ESET researchers discovered an extremely stealthy \u2013 yet surprisingly simple \u2013 technique that allowed Android malware to stay under the radar. Analysing the DEFENSOR ID app that was \u2013 at the time \u2013 available on the official Android app store, ESET researchers learned the app misused accessibility services but required no other suspicious permission nor had any other malicious functionality.<\/p>\n\n\n\n
\u201c<\/em>The accessibility services feature is long known to be the Achilles\u2019 heel of the Android operating system, and security solutions have been tuned to detect various combinations of misuse of this weak spot with other indicators of malicious behavior,\u201d<\/em> explained Luk\u00e1\u0161 \u0160tefanko, the ESET Malware Researcher who conducted the analysis into DEFENSOR ID.<\/p>\n\n\n\n Faced with malware that displayed no additional functionality nor suspicious permissions on top of accessibility services, all known security mechanisms failed to trigger any alarm. As a result, DEFENSOR ID made it onto the Google Play store, stayed there for a few months and was never detected by any security vendor participating in the VirusTotal programme.<\/p>\n\n\n\n \u201c<\/em>This has been a valuable lesson for us. Based on what we\u2019ve learned about DEFENSOR ID, we\u2019ve fine-tuned our detection technologies to also cover malware with such a uniquely low detection cross-section,\u201d said \u0160tefanko.<\/p>\n\n\n\n Apart from being extremely stealthy, DEFENSOR ID is capable of inflicting serious harm on its victims. It belongs to the banking trojans malware category and is exceptionally insidious: once installed, it needs its victim to take only one action to fully unleash its power.<\/p>\n\n\n\n \u201cOnce the user activates accessibility services, DEFENSOR ID can pave the way for the attacker to clean out the victim\u2019s bank account or cryptocurrency wallet and take over their email or social media accounts, among other malicious actions,\u201d commented \u0160tefanko.<\/p>\n\n\n\n Following ESET\u2019s notice, Google removed DEFENSOR ID from the official Android app store.<\/p>\n\n\n\n \u201cWe decided to publish the results of our investigation into this malware to help defenders cope with ultra-low cross-section Android malware. The creators of such malware are definitely going to face hardened protections around both Google Play and the users\u2019 devices,\u201d concluded ESET\u2019s \u0160tefanko.<\/p>\n","protected":false},"excerpt":{"rendered":" ESET researchers discovered an extremely stealthy \u2013 yet surprisingly simple \u2013 technique that allowed Android malware to stay under the radar. Analysing the DEFENSOR ID app that was \u2013 at the time \u2013 available on the official Android app store, ESET researchers learned the app misused accessibility services but required no other suspicious permission nor […]<\/p>\n","protected":false},"author":36,"featured_media":300,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[18,34,44],"tags":[164,165,166,167],"class_list":["post-299","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-mobile","category-top-stories","tag-android","tag-defensor-id","tag-eset","tag-lukas-stefanko"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/users\/36"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/comments?post=299"}],"version-history":[{"count":0,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/299\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media\/300"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media?parent=299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/categories?post=299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/tags?post=299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}