Security Alert: Geinimi, Sophisticated New Android Trojan Found in Wild

The Threat:
A new Trojan affecting Android devices has recently emerged in China. Dubbed “Geinimi” based on its first known incarnation, this Trojan can compromise a significant amount of personal data on a user’s phone and send it to remote servers. The most sophisticated Android malware we’ve seen to date, Geinimi is also the first Android malware in the wild that displays botnet-like capabilities. Once the malware is installed on a user’s phone, it has the potential to receive commands from a remote server that allow the owner of that server to control the phone.

Geinimi is effectively being “grafted” onto repackaged versions of legitimate applications, primarily games, and distributed in third-party Chinese Android app markets. The affected applications request extensive permissions over and above the set that is requested by their legitimate original versions. Though the intent of this Trojan  isn’t entirely clear, t he possibilities for intent range from a malicious ad-network to an attempt to create an Android botnet.

Lookout has already delivered an update for its Android users to protect them against known instances of the Trojan. If you are already a Lookout user (free or premium), you are protected and no action is needed.

How it Works:
When a host application containing Geinimi is launched on a user’s phone, the Trojan runs in the background and collects significant information that can compromise a user’s privacy. The specific information it collects includes location coordinates and unique identifiers for the device (IMEI) and SIM card (IMSI). At five minute intervals, Geinimi attempts to connect to a remote server using one of ten embedded domain names. A subset of the domain names includes www.widifu.com, www.udaore.com, www.frijd.com, www.islpast.com and www.piajesj.com. If it connects, Geinimi transmits collected device information to the remote server.

Though we have seen Geinimi communicate with a live server and transmit device data, we have yet to observe a fully operational control server sending commands back to the Trojan. Our analysis of Geinimi’s code is ongoing but we have evidence of the following capabilities:

• Send location coordinates (fine location)
• Send device identifiers (IMEI and IMSI)
• Download and prompt the user to install an app
• Prompt the user to uninstall an app
• Enumerate and send a list of installed apps to the server

While Geinimi can remotely initiate an app to be downloaded or uninstalled on a phone, a user still needs to confirm the installation or uninstallation.

Geinimi’s author(s) have raised the sophistication bar significantly over and above previously observed Android malware by employing techniques to obfuscate its activities. In addition to using an off-the-shelf bytecode obfuscator, significant chunks of command-and-control data are encrypted. While the techniques were easily identified and failed to thwart analysis, they did substantially increase the level of effort required to analyze the malware. The Lookout Security team is continuing to analyze capabilities of new and existing Geinimi variants and will provide more information as we uncover it.

Who is affected?
Currently we only have evidence that Geinimi is distributed through third-party Chinese app stores. To download an app from a third-party app store, Android users need to enable the installation of apps from “Unknown sources” (often called “sideloading”). Geinimi could be packaged into applications for Android phones in other geographic regions. We have not seen any applications compromised by the Geinimi Trojan in the official Google Android Market.

There are a number of applications—typically games—we have seen repackaged with the Geinimi Trojan and posted in Chinese app stores, including Monkey Jump 2, Sex Positions, President vs. Aliens, City Defense and Baseball Superstars 2010. It is important to remember that even though there are instances of the games repackaged with the Trojan, the original versions available in the official Google Android Market have not been affected. As the Lookout team finds more variants of the Geinimi Trojan grafted onto legitimate applications, we’ll provide timely updates.

As stated above, Lookout has already delivered an update for its Android users to protect them against known instances of the Trojan.
 

How to Stay Safe:

• Only download applications from trusted sources, such as reputable application markets. Remember to look at the developer name, reviews, and star ratings.
• Always check the permissions an app requests. Use common sense to ensure that the permissions an app requests match the features the app provides.
• Be aware that unusual behavior on your phone could be a sign that your phone is infected. Unusual behaviors include: unknown applications being installed without your knowledge, SMS messages being automatically sent to unknown recipients, or phone calls automatically being placed without you initiating them.
• Download a mobile security app for your phone that scans every app you download. Lookout users automatically receive protection against this Trojan.

With the discovery of this new malware, it is more important than ever to pay attention to what you’re downloading. Stay alert and ensure that you trust every app you download. Stay tuned for more details on this threat.

via http://blog.mylookout.com/2010/12/geinimi_trojan/#

Our Thoughts:

Even though this originated in China, it has the potential to infect any phone worldwide.  We do not recommend downloading apps from anywhere besides the Android Marketplace unless you have experience doing so.  The apps that have caused the Trojan to be installed have come from 3rd party sites, NOT THE ANDROID MARKETPLACE, so use your best judgement at all times.  This virus may not seem to be doing much damage, but because it is compromising your personal information it has the potential to transmit not just your IMEI/serial number, but also penetrate your passwords, account information, etc.  Please do not take this lightly!  Also, we recommend that you install lookout mobile security onto your phone for additional protection.  Lookout is a free app found in the Android Marketplace that scans attachments and applications as you download and install as well as your entire phone daily.  It also allows you to wirelessly back up your information on their secure website and track your phone in case of loss or theft.  Finally, even though it is constantly running in the background, it only uses about 2% off your battery.

If your phone appears to be behaving in the ways described above, please contact tech support immediately at 1-888-211-4727.

Effective Jan. 1 2011, 5 new states will be banning handheld cellular phone use while driving.  If you are driving this holiday season, we urge you to be aware of these new laws and be safe in your vehicles. Many phones are now equipped with text-to-speech technology to both read you your texts and emails as well as listen to your voice and transcribe it to a text or email.  When it comes to phone calls, remember that you're still distracted when driving and talking at the same time.  Use your car's built-in Blue Tooth technology, or order a Blue Tooth headset (ours are 15% off through the holidays).  Remember, arriving to your destination safely should always be your first priority!

Handheld Cell Phones: 8 states (Calif., Conn., Del., Md., N.J., N.Y., Ore. and Wash.), D.C. and the Virgin Islands prohibit all drivers from using handheld cell phones while driving.

• Except for Maryland, all laws are primary enforcement—an officer may cite a driver for using a handheld cell phone without any other traffic offense taking place.

via Governors Highway Safety Association http://www.ghsa.org/html/stateinfo/laws/cellphone_laws.html

Cell Phone Driving Laws by State

 

Find out if there are any cell phone restrictions where you drive

For many, wireless communications has delivered on the promise of the untethered life by allowing us to stay in touch wherever we are and whenever we want. And for an increasingly mobile culture, "where" and “when” is often in the car. As with any activity you engage in when behind the wheel, using your cell phone while driving can pose potential risks. Already some states have mandated the use of hands free phone kits while driving for all drivers, while other states have laws for new drivers, and many states still have similar legislation pending.

Not sure where your state stands on driving and using cell phones? Here’s a list of how individual states are dealing with the issue and more specifically how it affects you. In most cases, you can still use a phone during emergency situations. Many states have laws about bus drivers using cell phones while driving that are not listed here. If you don’t see your state listed below, it simply means there is currently no cell phone driving laws on the books. If you want the latest and most current information on the topic, visit the National Highway Traffic Safety Administration (NHTSA).

 California

 Beginning in July 2008, teens with learner’s permits can’t talk on cell phones, send text messages, or use other interactive electronic devices while driving.  Simultaneously, all drivers need to use hands-free devices while driving.

 Colorado

 Drivers with a learner’s permit can’t use a cell phone while driving.

 Connecticut

 Hands-free devices are required while using a phone while driving.

 Delaware

 Drivers with a learner’s permit can’t use a cell phone while operating a car. UPDATE:  Starting January 1, 2010, all drivers are required to use a hands-free device while driving.


 District of Columbia

 All drivers must use a hands-free device while operating a car. Additionally, drivers with a learner’s permit can’t use a cell phone while operating a car.

Florida

 Drivers can use a cell phone while operating a car as long as the sound goes through only one ear; the other ear must be kept free to hear surrounding sound.

Illinois

 Drivers under the age of 18 can’t use a cell phone while operating a car. Additional restrictions may exist by jurisdiction.

Maine

 Drivers with a learner’s permit or under the age of 18 with restricted licenses can’t use a cell phone while driving.

Maryland

 Drivers with a learner’s/intermediate permit or under the age of 18 with restricted licenses can’t use a cell phone while driving. UPDATE: Starting January 1, 2010, all drivers are required to use a hands-free device while driving.


Massachusetts

 Drivers can use the cell phone while driving as long as it does not get in the way of the vehicle's operation and one hand is on the wheel at all times.

Minnesota

 Drivers with a learner’s permit or under the age of 18 can’t use a cell phone while driving.

Nebraska

 Beginning in January 2008, teens with provision, learner's, or school permits can’t talk on cell phones, send text messages, or use other interactive electronic devices while driving.

New Hampshire

 Cell phone use while driving is not forbidden, but fines are imposed on drivers who cause accidents while on the phone.

New Jersey

Drivers need to use a hands-free devices while driving, but the measure can only be enforced when the driver is violating another law. Additionally, drivers under age 21 or those on a graduate license permit/provisional license can’t use a phone while operating a vehicle.

New Mexico

Drivers of state vehicles must use a hands-free device when using a cell phone while driving. Both students and instructors in driver education situations are forbidden from using cell phones in the course of behind-the-wheel training. Additional restrictions may exist by jurisdiction.

New York

Hands-free devices are required while using a phone while driving.

North Carolina

Drivers under the age of 18 can’t use a cell phone while driving, except to call 911 or parents.

Ohio

Currently, there are no state laws, however, laws may vary by jurisdiction.

Oregon

Beginning in January 2008, drivers with a learner's permit and intermediate license holders can’t use a cell phone while operating a vehicle. UPDATE: starting January 1, 2011, all drivers are required to use a hands-free device while driving.


Pennsylvania

Currently, there are no state laws, however, laws may vary by jurisdiction.

Rhode Island

Drivers under the age of 18 can’t use a cell phone while driving.

Tennessee

Drivers with a learner’s permit or intermediate license can’t use a cell phone while driving on a highway.

Texas

Drivers with a learner’s permit/intermediate license or under the age of 18 with restricted licenses can’t use any handheld wireless device while driving.

Utah

State law covers "careless driving" offenses, such as when a driver commits a traffic violation while, for example, holding a cell phone.

Virginia

Drivers with intermediate licenses can’t use a cell phone or headset while driving.

Washington

Beginning in January 2008, drivers can’t compose or send text messages while driving. Starting July 2008, hands-free devices will be required for cell phone while driving.

West Virginia

Drivers with a learner’s permit or intermediate license can’t use a cell phone while driving.

via: http://www.letstalk.com/viewArticle.htm?artId=25

~Be safe on the roads, especially if the weather is getting bad.  Think you need a Bluetooth Headset?  Visit our accessory site and use the offer code 'HOLIDAY15' at checkout for 15% off of your order.