Kaspersky Lab experts have discovered a modification of the Gugi banking trojan that can bypass new Android 6 security features designed to block phishing and ransomware attacks.
The modified trojan forces users into giving it the right to overlay genuine apps, send and view SMS, make calls, and more. It is spread through social engineering and its use by cybercriminals is growing rapidly: between April and early August, 2016, there was a ten-fold increase in its number of victims.
The Gugi Trojan’s aim is to steal users’ mobile banking credentials by overlaying their genuine banking apps with phishing apps, and to seize credit card details by overlaying the Google Play Store app. In late 2015, Android OS version 6 was launched, with new security features designed specifically to block such attacks.
Among other things, apps now need the user’s permission to overlay other apps, and to request approval for actions such as sending SMS and making calls the first time they want to access them.
Kaspersky Lab anti-malware experts have uncovered a modification of the Gugi Trojan that can successfully bypass these two new features.
Initial infection with the modified trojan takes place through social engineering, usually with a spam SMS that encourages users to click on a malicious link. Once installed on the device, the trojan sets about getting the access rights it needs. When ready, the malware displays the following sign on the user’s screen: “additional rights needed to work with graphics and windows”. There is only one button: “provide”.
When the user clicks on this, they are presented with a screen asking them to authorize app overlay. After receiving permission, the trojan will block the device screen with a message asking for ‘Trojan Device Administrator’ rights, and then ask for permission to send and view SMS and to make calls.
If the trojan does not receive all the permissions it needs, it will completely block the infected device. If this happens, the user’s only option is to reboot the device in safe mode and try to uninstall the trojan, an activity that is made harder if the trojan has already gained ‘Trojan Device Administrator’ rights.
Aside from these security workarounds and a few other features, Gugi is a typical banking trojan: stealing financial credentials, SMS and contacts, making USSD requests and sending SMS as directed by the command server. To date, 93% of users attacked by the Gugi Trojan are based in Russia, but its number of victims is on the rise. In the first half of August 2016 there were ten times as many victims as in April 2016.
“Cybersecurity is a never-ending race. OS systems such as Android are continuously updating their security features to make life harder for cybercriminals and safer for customers; cybercriminals are relentless in their attempts to find ways around this; and the security industry is equally busy making sure they don’t succeed. The discovery of the modified Gugi Trojan is a good example of this. In exposing the threat, we can neutralize it, and help to keep people, their devices and their data safe,” said Roman Unucheck, Senior Malware Analyst, Kaspersky Lab.
Kaspersky Lab advises Android users to take the following steps to protect themselves against the Gugi Trojan and other malware threats:
Don’t automatically agree to hand over rights and permissions when an app asks you to do so – think about what is being asked for, and why you are being asked for it.
Install an antimalware solution on all devices and keep OS software up-to-date.
Avoid clicking on links in messages from people you don’t know, or in unexpected messages from people you do.
Exercise caution at all times when visiting websites: if something looks even slightly suspicious, it probably is.
The Trojan-Banker.AndroidOS.Gugi family has been known about since December 2015, with the modification Trojan-Banker.AndroidOS.Gugi.c first discovered in June 2016. Kaspersky Lab products detect all modifications of the Gugi Trojan malware family.
38391 449608Youll be able use all sorts of advised attractions with various car treatments. A quantity of sell traditional tools numerous demand families for almost any event for any investment district, or even for a holiday in new york. ???? ??? ?????? ????? 299622
176998 982228Yay google is my world beater assisted me to uncover this wonderful internet web site ! . 613702
605027 482123I genuinely like your writing style, great data, thankyou for posting : D. 961306
353086 487816This is the first time I frequented your website page and to thispoint? I amazed with the research you made to create this actual put up incredible. 722041
43595 823248I like this web site quite much, Its a really good situation to read and get information . 52582
576347 897711Hello there, I discovered your blog by way of Google at exactly the same time as looking for a comparable topic, your web site got here up, it seems to be great. Ive bookmarked it in my google bookmarks. 862023
512064 604375I want going to comment as this posts a bit old now, but just wanted to say thanks. 726440
992597 470984But wanna say that this is invaluable , Thanks for taking your time to write this. 736752
695101 320393Aw, this was a truly nice post. In concept I wish to put in writing like this moreover – taking time and actual effort to make an superb article nonetheless what can I say I procrastinate alot and not at all appear to get something done. 178784
The CBD SEO Power delivers top-notch services for the benefit of businesses in the thriving CBD industry. With a tactical propose to to Search Engine Optimization (SEO), they cbd seo overshadow in enhancing online visibility and driving living traffic. Their mastery lies in tailoring SEO strategies specifically representing CBD companies, navigating the together challenges of this niche market. Middle of extensive keyword investigating, size optimization, and link-building tactics, they effectively encouragement search rankings, ensuring clients take inaccurate amidst competition. Their side’s address to staying updated with persistence trends and search motor algorithms ensures a potent and operative approach. The CBD SEO Agency’s commitment to transparency and client communication fosters conviction and reliability. Inclusive, their specialized services pander to to the noticeable needs of CBD businesses, making them a valuable partner in navigating the digital landscape within this competitive market.
I’m in love with the cbd products and natural skin toner ! The serum gave my epidermis a youthful support, and the lip balm kept my lips hydrated all day. Eloquent I’m using unsullied, consistent products makes me quality great. These are in the present climate my must-haves in support of a saucy and nourished look!