Sophisticated New Android Trojan Found in Wild

DECEMBER 29, 2010

Security Alert: Geinimi, Sophisticated New Android Trojan Found in Wild

By tim

A new Trojan (“Geinimi”) affecting Android devices has recently emerged in China

• can compromise a significant amount of personal data on a user’s phone and send it to remote servers
• the first Android malware in the wild that displays botnet-like capabilities
• being “grafted” onto repackaged versions of legitimate applications
• it has the potential to receive commands from a remote server that allow the owner of that server to control the phone
• the possibilities for intent range from a malicious ad-network to an attempt to create an Android botnet

see: http://blog.mylookout.com/2010/12/geinimi_trojan

So why am I writing about this malware, when I don't even own a smartphone?  Because the article was written by my son, Tim.

Back in July (http://strazzere.blogspot.com/2010/07/go-west-young-man.html) I wrote about how Tim moved to California, and became part of the Security Response Team at Lookout in San Francisco.

As part of his work there, Tim found and reverse-engineered this malware, helped develop Lookout's protection for it, and created this writeup.

As we say in New England, Tim is Wicked Smaht and works Wicked Hahd.

And his Mom and Dad are Wicked Proud!

see also:
http://www.securitynewsdaily.com/new-trojan-found-on-android-mobile-devices-0379/
http://www.zdnet.com/blog/google/android-malware-in-the-wild/2724
http://news.cnet.com/8301-1009_3-20026804-83.html
http://content.usatoday.com/communities/technologylive/post/2010/12/nasty-android-trojan-found-grafted-to-gaming-apps-/1
http://www.tgdaily.com/mobility-features/53287-trojan-can-take-over-android-phones
http://news.yahoo.com/s/mashable/20101230/tc_mashable/advanced_trojan_could_zombify_your_android_device
http://www.securitynewsdaily.com/new-trojan-found-on-android-mobile-devices-0379/
http://www.appleinsider.com/articles/10/12/29/new_android_malware_could_produce_chinese_botnet_harvest_personal_data.html
http://www.itespresso.es/un-nuevo-troyano-amenaza-a-los-terminales-android-48779.html
http://www.security.nl/artikel/35655/1/Eerste_Android_malware_met_botnet-eigenschappen.html
http://www.computerworld.ch/news/security/artikel/fieser-android-trojaner-im-anmarsch-55359/
http://mobile.slashdot.org/story/10/12/30/1856242/Android-Trojan-Found-Spreading-From-Chinese-App-Stores

According to Tim:
It's "Geinimi" not "Gemini", and pronounced "Ghay-knee-mē" - translates from Chinese to roughly "Give me rice"


And here's the followup teardown Tim wrote:
http://blog.mylookout.com/2011/01/geinimi-trojan-technical-analysis/

---

This article originally appeared in my blog: All Things Quality

	My name is Joe Strazzere and I'm currently a Director of Quality Assurance. I like to lead, to test, and occasionally to write about leading and testing. Find me at http://strazzere.blogspot.com/.

Perhaps They Should Have Tested More in 2010

2010 saw some "interesting" bugs show up in the news.  Perhaps these companies should have tested more.

Skype supernodes still aren't so super

http://strazzere.blogspot.com/2010/12/perhaps-they-should-have-tested-more.html

Target confused about coupons for months

http://strazzere.blogspot.com/2010/11/perhaps-they-should-have-tested-more_01.html

Apple apparently just learned about Daylight Saving Time

http://strazzere.blogspot.com/2010/11/perhaps-they-should-have-tested-more.html

J.P. Morgan Chase chases some significant downtime

http://strazzere.blogspot.com/2010/09/perhaps-they-should-have-tested-more-jp.html

Apple didn't know how to display signal bars

http://strazzere.blogspot.com/2010/07/perhaps-they-should-have-tested-more.html

Zappos/6pm.com undercharges customers $1.6 million, nobody gets fired

http://strazzere.blogspot.com/2010/05/perhaps-they-should-have-tested-more.html

McAfee decides that Windows XP/SP3 is a virus

http://strazzere.blogspot.com/2010/04/perhaps-they-should-have-tested-more_22.html

---

This article originally appeared in my blog: All Things Quality

	My name is Joe Strazzere and I'm currently a Director of Quality Assurance. I like to lead, to test, and occasionally to write about leading and testing. Find me at http://strazzere.blogspot.com/.

Top Ten Blog Pages for 2010

Aside from my home page, these were the top ten content pages for 2010.  They received the most visits according to Google Analytics:

People in Testing

http://strazzere.blogspot.com/p/people-in-testing.html

My page of links to other testing-related blogs of interest.

Please send me links for sites that you think should be added - your site, or sites that you read.

A Glossary of Testing Terms

http://strazzere.blogspot.com/2010/04/glossary-of-testing-terms.html

A list of terms in QA and Testing.  I originally started this years ago so that I could copy and paste the definitions when people asked "What is...?"  I'm happy that you find it useful.

QA and Testing Interview Questions (And Some Answers)

http://strazzere.blogspot.com/2010/04/qa-and-testing-interview-questions-and.html

Another list I created to help people asking similar questions.

It's hard to be prepared for an interview.  I'm happy if this list helps.

25 Things About Me

http://strazzere.blogspot.com/p/25-things-about-me.html

Hmm.  I'm guessing browsers were looking for something else here?

How To Reproduce Bugs

http://strazzere.blogspot.com/2010/07/how-to-reproduce-bugs.html

I thought this was funny when I posted it.  But it got a lot more hits than I expected.

There are ALWAYS Requirements

http://strazzere.blogspot.com/2010/04/there-are-always-requirements.html

This is where I send people when they ask "But I don't have any written Requirements.  How can I test?"

Optimistic Developers, Pessimistic Testers

http://strazzere.blogspot.com/2010/04/optimistic-developers-pessimistic.html

This is one of my favorite posts.  I'm please others like it, too.

My QA Bookshelf

http://strazzere.blogspot.com/2010/04/my-qa-bookshelf.html

A list of the QA and Testing books I own.  I need to update this list soon.

Things I Like to Have in my Test Automation Suites

http://strazzere.blogspot.com/2010/04/things-i-like-to-have-in-my-test.html

A list of attributes that (for me) help to make a test automation suite useful.

Issue Tracking Template

http://strazzere.blogspot.com/2010/04/issue-tracking-template.html

An old sample template that can still be of use.

---

This article originally appeared in my blog: All Things Quality

	My name is Joe Strazzere and I'm currently a Director of Quality Assurance. I like to lead, to test, and occasionally to write about leading and testing. Find me at http://strazzere.blogspot.com/.

Perhaps They Should Have Tested More - Skype (Again)

Supernodes not so super?

Skype once again had a worldwide outage related to software problems in their supernodes:

• blocked millions of people from making Internet phone calls
• crash left a large chunk of Skype's 560 million users with nowhere to go
• was completely offline for more than three hours on Wednesday
• experienced its biggest global outage in three years
• was caused by a “software issue” with the “supernodes” 
• the company plans to issue compensation vouchers 
• the bigger question is whether businesses should be relying on these services in the first place

It's not the first time the service has gone down.  

In August of 2007, Skype was down for several days.  A faulty algorithm in their supernodes was exposed when many users rebooted their client machines while installing a Windows update: 

http://strazzere.blogspot.com/2010/04/perhaps-they-should-have-tested-more_5959.html

Certainly those supernodes are tricky.  

But perhaps Skype should have tested more, particularly after the worldwide failure just a few years ago?

Read more at: 

    http://www.ft.com/cms/s/2/bc4db85e-0e49-11e0-86e9-00144feabdc0.html

    http://www.thestarpress.com/article/20101223/NEWS06/101223009

    http://moconews.net/article/419-skype-down-but-not-out/

    http://gigaom.com/2010/12/23/skype-ceo-tony-bates-i-am-sorry-here-is-an-update/

    http://content.usatoday.com/communities/ondeadline/post/2010/12/skype-global-blackout-leaves-millions-without-free-phone-service/1

    http://blogs.computerworld.com/17578/skype_still_down_today_after_supernode_outage

    http://www.sfgate.com/cgi-bin/article.cgi?f=/g/a/2010/12/22/businessinsider-skype-outage-lesson-dont-rely-on-consumer-services-for-business-functions-2010-12.DTL

---

December 29th - an update from Skype's CIO Lars Rabbe:

"we will be reviewing our testing processes to determine better ways of detecting and avoiding bugs which could affect the system"

http://blogs.skype.com/en/2010/12/cio_update.html
http://newenterprise.allthingsd.com/20101229/skype-post-mortem-overloaded-servers-and-desktop-bugs-brought-us-down/

---

This article originally appeared in my blog: All Things Quality

	My name is Joe Strazzere and I'm currently a Director of Quality Assurance. I like to lead, to test, and occasionally to write about leading and testing. Find me at http://strazzere.blogspot.com/.