Firmware that actively tries to hide itself allows attackers to install apps as root. Almost three million Android phones, many of them used by people in the US, are vulnerable to code-execution attacks that remotely seize full control of the devices, researchers said Thursday.
Until recently, the flaw could have been exploited by anyone who took the time to obtain two Internet domains that remained unregistered despite being hardwired into the firmware that introduced the vulnerability. After discovering the vulnerability, researchers from security ratings firm BitSight Technologies registered the addresses and control them to this day. Even now, the failure of the buggy firmware to encrypt communications sent to a server located in China makes code-execution attacks possible when phones don’t use virtual private networking software when connecting to public hotspots and other unsecured networks.
Since BitSight and its subsidiary company Anubis Networks took possession of the two preconfigured domains, more than 2.8 million devices have attempted to connect in search of software that can be executed with unfettered “root” privileges, the researchers said. Had malicious parties obtained the addresses before BitSight did, the actors could have installed keyloggers, bugging software, and other malware that completely bypassed security protections built into the Android operating system. The almost three million devices remain vulnerable to so-called man-in-the-middle attacks because the firmware—which was developed by a Chinese company called Ragentek Group—doesn’t encrypt the communications sent and received to phones and doesn’t rely on code-signing to authenticate legitimate apps. Based on the IP addresses of the connecting devices, vulnerable phones hail from locations all over the world, with the US being the No. 1 affected country.Set featured image
“The thing that scares us is a lot of these users will be unaware of the vulnerability, and they will never get an update,” BitSight CTO Stephen Boyer told Ars. “This is full system compromise. This is at the root level. [Attackers with a MitM position] can do anything.”
Kind of BLU
In a blog post published Thursday, BitSight researchers said they went to a Best Buy store and purchased a BLU Studio G phone and were able to perform an attack that exploited the backdoor. As a result, they were able to install a file they named system_rw_test in /data/system/, a file location that’s reserved for apps with all-powerful system privileges. The researchers provided the following screenshot:
By observing the data phones sent when connecting to the two previously unregistered domains, BitSight researchers have cataloged 55 known device models that are affected. The most affected manufacturer is US-based BLU Products, which accounted for about 26 percent, followed by multinational Infinix with 11 percent, Doogee with almost 8 percent, and Leagoo and Xolo with about 4 percent each. Slightly more than 47 percent of the phones that connected to the BitSight sinkhole gave no indication who their manufacturer was. A list of specific models can be found in this advisory from the Department of Homeland Security-sponsored CERT.
The IP addresses of the connecting devices were based in countries all over the world, with the US being the top one, BitSight researchers told Ars. Update: Shortly after this post went live, João Gouveia, another BitSight researcher who helped uncover the rootkit, said in a tweet that he and his colleagues are “seeing lots of connections coming from all sorts of sectors, including healthcare, government and banking.”
Given the large number of connecting devices with unknown manufacturers, the list of affected devices is sure to grow in the coming weeks. People who are technically inclined can check if a phone is vulnerable by monitoring its network traffic and looking for outgoing connections to the following domains, which are hardwired into the Ragentek firmware:
- oyag[.]lhzbdvm[.]com
- oyag[.]prugskh[.]net
- oyag[.]prugskh[.]com
People who are concerned their phone may run the firmware may also contact the manufacturer. So far, according to both BitSight and the CERT advisory, only BLU Products has released an update that addresses the vulnerability. It’s not clear if it will be installed automatically or if users must manually apply it, and BitSight researchers have not yet tested the patch to evaluate its effectiveness. BLU Products representatives didn’t respond to a message seeking comment for this post. Affected or potentially affected users who don’t have an update can also protect themselves by connecting only to networks they trust or by using VPN software when connecting to hotspots and other unsecured Wi-Fi networks.
Rootkit functionality
Little is known about the Ragentek firmware. BitSight researchers said code in the firmware goes out of its way to conceal the presence of the underlying binary file. For example, it deliberately attempts to remain excluded from the list of running processes returned by the Linux PS command.
“In this case, the developer added an exception when iterating over the system processes to explicitly skip over the affected binary (“debugs”), and thus not display it in the returned results,” BitSight researcher Dan Dahlberg told Ars. “In other words, the programs were modified to pretend this binary did not exist.”
Dahlberg said the Ragentek firmware takes similar steps to evade the top command. Despite the suspicious behavior, BitSight researchers suspect the firmware is designed to deliver legitimate over-the-air updates to phones, and they believe the backdoor capabilities were unintentional. Attempts to reach Ragentek and other manufacturers weren’t successful.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
