A new Trojan horse aimed at Android devices has recently surfaced in China.
Named “Geinimi,” San Francisco firm Lookout Mobile Security says the Trojan is “the most sophisticated Android malware [the firm has] seen to date.”
“Geinimi is effectively being ‘grafted’ onto repackaged versions of legitimate applications,” most of which have been games, the firm says. The apps are then sold in Chinese third-party Android app markets. Affected apps will request permissions “over and above” those requested by the legitimate version of an app.
“Users should make sure that the program is asking for permissions appropriate to the app,” a spokesperson from Lookout told Wired. “If the program is asking for your IMEI or your location, and it has nothing to do with the app’s function, that’s a big red flag.”
IMEI is short for International Mobile Equipment Identity, the internationally-used, unique identity number used by many phones.
Lookout hasn’t yet established an intent for Geinimi, though the firm claims the Trojan is “the first Android malware in the wild that displays botnet-like capabilities.” The firm claims that it’s “botnet-like” because it hasn’t yet seen the command server communicate back to affected devices, a Lookout spokesperson told Wired.
The firm has evidence that Geinimi is being distributed only through third-party Chinese app markets. Lookout hasn’t seen any Geinimi-compromised apps in the official Google Android marketplace.
Lookout released an update to its own Android antivirus app, which it says will protect users against Geinimi.
Photo: alachia/Flickr
