Shedun

Shedun is a family of malware software (also known as Kemoge, Shiftybug and Shuanet^[1][2][3]) targeting the Android (operating system) first identified in late 2015 by mobile security company Lookout (company), affecting roughly 20,000^[4] popular Android applications.^{[3][5][6][7][8][9]} Lookout claimed the HummingBad malware was also a part of the Shedun family, however, these claims were refuted.^[10][11]

Avira Protection Labs stated that Shedun family malware is detected to cause approximately 1500-2000 infections per day.^[12] All three variants of the virus are known to share roughly ~80% of the same source code.^[13][14]

In mid 2016, arstechnica reported that approximately 10.000.000 devices would be infected by this malware ^[15] and that new infections would still be surging.^[16][17]

The malware's primary attack vector is repackaging legitimate Android applications (e.g. Facebook, Twitter, WhatsApp, Candy Crush, Google Now, Snapchat^[18])^[4][19][20] with adware included, the app which remains functional is then released to a third party app store;^[21] once downloaded, the application generates revenue by serving ads (estimated to amount to $2 US per installation^[20]), most users cannot get rid of the virus without getting a new device, as the only other way to get rid of the malware is to root affected devices and re-flash a custom ROM.^[5][22][23]

In addition, Shedun-type malware has been detected pre-installed on 26 different types^[24] of Chinese Android-based hardware such as Smartphones and Tablet computers.^{[25][26][27][28] [29][30][31][32][33][34][35][36][37][38][39]}

Shedun-family malware is known for auto-rooting the Android OS ^[19][40] using well-known exploits like ExynosAbuse, Memexploit and Framaroot ^[41] (causing a potential privilege escalation^[20][42][43])^[44] and for serving trojanized adware and install themselves within the system partition of the operating system, so that not even a factory reset can remove the malware from infected devices.^[45][46]

Shedun malware is known for targeting the Android Accessibility Service,^{[2][45][47][48][49][50][51]} as well as for downloading and installing arbitrary applications^[52] (usually adware) without permission,^[3] it is classified as "aggressive adware" for installing potentially unwanted program ^[53][54][55] applications and serving ads.^[56]

As of April 2016, Shedun malware is, by most security researchers, considered to be next to impossible to remove entirely.^{[57][58][59][60][61][62]}

Avira Security researcher Pavel Ponomariov, specialized in Android malware detection tools, mobile threats detection and mobile malware detection automation research,^[63] has published an in-depth analysis of the computer virus.^[12]

See also

• Brain Test
• Dendroid (Malware)
• Computer virus
• File binder
• Individual mobility
• Malware
• Trojan horse (computing)
• Worm (computing)
• Mobile operating system

References