Just last week, police forces across Europe arrested individuals who they believed had been using the notorious DroidJack malware to spy on Android users. Now attention has been turned on to another piece of software that can spy on communications, secretly record conversations, snoop on browsing histories and take complete control of a remote device. But, unlike DroidJack, OmniRAT doesn't limit itself to Android users - it can also hijack computers running Windows and Mac OS X too. And that's not the only difference between DroidJack and OmniRAT. Both of them may be being sold openly online, but OmniRAT retails for as little as $25 compared to DroidJack's more hefty $210. Security researchers at the anti-virus company Avast describe OmniRAT as a "Remote Administration Tool. And it certainly can be used for entirely legitimate purposes, with the permission and consent of the owners of Android, Mac and Windows computers it tries to control. But, in the wrong hands, it can also be considered a "Remote Access Trojan" - giving malicious hackers an opportunity to sneakily spy on and steal from unsuspecting users duped into installing the code.
In his blog post, researcher Nikolaos Chrysaidos describes how he believes hackers have infected Androids with OmniRAT after sending an SMS. Apparently, a German Android user explained on the Techboard-online forum how he had received an SMS telling him that an MMS had not been delivered directly to him due to the StageFright vulnerability. In order to access the MMS, the user was told to follow a bit.ly link within three days, and enter a PIN code. However, as Crysaidos explains, visiting the URL would initiate the attempt to install OmniRAT onto the target's Android device:
Once you enter your number and code, an APK, mms-einst8923, is downloaded onto the Android device. The mms-einst8923.apk, once installed, loads a message onto the phone saying that the MMS settings have been successfully modified and loads an icon, labeled “MMS Retrieve” onto the phone. Once the icon is opened by the victim, mms-einst8923.apk extracts OmniRat, which is encoded within the mms-einst8923.apk. In the example described on Techboard-online, a customized version of OmniRat is extracted.
Perhaps the long list of permissions requested by the app would make you think twice, if it weren't so common for so many popular apps in the Google Play store to make similar requests.
The problem of course is that through its cunning social engineering, and the target's keen attempt to view the MMS that they might have been sent, it may be all too likely that the user grants permission for the app to be installed without thinking of the possible consequences. And, as the app is capable of sending its own SMS messages, it may be that your infected Android device could then send further messages with malicious intent to your friends, family and colleagues, in the hope of hijacking further devices. After all, users are more likely to be tricked into believing a message is legitimate, and letting their guard down, if they receive a message apparently coming from someone they know and trust. Sadly victims will probably have no clue that their devices are compromised, and even if they uninstall the MMS Retrieve icon, the customised version of OmniRAT remains installed on their Android smartphone, and will be sending data to a command and control (C&C) server seemingly based in Russia:
So, the question to ask is how should you protect yourself? Well, clearly you should resist the urge to install apps onto your smartphone from anywhere other than the official app stores. Although malware has unfortunately snuck into the Google Play store in the past, you're much more likely to encounter malicious code from unauthorised sources. Furthermore, I would recommend running a security product on your Android device to detect malicious code and that - if possible - you keep your Android smartphone patched with the latest version of the operating system. Finally, always think long and hard before clicking on links from untrusted sources. It could be that you're just one click away from a hacker trying to take remote control of your Android phone. Editor’s Note: The opinions expressed in this and other guest author articles are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc. Image source: ThomasHawk/Flickr. Creative Commons.
Mastering Security Configuration Management
Master Security Configuration Management with Tripwire's guide on best practices. This resource explores SCM's role in modern cybersecurity, reducing the attack surface, and achieving compliance with regulations. Gain practical insights for using SCM effectively in various environments.
