28 Nov 2017

Google has revealed its recent efforts to root out Android apps infected with spyware it calls Tizi.

The Google Play Protect team discovered a trojanized app in September after its device scans found an app on Google Play that could root devices with a handful of old vulnerabilities.

Recent samples of Tizi allowed an attacker to root a targeted device and steal sensitive data from apps such as Facebook, Twitter, WhatsApp, Viber, Skype, LinkedIn and Telegram. Specific geographies targeted were Kenya, Nigeria and Tanzania, Google said. A smaller number of victims resided in the United States, researchers said.

This malicious application discovered by google security scan and it mainly performing to gain the root access of the target and exploit the old vulnerabilities.

According to the Google report, around 1,300 devices affected by Tizi and still its rapidly spreading its variant around the world.

How Does Tizi Android Spyware Work?

Since earlier Tizi family variants didn’t have the rooting and obfuscation capabilities, newly spreading this Tizi gain root access of targeting phone is considering as a main future.

Once it gaining the root access of the targeting mobile , it will contact first to the command & control server by sending the SMS with the device’s GPS coordinates.

Communication between C&C Server and Tizi using HTTPS in some specific versions,Tizi uses the MQTT messaging protocol with a custom server.

According to Google, Tizi apps can also record ambient audio and take pictures without displaying the image on the device’s screen.

Tizi Android Spyware Exploiting related vulnerabilities are mainly  target older chipsets, devices, and Android versions.

But most of the vulnerabilities are already patched but Tizi Android Spyware always trying to gain some high level permission by sending SMS messages and monitoring, redirecting, and preventing outgoing phone calls.

Tizi Android Spyware can root the device by exploiting one of the following local vulnerabilities:
  • CVE-2012-4220
  • CVE-2013-2596
  • CVE-2013-2597
  • CVE-2013-2595
  • CVE-2013-2094
  • CVE-2013-6282
  • CVE-2014-3153
  • CVE-2015-3636
  • CVE-2015-1805

Mitigation Steps for  PHA’s

Potentially Harmful Applications are always try to install some harmful malicious application into victims mobile. following steps are common mitigation step to protecting from PHA’s by Google.

  • Check permissions: Be cautious with apps that request unreasonable permissions. For example, a flashlight app shouldn’t need access to send SMS messages.
  • Enable a secure lock screen: Pick a PIN, pattern, or password that is easy for you to remember and hard for others to guess.
  • Update your device: Keep your device up-to-date with the latest security patches. Tizi exploited older and publicly known security vulnerabilities, so devices that have up-to-date security patches are less exposed to this kind of attack.
  • Google Play Protect: Ensure Google Play Protect is enabled.
  • Locate your device: Practice finding your device, because you are far more likely to lose your device than install a PHA.

Image Ref: The Hacker News

IT Security Professional – Security Researcher & Consultant for the Government, Enthusiast, Malware Analyst, Penetration Tester.

Leave your thought