Even factory reset cannot smite the foulness that is Shedun.
Michael Bentley of security-through-analytics outfit Lookout has found android malware that does not require user permission to install.
Bentley, Lookout’s head of response, says the Shedun malware accomplishes the feat using the Android’s accessibility features.
When installed the malware will use the accessibility service to gain god-mode like access to install apps and spew advertising across phone functions.
“These families root the victim’s device after being installed and then embed themselves in the system partition in order to persist, even after factory reset, becoming nearly impossible to remove,” Bentleysays.
“By gaining the permission to use the accessibility service, Shedun is able to read the text that appears on screen, determine if an application installation prompt is shown, scroll through the permission list, and finally, press the install button without any physical interaction from the user.”
Shedun lies about the capabilities of the accessibility service in a bid to get users to approve the initial installation claiming that users should ‘feel at ease’ about approving the accessibility service request.
Legitimate apps like LastPass and the popular Tasker use the accessibility service for functions like application password filling and to grant expanded capability to phone tinkerers
Source:https://www.theregister.co.uk/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
