I've read a little bit in the last few days about HummingBad, an Android virus which tries to gain root access. It seems to use the root access to display ads and install apps. Varying estimates put the affected devices between 10 million and 80 million. Apparently the criminals behind this virus stand to make millions of dollars per year from these ads.

Apparently this malware works by gaining root access. (Or can it still do damage even if it fails to gain root?)

If I had to guess, I would assume the process is something like this:

  1. HummingBad is bundled into some seemingly innocuous app (game, etc.) unwittingly installed by user from somewhere.
  2. When the user runs the app, the app immediately tries to do something similar to what
    white-hat apps like KingoRoot and Towelroot do, trying to root the device without the need for an external computer. However, instead of installing Super SU and giving the user control over the root access, the control goes to a remote server controlled by the criminals, with the goal that the owner of the device won't even realize what has happened.
  3. The criminals proceed to use the root access for whatever they want (display ads for revenue, install apps, mining cryptocurrency, botnet node, spreading the virus further, etc.)
  4. Profit.

Are my assumptions here correct? Particularly regarding point 2. Is this sort of like a black hat version of Towelroot/KingoRoot?

  • Wouldn't the user have to run the installer for the (game, etc.) as root for the malware to get root privilege? Someone was telling me you can get root privilege through processes that already run as root by injecting binary code into them – Kolob Canyon Oct 28 '16 at 4:02
  • @KolobCanyon Probably, I have no idea. – Revetahw Oct 28 '16 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.