Rewterz Threat Alert – Malicious Google Play Apps Exploit CVE-2019-2215 in Androids

Severity

High

Analysis Summary

The active attack involving three malicious Android applications exploits the Android use-after-free vulnerability CVE-2019-2215, to compromise a target device and collect users’ data.

This threat is being linked to the SideWinder advanced persistent threat (APT) group by researchers. It primarily targets Pakistani military infrastructure and has been active since at least 2012. Security researchers believe the threat group is associated with Indian espionage interests and has a history of targeting both Windows and Android devices.

The zero-day local privilege escalation vulnerability affected hundreds of millions of Android phones at the time it was published. The use-after-free vulnerability is considered “high severity” and requires a target to download a malicious application for potential exploitation. An attacker would have to chain CVE-2019-2215 with another exploit to remotely infect and control a device via the browser or another attack vector. The bug allows for a “full compromise” of a vulnerable device. This particular vulnerability exists in Binder, the main interprocess communication system that exists in Android, and the three malicious apps used in the attack were disguised as photography and file manager tools. The payload is dropped in two stages and information is exfiltrated to a C2 server.
 

Android apps Camero, FileCrypt Manager, and callCam are believed to be related to the SideWinder group and have been active on Google Play since March 2019.

CallCam is the payload app and is installed in two stages, the researchers explain. First a DEX file — an Android file format — is downloaded from the command-and-control server as shown above. The downloaded DEX file downloads an APK file and installs it after exploiting the device or employing accessibility. Camero and FileCrypt Manager both act as droppers. After downloading the DEX file from the C2 server, they call extra code to download, install, and launch the callCam app. The callCam icon is hidden on the target device and collects data in the background to send to the C2 server. This information includes location, battery status, files stored on the device, list of installed apps, account data, Wi-Fi data, and information related to the device, sensor, and camera. It also pulls data from WeChat, Outlook, Twitter, Yahoo Mail, Facebook, Gmail, and Chrome. CallCam encrypts all of this stolen data using RSA and AES encryption, and uses SHA256 to verify the data’s integrity and customize the encoding routine.

Impact

• Privilege Escalation
• Denial of Service
• Data exfiltration
• Exposure of sensitive information
• Device Takeover

Affected Products

• Google Pixel 2 running Android 9 and 10 preview
• Huawei P20
• Xiaomi Redmi 5A
• Xiaomi Redmi Note 5
• Xiaomi A1
• Oppo A3
• Moto Z3
• Oreo LG phones
• Samsung S7
• S8 and S9 running 8.x releases

Indicators of Compromise

Domain Name

• deb-cn[.]net
• ap1-acl[.]net
• ap1-acl[.]net
• reawk[.]net

Source IP

• 185.225.17[.]53
• 185.225.17[.]214

URL

• hxxps[:]//ms-ethics[.]net/

Remediation

• Block the threat indicators at their respective controls.
• Warn employees to strictly avoid using these applications.