An Android smartphone virus resurfaces

If you answer “Yes” to either question, your smartphone might need a check-up against the “NotCompatible” virus that has been infecting Android smartphones since March 2012. The U.S. company Lookout Mobile Security, has been following this virus since it was released. According to Lookout, the virus also showed a sharp uptick in activity in March […]

If you answer “Yes” to either question, your smartphone might need a check-up against the “NotCompatible” virus that has been infecting Android smartphones since March 2012. The U.S. company Lookout Mobile Security, has been following this virus since it was released. According to Lookout, the virus also showed a sharp uptick in activity in March of 2013, turning Android devices into unwilling web proxies (or intermediary access points to the web). Then, a few days ago, 20 November 2014, Lookout reported it has identified a mobile malware campaign, believed to be NotCompatible, that had affected at least four million Android users in the U.S.
The NotCompatible malware was first discovered by chance and brought to Reddit, a social news site and message board. At risk are people who have enabled “side-loading” – the ability to download apps from unofficial sources. According to PC World tech journalist Ian Paul in the 3 May 2012 issue of the magazine, side-loading is enabled on your phone when you go to Settings > Applications, followed by tapping the “Unknown Sources” check box. Any Android user arriving at an infected site using the phone’s browser will automatically download a file called “Update.apk.” If you have side-loading enabled, a screen will pop-up, asking you to install an update named “com.Security.Update” or something similar. You will get infected if you install the application! If you are not side-loading apps, you will not be able to install the Trojan, Lookout says. The main effects of the virus on your smartphone were believed to be mostly limited to the use of your phone as proxy for carrying out mischief on the web. In 2012, it was thought that hacked sites unknowingly acting as a vehicle for NotCompatible appear to be typically low traffic websites for local businesses such as country clubs, computer repair, and pest exterminators. A general rule of thumb in preventing attack is caution when allowing new apps into your system, and to be mindful of unauthorized downloads.
More commonly, criminals infect your smartphones by first infecting, with malicious codes, websites that you visit. When you visit the site from your phone, you unknowingly download the code. This is sometimes referred to as “drive-by-download.” In other scenarios, the spam from hijacked e-mail accounts is sent to your phones, a means that Lookout ascribes to more than 200,000 infections a day. Furthermore, and more recently, the bad guys trick you by installing the malicious code into your device as a security patch in an e-mail attachment.  The trick of sending e-mails advertising “weight-loss” solutions with a link that served up malware to Android users has also been documented.
NotCompatible has attracted the attention of Alcatel-Lucent, who researched into this “Android Web Proxy Bot,” published a “Malware Analysis Report” on 24 January 2014 on it, and regarded NotCompatible as one of 2013 top mobile threats. According to Alcatel-Lucent, NotCompatible is an Android bot that uses the infected phone as a proxy for this illicit web browsing activity. The company also found out that the command and control (C & C) servers for the bot are located in Germany and Holland and suggested that “the protocol is the same as a Windows based web proxy bot.” “This is the first time we’ve seen a common C&C infrastructure shared between Windows and Android malware. As for the origin of the name – “NotCompatible” comes from an early version that used a ruse about the Android browser being not compatible with the web site that served the malware.” “The malware was delivered as an update to fix that fictional problem.”
The interest of Alcatel-Lucent was attracted first by the high bandwidth (data) usage of devices that were infected by NotCompatible. The company cited an instance in which an infected phone used 165 Mbytes of bandwidth in just under two hours. “The vast majority of this was used by the malware to provide the proxy service. This could result in some very large data charges for the infected user, particularly if they are roaming. It would also significantly impact their battery life.”
The report by Alcatel-Lucent also discusses the motivation of the hackers in developing NotCompatible. The following is taken from the report, almost verbatim:
Anonymous browsing services: The most obvious use of the NotCompatible malware is to provide an anonymous web browsing service. Here, the bad guys conceal their browsing activities for a variety of reasons, particularly if the browsing activity is criminal in nature. User of the service would look like their web browsing is originating on the infected computers that are running the proxy service. So a person in China would look like they are browsing the Web from the United States.
Providing access to restricted foreign content: Often content such as movies is restricted to distribution within a specific geographic region. A proxy could be used to provide illegal access to this type of restricted foreign content, by making the user “look” like they are within the allowed geographic zone.
• Web Site optimization fraud: Proxy service could be used to generate web visits that look like they are coming from the target locations, thereby providing fraudulent “hits” data.
APT probing and exfiltration: This type of proxy could be a key component in an “Advanced Persistent Threat” scenario. If a device inside a corporate network is infected, the attacker can use the proxy to connect to computers and services inside the corporate network and “exfiltrate” the data.