Android Malware Uses Built-In Firewall to Block Security Apps

SOFTPEDIA ^ | 28 Dec 2015, 18:45 GMT | Catalin Cimpanu

[Utilizer]

Even if some malware families never get to cause worldwide damage, it's sometimes interesting to read about new techniques that some malware authors employ for creating their threats.

One of the most recent cases is a malware family that targets Android devices in China, discovered by Symantec, and named Android.Spywaller.

The uniqueness of this threat is the fact that during infection, the malware looks for Qihoo 360, a popular security app among Chinese Android users. Android.Spywaller uses a firewall to block Qihoo 360 internal communications

The malware searches and registers on the device with the same UID (unique identifier) used by the Qihoo 360 app, and then loads a binary called DroidWall, a version of the UNIX iptable package, modified to run on Android devices.

The iptable package is a well-known firewall utility for Linux systems, and DroidWall was developed by independent security researchers Rodrigo Rosauro, who later sold it to AVAST in 2011. Since the app spent a few years as open source, malware authors can still find it via Google Code or GitHub repositories.

[Utilizer]

Apparently not a major problem yet as it has so far only caused problems with Chinese users, this has the potential to spread from there so it is probably best to be aware of this problem. Looks more like trojanware, actually.

[Steely Tom]

Android Malware Uses Built-In Firewall to Block Security Apps

I believe Conficker did that too.

[JimRed]

Who creates these things, and why?

My guess is that the people who sell prevention and cures for them are responsible. Create a problem, sell a cure.

[Dalberg-Acton]

If this is not on Google play store, it isn’t a threat to any sane Android user.

[Utilizer]

You mean the same wankers that put the hope-’n-change Indonesian Muslim Community Organizer into office?

I’m willing to wager that many of them have Android devices, if not most of them. One could even imagine them possessing several in fact.

[Swordmaker]

Ping for the Android Ping list. . .

[kingu]

You live by the pirated software, you die by it as well.

[ThunderSleeps]

A scary "good" virus, one that will no doubt spawn imitators... - ANDROID PING!
Android Ping! If you want on or off the Android Ping List, Freepmail me.