Loapi Trojan Can Damage Your Mobile Devices

DooKey

DooKey

[H]F Junkie
Joined
Apr 25, 2001
Messages
13,553
A couple of days ago I reported on a nasty little android trojan that is modular and can be used to do multiple things. One of those things is cryptomining and it's not a good thing for your device. It's so aggressive that it can overheat your battery and destroy your device. Check out what it did to a phone that was running the cryptomining trojan for a couple of days. Consider this a public service announcement.

Loapi is an interesting representative from the world of malicious Android apps. It’s creators have implemented almost the entire spectrum of techniques for attacking devices: the Trojan can subscribe users to paid services, send SMS messages to any number, generate traffic and make money from showing advertisements, use the computing power of a device to mine cryptocurrencies, as well as perform a variety of actions on the internet on behalf of the user/device. The only thing missing is user espionage, but the modular architecture of this Trojan means it’s possible to add this sort of functionality at any time.
 
I'm honestly a little paranoid about this lately. Even mainstream websites are starting to embed crypto mining code into their pages to try and sneak a few CPU cycles without my consent. I can handle badly coded pages stealing cycles (people are idiots), but I can't handle it being intentional.

I wouldn't mind this if I knew it was happening AND it got rid of adds. Seriously...if Kyle put mining code in the forum that chugged based upon a BTC per page view (and I was aware of that rate), I would be all for it. 10 ms of CPU time per page view..deal.
 
I have taken to removing Java from my computer, and disabling javascript for all WEB sites, only allowing temporary access once I view the page source. It has gotten out of hand.

Damn tinfoil hat does not seem to be cutting it anymore.
 
This is why I roll my eyes when people say "I don't care about frequent security updates on my devices".

That should be the number one criteria, above all else, including screen size, battery life, wireless speed, responsiveness or any other features.
 
B00nie said:
Yet another reason to stick with iOS.
Click to expand...
Trepidati0n said:
yep....

https://www.symantec.com/about/newsroom/press-releases/2017/skycure_0718_01
Click to expand...

Yeah, the fallacy of Apple products being immune to malware is apparently still strong.

I would argue that the lesson here is to choose devices that get frequent security updates though, not to abandon any one platform completely.

While many Android handset makers have absolutely atrocious security update records, there are some that are great.

Right now though, those "some" is pretty much limited to Pixel phones, the Nexus 5x and 6P (at least until November next year) and any device you can put LineageOS on.

The others, even the big players like Samsung, LG and HTC just don't patch their devices often enough.

If I don't see new security patches every couple of weeks or so, or at least once a month, I start getting concerned, regardless of who made the device, and this includes Apple.
 
Running a combination of the Uber Driver's app and Waze at the same time caused my phone to do that.
 
Zarathustra[H] said:
Yeah, the fallacy of Apple products being immune to malware is apparently still strong.
Click to expand...

iOS apps are pre-screened by humans before they're allowed to be released. iOS is just simply superior in security. It takes 2 weeks on average for a developer to get permission to release.
 
B00nie said:
iOS apps are pre-screened by humans before they're allowed to be released. iOS is just simply superior in security. It takes 2 weeks on average for a developer to get permission to release.
Click to expand...

Sorry...humans are flawed. Shit gets through. If you think their review process on each app is line by line exhaustive, you need to rethink again. No way is apple going to put a SW security expert for 80 hours on each app.
 
B00nie said:
iOS apps are pre-screened by humans before they're allowed to be released. iOS is just simply superior in security. It takes 2 weeks on average for a developer to get permission to release.
Click to expand...

Yep, Apple has better app store security. Google is improving the security in their Play store, but it is moving slowly.

That is only one attack vector though, and not the one that I am most concerned about. I don't download tons of apps from unknown developers. I only use big name, well known apps, and thus I don't need to be as concerned about them containing malware.

The attack vector I am more concerned about is random web-based attacks, like from ads, which is how this malware in the OP is distributed. Apple tends to be very opaque when it comes to known bugs and very slow to patch them. I like Google better in that regard, but - as mentioned before - this is of little use if the handset maker doesn't incorporate these upstream patches on a regular basis.
 
The cryptominging thing is something I'll never allow on my PC, even on a site I otherwise support with it being completely voluntary.
 
Trepidati0n said:
Sorry...humans are flawed. Shit gets through. If you think their review process on each app is line by line exhaustive, you need to rethink again. No way is apple going to put a SW security expert for 80 hours on each app.
Click to expand...

It sure as hell beats the Google 'release first, heuristic detection later' way of things. It's no coincidence that Android is all the time in news for serious exploits and iOS is virtually non existant.
 
Well of course I am acting childish. It is the only response to someone who thinks any computer company is more secure than the other one. Let me hand you a clue. Turning a blind eye to security flaws does not make a product more secure. Apple is guilty of that.

I have been around this industry longer than the industry has been around. I have suffered through all the marketing hype every company can muster. Apple has always had the best marketing, even when they did not have a very good product at all. That is not to say they do not have good designs. Even when the product was bad, it looked good being bad.

The Apple user who is emotionally invested in the company makes me giggle a bit. Call it what you will. It is what it is.

EDIT: For the record. I am not pro-anything. I have worked with just about every kind of computer system you can imagine. They all have strengths and weaknesses. I am incredibly pragmatic.
 
B00nie said:
It sure as hell beats the Google 'release first, heuristic detection later' way of things. It's no coincidence that Android is all the time in news for serious exploits and iOS is virtually non existant.
Click to expand...

Oh...so you are goal post shifting now. Congrats. Keep it up. I don't have the time to back you into a corner until I finally get the standard "well, until you come back with an intelligent argument this isn't worth discussing anymore".
 
Trepidati0n said:
Seriously...if Kyle put mining code in the forum that chugged based upon a BTC per page view (and I was aware of that rate), I would be all for it. 10 ms of CPU time per page view..deal.
Click to expand...

Absolutely, I'd leave the [H] open all day on my work PC.
 
buzzbomb said:
I wouldn't mind this if I knew it was happening AND it got rid of adds. Seriously...if Kyle put mining code in the forum that chugged based upon a BTC per page view (and I was aware of that rate), I would be all for it. 10 ms of CPU time per page view..deal.
Click to expand...
I think the mining thing needs to be nipped in the bud. For every Kyle who attempts it transparently and honestly, there will be thousands who try it underhandedly. People need to come out hard and fast against this, and that unfortunately means coming out against even honest attempts at it. This is one instance where the baby must be thrown out with the bathwater.
 
Disclaimer: I own an iPhone 7 Plus.

With that being said, I'm going to try and make this post as non-iPhone fanboy-ish as I can get.

I'm not going to deny that Apple has issues, yes, even the lauded Apple that so many say can do no wrong has gotten things wrong. They have security issues just like so many other companies do but it's how Apple reacts to those security issues that keep me in the iOS ecosystem. The fact that every device in the world gets the update the same day that everyone else gets it regardless of who your carrier is is the best thing ever. Meanwhile in the Android world you have to hope and pray your carrier of choice decides to grace your device with the update.
 
really time to up the ante on the punishment for creating viruses/malware/etc. While yeah I'm sure the prosecution rate would be near zero, plus the whole international bit, maybe just maybe if you started to have penalties that were on the same order of robbing a bank maybe he'd stop a few of the small time "script kiddies" and what not.
 
You must log in or register to reply here.
Back
Top