RootSmart malware can give itself root on Android 2.3, connect to a botnet

First of all, don’t freak out. Unless you are a Chinese consumer using an Android 2.3 handset that runs apps from an unofficial app market, in which case you may want to freak out just a little if your phone has been sending out strange texts without your bidding. Otherwise you are almost certainly in the clear.

Ok, calmed down? What’s happened is that a new bit of malware is being circulated in China that attacks Android handsets running Gingerbread (Android 2.3).  The malware, known as RootSmart, spreads itself through what appear to be legitimate apps in unofficial app markets. The malware then downloads a copy of Gingerbreak – the one-click root solution for Gingrebread devices – and proceeds to give itself root access. At that point the malware can take control of parts of your phone that you didn’t give it permission to initially, and that can cost you money (and make money for the nefarious hackers) by sending premium text messages or using other premium services.

RootSmart is not known to occur on the Android Market, and Google’s recently revealed  Bouncer security system was created to stop just these sorts of things. But it does highlight the downsides to one-click rooting methods – those methods are called “exploits” for a reason, as they circumvent the operating system’s own security features, opening up holes for less savory bits of code to break in through.

Not that this means that rooting is inherently bad, but root methods that require connecting the device to your computer are obviously not going to be able to be utilized by malware. At least not until hackers learn how to pull off that trick the bad Transformers pulled with the Allspark in the Michael Bay movies.

Remember, if you’re concerned about malware, you should probably stick to the official Android Market or Amazon’s App Store. If you are a Chinese user and you aren’t on Android 2.3 you should also be ok. If you happen to be rocking a Gingerbread handset in The Middle Kingdom, you should probably be vigilant about what apps you install, and stay on the lookout for odd activity. Installing a security app couldn’t hurt either.

source: Xuxian Jiang via The Verge