I've read a little bit in the last few days about HummingBad, an Android virus which tries to gain root access. It seems to use the root access to display ads and install apps. Varying estimates put the affected devices between 10 million and 80 million. Apparently the criminals behind this virus stand to make millions of dollars per year from these ads.
Apparently this malware works by gaining root access. (Or can it still do damage even if it fails to gain root?)
If I had to guess, I would assume the process is something like this:
- HummingBad is bundled into some seemingly innocuous app (game, etc.) unwittingly installed by user from somewhere.
- When the user runs the app, the app immediately tries to do something similar to what
white-hat apps like KingoRoot and Towelroot do, trying to root the device without the need for an external computer. However, instead of installing Super SU and giving the user control over the root access, the control goes to a remote server controlled by the criminals, with the goal that the owner of the device won't even realize what has happened.
- The criminals proceed to use the root access for whatever they want (display ads for revenue, install apps, mining cryptocurrency, botnet node, spreading the virus further, etc.)
Are my assumptions here correct? Particularly regarding point 2. Is this sort of like a black hat version of Towelroot/KingoRoot?