Tizi Android malware highlights the importance of security patches for high-risk users

Posted by   Martijn Grooten on   Nov 28, 2017

A well-known security researcher once said: "if you purposely choose Android you are either Poor, Cheap, or really hate Apple."

Android has a bad reputation in security circles, though these days that is less because of a lack of effort on Google's part and more because of the prevalence of many older devices with unpatched vulnerabilities.

It is easy to make this problem seem bigger than it is. The typical Android vulnerability still requires an app to be installed which, on non-rooted devices, means that the app first needs to get onto Google Play – this is something that malware manages to do, quite regularly, and sometimes with a worryingly large number of downloads.

However, the prevalence of such Android malware is still small compared to that of Windows malware and may, for the average home user, not justify the cost of a new phone.

For users with a more advanced threat model, things are different though. A good example of this is 'Tizi', a backdoor family discovered by researchers from Google, which used various apps found on Google Play. The malware used one of nine vulnerabilities, all patched between 2013 and 2015, to obtain root on a device which was then used to record calls, siphon out messages, and access personal information.

It is unclear what kinds of users were targeted by this malware, but interestingly, some 80% of installations were found in Kenya, once again highlighting that malware is a truly global problem. (Those who attended Tyrus Kamau's VB2017 talk "The state of security in Africa: Kenya" will, of course, not be surprised by this.)

tizipiechart.png
Tizi installations by country. Source: Google.

Targeted malware attacks are certainly not limited to powerful intelligence agencies, and victims may be targeted for political, business and sometimes very personal reasons, as the widespread use of spyware in domestic abuse cases shows. For such potential victims, using a phone that will receive security patches is an important first step in their digital defence.

Finally, Google deserves credit for taking down this malware and for implicitly admitting that its efforts to keep Google Play malware-free are not 100% successful. That too, is an important first step.

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

Nominations opened for sixth Péter Szőr Award

Virus Bulletin is seeking nominations for the sixth annual Péter Szőr Award.

Haroon Meer and Adrian Sanabria to deliver VB2019 closing keynote

New additions to the VB2019 conference programme include a closing keynote address from Thinkst duo Haroon Meer and Adrian Sanabria and a talk on attacks against payment systems.

Free VB2019 tickets for students

Virus Bulletin is excited to announce that, thanks to generous sponsorship from Google Android, we are able to offer 20 free tickets to students who want to attend VB2019.

VB2018 paper: Lazarus Group: a mahjong game played with different sets of tiles

The Lazarus Group, generally linked to the North Korean government, is one of the most notorious threat groups seen in recent years. At VB2018 ESET researchers Peter Kálnai and Michal Poslušný presented a paper looking at the group's various…

Book your VB2019 ticket now for a chance to win a ticket for BSides London

Virus Bulletin is proud to sponsor this year's BSides London conference, which will take place next week, and we have a number of tickets to give away.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.