involves nothing more than formatting all user writable partitions. Samsung is not unique in this regard, and read the link the malware does not persist across factory resets, but rather it reinstalls itself which is something to do with Google Play and the user account.
Re: (Score:3)
The "fix" is to have a "soft wipe" and a "hard wipe" to allow a quicker full reset, and a fuller factory reset.
This isn't just a "google" issue, but a handset problem.
Re: (Score:2)
Most "factory reset"s don't reset to factory. They reset to a snapshot. This is "good" because it stores security updates and the like, so you don't have to re-download all updates after a reset. But also, it's bad. It can capture malware inside the "factory reset".
The "fix" is to have a "soft wipe" and a "hard wipe" to allow a quicker full reset, and a fuller factory reset.
This isn't just a "google" issue, but a handset problem.
False. Factory reset resets to the *current* factory image of the phone. That is if you take a 2 year old phone, apply all updates and do a factory reset, you will have the same factory device as the one you pickup from the store today (assuming that hasn't been sitting on the shelf for 2 years).
The only way to modify your "snapshot" (which isn't a snapshot at all but rather the current factory image) is via the bootloader writing to a read only partition. This is also why you can't apply security updates h
Re: (Score:2)
Malware has no vector to apply the update, unless of course it is cryptographically signed by the vendor and thus could actually be installed by the bootloader.
Yup. All the malware needs to do is MITM them update. You make it sound impossible. It's been done before, and is essentially one of the ways to "jailbreak" a phone. A privilefe elevation to add in a malicious root server, then have the fraudulent code signed by that.
There are many more ways to do it, but I don't have time to list them all, and wouldn't want to give anyone bad ideas.
Re: (Score:2)
Considering that the way it's done in the factory is by flashing an image, no factory reset function is going to be that. It's an attempt to imitate that with safeguards. No question it's being done, but a factory reset can't actually happen the way it happens at the factory unless you have a dedicated ROM sitting there waiting to re-flash the phone.
Re: (Score:2)
Considering that the way it's done in the factory is by flashing an image, no factory reset function is going to be that
Nope. Factory resets flash an image into one partition that is completely unchanged in any process other than flashing another image (via a bootloader based update). User changes are written to a completely empty writable partition. If you nuke that partition like the factory does then your device is indistinguishable from another device currently sitting on the store shelf in every way except for hardware IMEI, hardware security keys, and the scratches you made on the case.
Re: (Score:2)
Clearly a software flash is not even involved in a "factory reset" - it wouldn't be needed if that partition truly hadn't changed.
If this malware had root access, it could certainly add folders to that read only partition outside of an update. Unless you install an update after resetting, the OS won't get rewritten.
I don't think it's quite known how it worked yet, but it does involve persistent files bring processed by the Play Store app.
Re: (Score:2)
You're right, it's NOT a "factory reset". It's a "delete all users, apps, and reset all settings". If you have an iPhone, you have two reset options - a "delete all data and settings", and an actual "full reset". The former is like what android offers, but CAN miss things. The latter reboots off a recovery, FORMATS the main partition, and restores the FACTORY installation. That's how you do a "factory reset". Nothing that wasn't on the phone when you unboxed it is there after such a reset. ZERO chanc
Re: (Score:2)
ZERO chance of persistence by malware.
Very low, but probably not quite zero. Given that a full reset requires itunes, in theory, a compromised iphone could compromise the PC it was plugged into via USB and muck with the image blown back into the phone (and, bonus points, you've got a foothold in the PC as well).
It seems EXTREMELY unlikely that someone would craft malware like this (far more complicated having to be able to compromise multiple systems, much larger footprint, easier to detect) but it is not hard to envision scenarios where a sta
Re: (Score:2)
Re: (Score:2)
You're right, it's NOT a "factory reset". It's a "delete all users, apps, and reset all settings".
False. All user apps and settings reside on a writable partition as distinct from the OS itself which resides on a read only partition that is only ever written by the bootload (i.e. during a reboot when applying an update). Factory reset deletes all user writable partitions at which point the phone is completely indistinguishable from any other phone running that version of the OS and that security patch level (and hardware static strings like IMEI).
Re: (Score:2)
This would only happen, of course, if the "Factory Reset" did not actually "reset" the device to a factory state.
And you'd be wrong. Read the linked article. Factory Reset does reset the device completely including wiping the malware. Something related to the Playstore and the user account causes this malware to reinstall.
Public service announcement (Score:2)
tl;dr (Score:2)
Re: (Score:1)
App reinstalling (Score:2)
The only plausible attack vector for this would be reinstalling the same compromised application.
PEBKAM
Re: (Score:1)
i only know of pebkac
is pebkam a new strain?
Re: (Score:2)
The only plausible attack vector for this would be reinstalling the same compromised application.
Correct.
PEBKAM
Incorrect. RTFA.
Insert free advert for Malwarebytes (Score:2)
How?
“Malwarebytes has found that somehow the Trojan xHelper is being deployed from the Play Store itself”
A total non story then.