Snowblind Mobile Malware
A novel Android malware tracked as Snowblind exploits a security feature to bypass current anti-tampering protections in apps that manage sensitive user data. Snowblind aims to repackage target applications so they cannot detect the misuse of accessibility services. This allows the malware to capture user inputs like credentials or gain remote control to perform malicious activities.
What sets Snowblind apart from other Android malware is its exploitation of 'seccomp' (secure computing), a Linux kernel feature used by Android for application integrity checks. This feature is intended to safeguard users against unsafe actions like application repackaging.
Exploiting Security Features to Compromise Devices
Analysis of Snowblind reveals its innovative method of attacking Android applications through the exploitation of the Linux kernel feature 'seccomp.' Seccomp is a security mechanism that limits the system calls (syscalls) applications can perform, thereby reducing their attack surface. Initially integrated by Google in Android 8 (Oreo), seccomp was implemented within the Zygote process, the parent process for all Android applications.
Snowblind specifically targets applications handling sensitive data by injecting a native library that loads prior to anti-tampering mechanisms. It installs a seccomp filter to intercept syscalls like 'open()', commonly used for file access. During tampering checks of the target application's APK, Snowblind's seccomp filter prevents unauthorized syscalls and triggers a SIGSYS signal, indicating an invalid syscall argument.
To circumvent detection, Snowblind installs a signal handler for SIGSYS. This handler inspects and modifies the thread's registers, enabling the malware to manipulate the arguments of the 'open()' syscall. Researchers explain that this manipulation redirects the anti-tampering code to view an unaltered version of the APK.
Due to its targeted approach, the seccomp filter imposes minimal performance impact and operational footprint, making it unlikely for users to detect abnormalities during regular application usage.
Snowblind Allows the Attackers to Perform Various Harmful Actions
The method employed in Snowblind attacks appears to be relatively unknown, and researchers indicate that most apps are not equipped to defend against it. This type of attack operates discreetly, posing a significant risk of compromising login credentials. Moreover, the malware has the capability to disable critical app security features such as two-factor authentication and biometric verification.
Attackers can leverage this technique to access sensitive on-screen information, navigate devices, manipulate applications, and circumvent security protocols by automating actions that typically require user interaction. Additionally, they can extract personally identifiable information and transactional data.
The extent of the Snowblind attack campaign's impact on applications remains unclear. Furthermore, there is concern that other threat actors could adopt this method to evade Android protections in the future.
