Newly discovered Android virus can wreck your phone, cover its tracks

By Adam Ismail Published December 2, 2017

Mobile Malware — Image used with permission by copyright holder

Every week or so, there’s a new form of Android malware discovered that works in a unique way from what’s come before. Fortunately, in most cases, Google and third-party security experts identify the offenders before they do any serious damage. Kaspersky has just discovered one such Trojan, called Dvmap, located in an unassuming game on the Google Play Store called Colourblock with an unprecedented tactic — it injects code into the Android system library.

According to Kaspersky, this is the first example of malware on the operating system with that capability. Colourblock has reportedly been downloaded over 50,000 times, though Google took the game down after Kaspersky brought it to the company’s attention.

The danger of malware that overwrites contents in the system library in this particular instance is that it can disable Android’s Verify Apps function, allowing free, unchecked installation of downloaded software without the user’s knowledge or approval. By replacing the library, the Dvmap Trojan also eliminates key services that many apps rely on to operate properly. This means normally stable apps could very well start crashing your device.

Dvmap even deletes root access to cover its tracks. That’s particularly dangerous for apps dealing with sensitive information that rely on root detection to operate securely, like banking apps.

Kaspersky’s Roman Unuchek noted in his analysis that although the Trojan possessed the ability to download and execute files, it never received any commands during his investigation. This could mean that the developers are still expanding their reach and testing their methods before launching the full attack.

Interestingly, Colourblock has been able to sidestep action from Google and remain under the radar because the developers have been regularly “updating” the app by releasing a mix of clean and malicious versions. The first release was clean, but was then replaced with another containing Dvmap after a short period of time. That version was switched out with another clean app, and then again with an infected one. Kaspersky says the developers had performed the switcheroo at least five times between April and May.

Topics

Former Digital Trends Contributor

Adam’s obsession with tech began at a young age, with a Sega Dreamcast – and he’s been hooked ever since. Previously…

Mobile

How to check your phone for viruses

facebook reportedly has a clubhouse clone in its sights woman using phone

Smartphones are far from immune to getting attacked by malware. A variety of viruses can cause all kinds of problems, and while some of these viruses are very obvious, others play a more subtle game to steal money or information. Here’s what to watch for if you think your phone may have a malware problem and what you should do if you confirm something has gone wrong.
Watch for signs of a problem

Viruses usually find their way onto phones due to users accessing content they shouldn’t. There are good reasons why you should never click that strange link in a text, open unknown email attachments, or download a random new app -- these are all possible sources of malware, and mobile devices are frequent targets since people often don’t think as much about opening a text or checking out a new app. Even iPhones are susceptible to various trojan horse and phishing tactics, especially if they have been jailbroken.

Mobile

How to use Nova Launcher to customize your Android phone

nova launcher

Tired of staring at the same old home screen? If you've got a smartphone running Google's Android operating system, good news: You don't have to put up with the monotony any longer. Android supports what are known as third-party launchers, custom apps that supercharge your home screen with new features, themes, and optimizations. There's a pretty large list of launchers to choose from, but few come close to the level of polish and customization of Nova Launcher, a free (and optionally paid) Android launcher for all devices running Android 4.0 and newer.

Nova Launcher replaces your home screen and app drawer, the scrolling list of app icons normally accessible by swiping up on your phone's home screen. But on the default settings, you won't notice much in the way of change -- and that's because Nova Launcher sticks to a fairly vanilla take on Android's home screen. But there's a lot Nova Launcher can do that's not immediately obvious. Don't like the shape or style of app icons? It's easy to swap them out. Bored of the transition animations between home screens and apps? Just pick different ones.

Mobile

AT&T just made it a lot easier to upgrade your phone

Do you want to upgrade your phone more than once a year? What about three times a year? Are you on AT&T? If you answered yes to those questions, then AT&T’s new “Next Up Anytime” early upgrade program is made for you. With this add-on, you’ll be able to upgrade your phone three times a year for just $10 extra every month. It will be available starting July 16.

Currently, AT&T has its “Next Up” add-on, which has been available for the past several years. This program costs $6 extra per month and lets you upgrade by trading in your existing phone after at least half of it is paid off. But the new Next Up Anytime option gives you some more flexibility.