Mobile malware's disruptive impact on enterprises continues to see an uptick in prevalence as mobile devices become an increasingly preferred platform to flexibly access and manage data. We recently found 200 unique Android apps—with installs ranging between 500,000 and a million on Google Play—embedded with a backdoor: MilkyDoor (detected by Trend Micro as ANDROIDOS_MILKYDOOR.A).
MilkyDoor is similar to DressCode (ANDROIDOS_SOCKSBOT.A)—an Android malware family that adversely affected enterprises—given that both employ a proxy using Secure Socket (SOCKS) protocol to gain a foothold into internal networks that infected mobile devices connect to. MilkyDoor, maybe inadvertently, provides attackers a way to conduct reconnaissance and access an enterprise’s vulnerable services by setting the SOCKS proxies. Further, this is carried out without the user’s knowledge or consent.
While MilkyDoor appears to be DressCode’s successor, MilkyDoor adds a few malicious tricks of its own. Among them are its more clandestine routines that enable it to bypass security restrictions and conceal its malicious activities within normal network traffic. It does so by using remote port forwarding via Secure Shell (SSH) tunnel through the commonly used Port 22. The abuse of SSH helps the malware encrypt malicious traffic and payloads, which makes detection of the malware trickier.
Post from: Trendlabs Security Intelligence Blog - by Trend Micro
DressCode Android Malware Finds Apparent Successor in MilkyDoor
CSO Perspectives Roadshow Interview - Silas Barnes, Group Chief Information Security Officer, Virgin Australia Group
CSO Perspectives Roadshow 2017 Showreel
CSO Perspectives Roadshow Interview - Jeff Lanza, Retired FBI Agent (USA)
CSO Perspectives Roadshow Interview - Mark Loveless "Simple Nomad" Senior Security Researcher at Duo Security
Panel Session sponsored by VMware, Application Security: Does moving your applications to the Cloud mean reduced risk or just relocated risk?