Black Market for Android Backdoors and Trojans

[tanjimajuha20]

Android devices vulnerable during manufacturing

In 2017, criminals managed to embed an advanced backdoor into the firmware of Android devices at manufacturers' factories. The Triada malware was first reported in 2016 india whatsapp resource from Kaspersky Lab research, which noted that this malware is "one of the most advanced mobile Trojans" that uses exploits to gain access to the system with superuser rights, which bypassed Android's built-in protection tools, as well as tools for modifying the main Zygote process in Android, allowing the malware to directly interfere with the operation of each installed application. The attackers used the backdoor to secretly download and install modules. Since the backdoor was embedded in one of the OS libraries and was located in the system partition, it could not be removed using standard methods, including a factory reset.


There is a large market for malware distributed on the dark web for Android. In April 2023, Kaspersky Lab released a fairly detailedreviewon this topic. It can be assumed that in the future the number of threats to Android will grow and they will become more and more complex. Obviously, if a huge amount of malware for Android can be found "on the open market", then serious attackers and government intelligence agencies have an even larger arsenal of "cyber weapons" to gain complete control over Android devices.

Vulnerabilities in Mobile OS and Device Drivers

Unlike Apple, Android devices are manufactured by a large number of companies, so the set of drivers is quite extensive, and accordingly, the number of vulnerabilities is potentially much larger. In late 2022 - early 2023, Google researchers from Project Zero reported eighteen zero-day vulnerabilities in Exynos modems manufactured by Samsung. The four most serious of them allow remote code execution and remote compromise of the phone at the modem firmware level without user intervention, all you need is to know the victim's phone number.

Let's sum it up

The mass rejection of the not ideal, but comparatively more secure mobile operating system Apple iOS with the recommendation to switch not to Russian mobile devices and operating systems, but to devices from Chinese manufacturers with Android, to put it mildly, does not improve, but significantly worsens the security situation. Most devices with Google Android will be more vulnerable and, most likely, will remain without updates. It is unlikely that in the event of critical vulnerabilities being discovered, manufacturers will promptly release new versions. It is quite obvious that such an approach significantly increases the attack surface, that is, the number of vulnerabilities through which Android devices will inevitably be hacked by both intruders and foreign intelligence agencies.