F-Secure Mobile Security in action

Installing an infected program

Zimry, a Malware Analyst in F-Secure’s Kuala Lumpur Labs, was recently doing some analysis on malware designed to infect Android phones. During the analysis, he ran some malicious samples on a smartphone installed with F-Secure Mobile Security to make sure the phone would be protected.

Since Safe and Savvy has writing about mobile security, we thought we’d use this sample to show you our Mobile Security in action.

The test samples used were related to the new Android trojan, which seems to be targeted towards users in mainland China and are being distributed on free file-sharing networks there. The samples were trojanized programs – that is, an attacker took legitimate programs, inserted their own malicious code and recompiled the program to create malware. The samples we’ve seen so far came from a third-party application provider in China. Most of the programs are advertised as offering wallpaper for phones.

At right (above) is an example of an infected program being installed on the test phone. During the installation process, the file is scanned by Mobile Security – and it is detected as infected.

Scanning results

Some users don’t have Mobile Security set to automatically scan files at installation. In which case, the infection is only discovered when the phone is manually scanned. After a manual scan, the user would see a notification like the one at left, informing them that the programs are infected.

As you can see, Mobile Security detects the infected files as two trojans, from two separate families:

• Trojan:Android/Adrd.A
• Trojan:Android/Geinimi.A

Adrd trojans behave as straight-forward (but still nasty) Trojan-Clickers, whereas trojans from the Geinimi family, are more sophisticated, almost powerful enough to be classed as Backdoor programs.

Another feature Zimry tested was Browsing Protection. He tried browsing a website known to be a phishing site. On an unprotected mobile browser (i.e., no antivirus installed), he managed to get to the actual phishing screen with no warning:

Phishing site

On the test phone however, since he had Browsing Protection enabled, what he saw was this:

Warning

Since harmful sites like this may also be hosting trojans, Browsing Protection would also be a good precautionary measure against unintentionally coming across and downloading such malware.

So it’s nice to know Mobile Security works at three key points – potential download, during installation and on scanning.

Are you using our Mobile Security? You can still try out it out for free.  We’d appreaciate your feedback. All pertinent comments/suggestions/constructive criticisms will be passed to the development team to improve our protection.

Thanks,

Alia