June 14, 2021

Geinimi: New Android Data Stealing Trojan

Geinimi, a new Android data stealing Trojan affecting Android cell phones in China.

According to Lookout blog reports, this Trojan can compromise a significant amount of personal data on a user’s phne and send it to remote servers. Geinimi is also the first Android malware in the wild that displays botnet-like capabilities. Once the malware is installed on a user’s phone, it has the potential to receive commands from a remote server that allow the owner of that server to control the phone.

“Geinimi is effectively being “grafted” onto repackaged versions of legitimate applications, primarily games, and distributed in third-party Chinese Android app markets. The affected applications request extensive permissions over and above the set that is requested by their legitimate original versions. Though the intent of this Trojan isn’t entirely clear, the possibilities for intent range from a malicious ad-network to an attempt to create an Android botnet.”, stated in the report.

In addition to the personal data such as address book, the Trojan can also read out the cell phone’s position data, device ID (IMEI), SIM card number (IMSI), and a list of the installed apps.

More information is available here.


Web-injection Vulnerabilities in WebOS

Researchers at SecTheory has discovered multiple flaws in the WebOS smartphone platform with possibility of build a mobile botnet or execute other remote attacks.

The most dangerous of the vulnerabilities is an injection flaw on the WebOS version 1.4.X that allows remote command and control, including access to a phone’s files or injecting a remote JavaScript backdoor into the phone’s Contacts Application to build a botnet.

Read the full story here.