-1

I have reason to believe that my Lineage OS (14.1-20180620 nightly build) may be infected with malware. How should I deal with this?

Other questions recommend running Malwarebytes. A question asking about typical malware techniques did not receive an answer.

Details:

With K9 mail I opened an Email that contained what appeared to be a png image and a link to a jar file (yniaaa.jar) hosted on doko.moe (an url known to be used for malware distribution) but showed only plain text (and not very much of it). This was followed by strange behavior of the K9 mailclient (it did not show all emails any more; in the webmail interface all emails were still present). A google search for any of these details (file name, url, sender email address (probably forged, but still)) does not turn up very much.

I do have a backup of the email (But I do not know how to investigate it safely).

Possibilities:

  • Uninstall K9 (obviously)
  • Change all passwords (obviously)
  • Wipe everything, reinstall everything (disadvantage: it is inconvenient and currently impractical)
  • Find out what kind of malware it is and what it does since it may have sent emails in my name before the password change took effect? (disadvantage: I do not know how to do that.)
  • Run Malwarebytes (disadvantage: will this find and remove everything?? I do not know how it works. EDIT: I also do not understand it. In my case it does nothing besides running a really really dumb animation and show a welcome screen.)
  • Remove any leftover data of K9, reinstall then (disadvantage: 1. I do not know how. 2. Lineage itself may be compromised. I do not know anything about malware on Android/Lineage. From the abscence of root passwords etc, I assume that security standards are in general very very very low.)
  • Inspect the system with adb (disadvantage: I do not know how)

Versions Lineage OS (14.1-20180620 nightly build); K9 mail: version unknown (I uninstalled it before I thought of checking the version number. I do not know how to check the version number after the uninstall is complete.)

  • Best practice would be to not click on links from suspected bad emails or from senders you don't know, etc. – SiXandSeven8ths Aug 14 '18 at 15:03
  • @SiXandSeven8ths Thank you for this comment. Please note that this is easier said than done if the only interface you have is a touchscreen and an app you are not 100% familiar with. I attempted to delete the email but ended up opening it. – 0range Aug 16 '18 at 22:04
  • 1
    If you want to investigate you may want to setup a virtual machine on a desktop and install Android-x86. Then install your K9 mail client. Afterwards, take md5hash and a list of file hierarchy of data, cache, system and boot partition respectively and save it outside the ANdroid-x86. This should be considered the pristine image of your Android machine. Now setup K9 mail client with your email ID. Open that suspicious email, then that attachment and observe if the same events occurred as with your phone. Now repeat the md5hash and file hierarchy for all partitions and compare with previous one – Firelord Aug 20 '18 at 7:36
  • 1
    I cannot ensure how well this would work but if the Android-x86 would be infected, this is the way to go. Comparison of md5hash and file hierarchy can pinpoint changes, though you would have to eliminate obvious false positives in data partition. Make sure you are using the same Android-x86 version corresponding to Android version in your device. – Firelord Aug 20 '18 at 7:38
1

Run Dr. Web Security Space Antivirus in full scan on your lineage. If it does not say there's a malware trust me there isn't. After that check what it recommends. Ignore only Google Play Services Adware warning

In order to wrap things up easily. When we look at a virus that can cause a computer or a phone to totally turn into nothing but a brick, then we surely mean a virus that can modify system components and hence cause system to malfunction.

Windows OS to start with, has an ability to enable programs to run as Administrator and hence can modify the system files like installing device drivers, accessing keystore and configuring hardware devices. If you're logged in as an administrator and you have explicitly allowed programs to run as administrator without prompt, you may be vulnerable to have programs with ill intentions to modify system components. We call these malware if they delete, replicate and hide files.

Talking about Linux based OS, specifically on computers like the Mac, Ubuntu, Resurrection etc, the administrator rights are granted by the SuperUser script which works after being initialized at boot by its daemon. This is just like a rooted android where an app can configure and access the root file system and execute system shell commands like removing, downloading data into a partition and creating file systems. Applications can use these to delete essential files like the framework files and hence spoil your Linux PC.

Lastly, we all know Android runs a modified Linux Kernel which means SuperUser rights can be granted by rooting. This way the ability to modify the system is possible but only by explicitly granting the rights by allowing root manager to allow the app to gain root access and modify the system. These are the only ways to brick a phone or PC. But naturally Android is not rooted by default and it makes it harder to get bricked. The only type of problem we have in android is apps that popup adverts and that just irritates us but has no harm to the system.

I have noticed very well that some third party Androids come with pre-installed apps that can install other apps. This is enhanced by a main app at /system/app or /system/priv-app/, a framework file to render advertising UI and install apps at /system/framework/, a script for installing apps, at /system/bin or sbin and a library to support its main app at /system/lib/. I have seen this evident in some fake Sony phones but after running Dr. Web Security Space, it can identify all of them then you can root and delete them to avoid these ill behavior.

Please note that Google Play Services will be listed because they can popup adverts above apps but just ignore this since these are essential services for entire Google apps

Why Dr. Web Security Space? Here I have tried a lot of antivirus software on android and surely many of them scan application permissions, known apps to cause problems. This doesn't go beyond discovery of apps that can access private information and what apps are known to cause things like ads and basic perceptible things. Dr. Web goes around scanning system apk files. Treating each as a zip archive and scanning their code and data and assets each to see what they can cause. This makes it able to discover even apps at your memory card which are not installed whether they are harmful or not. It scans framework files each as a jar archive to know what harm they can do and thus discover them. What does it mean. This software first tends to know what type of file is a file regardless of its file extension or name then scans in it file by file through code texts and through archives and through executables to know their harm. So it's the best I can recommend. It even shows you what it's scanning in a file and exactly what is harmful and recommends the best action. I don't think there's anything out there that does all these

  • Thank you for your answer. So you are saying that antivirus software for Android is so sophisticated that the user should not be worried about malware that is not caught by antivirus software. Could you please add some explanation why this is the case (why this level of sophistication is achieved in Android when this is elusive for other OS)? Could you please explain whether this applies in your opinion to all Android antivirus software or specifically only to Dr. Web Security Space. If it applies only to Dr. Web Security Space, could you please explain what makes this software so special? – 0range Aug 16 '18 at 22:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.