Warning: Malware compromise potential to Custom ROMs/Community builds

[gurgle]

There is some new malware targeting Custom ROMs. This Trojan primarily focuses on the low end Chinese builds. The Lookout Mobile Security group blogged about this finding. < Link > They have identified at least eight different instances of the trojan jSMSHider. The current potential of compromise is low, but you should be aware. This could easily migrate to other ROMs, and the impact could create a problem of trust with community Builds or Custom ROMs.

The application would appear to be installed as a default build application. This type of Trojan tries to take control over the mobile phone functionality by rooting the phone. jSMSHider exploits a vulnerability in the way most custom ROMs sign the system image. Publicly available private keys in the Android Open Source Project (AOSP) are commonly used to sign the custom builds. The end result is this exploit attempts install custom commands and receive instructions from external servers. Information could be passed back, and the device could be used to connect if possible to a costly SMS service.

Most AV products for Android would identify and protect from this compromise attempt. The problem is most individuals who use custom ROMs do not want the CPU impact from an Android AV product. The best recommendation is to be aware, and be cautious of unknown custom/community build ROMs.

 

[OffWorld]

The linked blog post says the trojan uses:

...publicly available private keys in the Android Open Source Project (AOSP) [that] are often used to sign the custom ROM builds.

There is presently only one comment there which says:

CYANOGEN SAYS:
JUNE 16, 2011 AT 9:52 AM
CyanogenMod 7 users- we addressed this issue by disallowing these kinds of apps (signed with platform keys) on user-controlled storage. Be sure you have the latest release.

So CM7 doesn't allow this key to be used, but is there an easy way to find out if our rom allows the AOSP "platform key" or not? It would be nice to know if our firmware can be compromised by this or not by this trojan.