Monero Miner Virus Attacks Android
OpinionBit News Today2 min read
Several Android smartphones across the world are under attack from a new type of crypto-jacking malware that secretly mines the Monero cryptocurrency. The Trojan, discovered recently, exploits a security flaw to access the phone after it has been hacked. ## Mining Monero on Mobile Devices
Researchers first identified the malware when it was detected on mobile devices in Southeast Asia. security software company McAfee received reports of smartphones lagging inexplicably and overheating.
The malware masquerades as a third-party Google Play app. Once installed, it accesses the device's hardware, specifically the graphics processing unit (GPU). It then uses the GPU to mine Monero. The trojan repeatedly restarts the mining process.
Initially, this can cause the phone to slow down and drain the battery. If the mining continues for a prolonged period, it can even physically damage the battery. In the worst-case scenario, unmitigated crypto-jacking can permanently damage the device. ## The Trojan's Method
Although the Trojan's author has not been identified, researchers surmise that it uses a recently discovered vulnerability in Android's transaction processing component. The security flaw allows hackers to obtain root access to any app installed on the device.
The malware targets the Android transaction processing component, which receives transaction requests, verifies them, and returns a response. The component is vulnerable to a memory corruption flaw, which the Trojan exploits to install root certificates and own the device.
Once installed, the Monero miner runs silently in the background. It opens a port on the device, allowing the hacker to communicate with it remotely. Researchers have discovered that the hackers often communicate with the device over text messages. ## Who Is Affecting?
Most of the affected devices are low-end smartphones, which are typically limited by the amount of power they can supply to an app. The victims usually reside in Asia and the Middle East. However, it is yet unclear if the hackers are based in the same region or targeting nearby victims.
The malware listens on a specific port and waits for the hacker to connect. They send a command over text, which the trojan then decodes and executes. Researchers say the code's encryption technique matches other malware in circulation. ## Protecting Android Users
The malware highlights the importance of keeping the operating system up-to-date and only downloading apps from legitimate sources. Users in affected areas are advised to check for unusual activity on their phones. They are also encouraged to install a third-party anti-malware program.
Android users are generally advised to avoid installing apps that ask for extensive permissions, especially for features unrelated to the app's stated purpose. Many apps are known to have spare functionality, but some are effectively malware in disguise.
