Money stolen via Android malware Port 4000 remote anything exploit

Question

As background, my business bank account was compromised. The compromise also involved call forwarding of a smartphone. So they got bank credentials and cell phone credentials.

I initially suspected key-loggers on compromised laptops, compromised networking equipment at home or office, or social engineering. But it finally dawned on me that my Android phone was another possible source for the breach.

Last night, using an Android network scanner, I scanned my home network and saw that my Droid Turbo had two services running, one for Port 4000 and I believe the other was Port 4500. Port 4000 was "Remote Anything slave" and a quick Google let me know that this gives a hacker complete control of my device. Other Android phones in the family did not have these services running. I quickly shut the phone down and am going to buy a new phone this morning.

My assumption at this point is that the phone hack allowed them to get my cell phone company passcode that allowed them to forward bank activation codes; the bank and phone company confirm this happened.

I guess my question is whether every computer and phone on my networks (business and home) are now likely to have malware? From the phone, can the malware go to the router and then go put malware on other devices. Is there likely to be malware on the router? I'm trying to understand what needs to be replaced. I should add that I don't recall going to the bank website on my cell phone but it's possible. I don't have the bank app but I might have logged in on the train ride home to do something.

Any and all advice is appreciated. Surprisingly, the bank, the cell phone company and Google don't seem all that interested in investigating, so I guess I am on my own.

Answer 1

Stuff like this happens everyday. It's not a surprise that any of the companies don't want to investigate. It's too small of a scale and not in their best interest to do so. Now as for your questions...

• Network Devices: Home/consumer network devices are typical not kept as secure or firmware updates released as often for. The best thing to do would be to check the manufacturer's website of your router/AP/switch to see if you're running the latest firmware. A hard/factory reset of the device would be prudent. While it's unlikely that the malware on the phone was able to infect your router in any way, it's not impossible. Also, if your home router allows you to implement policies, consider blocking unnecessary outbound traffic. This can deter malware applications from reaching their host if they are not using a default http/https port.
• Other computers/phones: You should start by changing Administrator passwords on each device and running full AV scans. If you use any cloud-based file sharing services (i.e.- Google Drive, Dropbox, etc.) you'll want to scan those as well. Certainly try and target the services you used on your infected phone first. Any accounts that were tied to your phone should have their credentials changed, including username, if possible. If you're not already doing so, make sure you're running a software firewall on each of your machines.
• Gmail: I'm assuming that you have a Gmail account and that several of your services are tied to this account. Consider using the Google Authenticator service that Google provides. It requires a 6 digit PIN whenever you try and use your Google account for ANYTHING that isn't already approved. Your email account generally is the apex for many other accounts. Set a password on it that is different from all other accounts (which you should always do anyways) and implement the maximum security your provider allows.
• Additional Security Moving Forward: For credit cards and bank accounts, setup email/text notifications to notify you when charges are made or when new devices are used to access your accounts. Most banks offer this. Also, be very careful about the applications you install on your phone. It's possible the the infection came from an application that was installed by you to begin with.

Answer 2

RemoteAnyThing is actually a SMS management app designed to let you offload control over SMS to a computer (to read/send SMS without using your phone). It isn't itself a virus, but obviously it is very useful to an attacker going after one time use codes for banks, sent to phones via SMS. This would also let them (depending on if your provider does this via sms) set up call forwarding. Lastly, you (or an attacker, unfortunately) can deploy this via the Google Play store so the actual attack probably started as a compromise of your Google account, and led them to your phone which through clever app usage allowed them to steal two factor auth tokens.

I second the other answer, using 2FA on your Google account is a really REALLY good idea, it hardens the accounts that basically encapsulate your whole life (esp if you use an Android powered phone) and it is impossible to understate the need to take every precaution when protecting access.

Edit: to more completely answer your final question: RemoteAnyThing appears to operate via a direct connection to a computer, hence the port availability. So, either your desktop was compromised to run the software in secret, or your router was compromised to port forward the connection from the software running somewhere else (on the attackers' computer or a zombie intermediary).