{"id":11083,"date":"2011-09-15T09:26:31","date_gmt":"2011-09-15T16:26:31","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=11083"},"modified":"2025-06-04T03:52:31","modified_gmt":"2025-06-04T10:52:31","slug":"rooting-exploit-for-android","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rooting-exploit-for-android\/","title":{"rendered":"Rooting Exploit for Android Works Silently"},"content":{"rendered":"

In our last blog about Android malware, we discussed the expanding threat landscape for Android malware. Recently, we received an Android package in our collection and observed that this malicious application uses a rooting exploit that targets Android devices running OS Versions 2.3 or earlier to gain root privileges on the compromised device.<\/p>\n

The malware binary is packaged with a legitimate application. In this case, the malicious exploit code comes with \u201cDaily Beauties,” which showcases pictures of celebrities that are updated periodically. Attackers use this repacking approach to hide their malware within genuine applications, which users will download and install.<\/p>\n

Repacking An Application With Malicious Code<\/h2>\n

The following image represents the repacking a legit application with malicious code. These repackaged applications are made available in Android black markets and third-party markets.<\/p>\n

\"\"<\/a><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Figure 1: Repackaged application<\/p>\n

This malicious application requires the following user permissions:<\/p>\n

\"\"<\/a><\/p>\n

Figure 2: User permissions required by the malicious application<\/p>\n


\n<\/a>From the preceding list of permissions requested by the malicious application, I was curious about two in particular.<\/p>\n