New malware CopyCat infects 14 mn outdated Android devices

CopyCat is an adware (a malware that injects ads on victims device to generate revenue) that affected over 14 million Android users in the span of 2 months. It raked over $1.5 million via fraudulent app installations and advertising with peak activity during April & May 2016.

How did CopyCat malware spread?
Unlike older adwares, CopyCat spread via 3rd party app stores and standard phishing attacks. With increased security checks in the Google Play, the architects of CopyCat chose not to host it on the official market.

How does CopyCat work?
CopyCat once installed from a 3rd party app store or a phishing campaign. injected advertisements in the browsers and other applications of a victim's device and when the victim clicked them, it earned money.
Moreover, after installation, the malware fetched information about the device and used specific exploits to root (A process where an app gains highest available privileges allowing it to alter the core architecture of the device) the victim's device. This allowed CopyCat to further install rootkits to make itself persistent in the victim's phone.
After gaining root access, the malware could then install fraudulent apps, monitor app installations and app launches to display targeted ads and altered the refer-install mechanism to steal the installation revenue.
All this was done via infecting the Android Zygote Daemon(A service in Android devices that is responsible for launching apps on the device). This allowed the attacker complete access to the victim's device.
CopyCat used several exploits, including CVE-2013-6282 (VROOT), CVE-2015-3636 (PingPongRoot), and CVE-2014-3153 (Towelroot) to infect devices running Android 5.0 and lower, which is although very old but widely used.

What was the impact of CopyCat?
CopyCat infected over 14 million devices out of which, 8 million were rooted ie complete high privileged access. Out of these 8 million, 3.8 million devices were infected with adware and 4.4 million were used to steal credit card information.

In this span of 2 months, it earned over $1.5 million via fraud app installations & displaying over 100 million advertisements.

Which parts of the world did CopyCat hit the worst?
CopyCat primarily affected devices in the Southeast Asia, mainly spanning to India, Pakistan & Bangladesh.
Although in the Unites States over 280,000 devices were infected. Interestingly, Chinese users were not infected indicating the attack to be originated from China.

Who is behind CopyCat?
Though it lacks any direct evidence, researchers at CheckPoint suggested the responsible party being a Chinese advertising network MobiSummer.
The researcher found following connections between CopyCat & MobiSummer:
1. CopyCat malware and MobiSummer operate on the same server
2. Several lines of CopyCat's code is signed by MobiSummer 3.
CopyCat and MobiSummer use the same remote services
4. CopyCat did not target Chinese users despite over half of the victims residing in Asia

What can users do to protect themselves?
According to the spokesperson at Bugsbounty, users should take the following precautions:
1. Install applications only from the Google Play Store and not use any 3rd party app stores
2. Make sure that the option for allowing app from unknown sources is unchecked in the Android settings
3. Avoid installing apps with < 50,000 downloads and enough reviews & ratings.
4. Check the app permissions before installing. The app should only take permissions that are relevant to it. If a flashlight app needs permission for SMS & contacts it is definitely malicious
5. Update to the latest version of Android if possible
6. Specifically disallowing apps specific permissions from the settings if your phones allow it.