New Android malware can steal personal data and wipe a device's contents

Though mobile security has tightened up a great deal since the early days of Android, keeping the baddies at bay will always be a game of digital whack-a-mole. Danish security firm Heimdal has unearthed a particularly spiteful new piece of malicious software that can gain admin rights to a device and wreak subsequent havoc. 

Once any piece of malware has obtained admin rights, the intruder's overlord gains carte blanche over the target device. The Mazar malware is no exception, and takes full advantage of whatever it can infiltrate. Spread via SMS, it can make calls (potentially to premium rate lines), read texts and delete the contents of an entire Android smartphone or tablet without warning. Heimdal believes that Mazar could have reached up to 100,000 handsets in Denmark, though the effect outside of the Scandinavian nation has yet to be established. 

Mazar can only affect devices where users have permitted untrusted app installations via Settings, though. If you don't know what that means, then you're probably safe on this occasion, since Google's platform blocks installs from unverified sources by default. 

If a device does allow apps to be installed from external sources, then Mazar can sink its claws in. Spread under the guise of a legitimate SMS message containing a link, users that tap on said URL then have Tor installed on their device. Tor's services, for those unaware, allow users to connect to the Internet under a veil of anonymity. Great for privacy, but also useful to a hacker funneling malicious software to and from a device undetected, as is the case here. 

Interestingly, the malware cannot be installed on any device with Russian as its selected as its language. Heimdal has tested the bug on Android 4.4 KitKat, but not on any newer editions for now, so it's unknown whether Lollipop or the latest Marshmallow are susceptible. 

As ever, stick to the Google Play Store wherever possible for all of your downloading needs, and ignore any unsolicited SMS messages if you want to avoid Mazar's evildoing. 

source: BBC