Security experts from Lookout have discovered an app on the Google Play Store, named LevelDropper, that hides malware and is capable of rooting the user's device in order to install unwanted applications.
The name of the app is LevelDropper and it is a digital version of a common tool found on construction websites and in toolkit .
The problem is that, when users install this application, they may notice an empty pop-up window appearing in LocationServices.
According to Lookout experts, this is a red flag, as it's a sign that an Android OS service has just crashed. These kinds of crashes are how exploits manifest.
In the background, the malware hidden in the LevelDropper code starts executing malicious code and exploits the crash to escalate its access to the root user.
After analyzing the entire code of the app, Lookout researchers say that the app does not have any new rooting functionality, but rather takes advantage of rooting exploits that are already available.
Normally, these types of exploits should have been detected by Google's Bouncer, a security system used to screen apps before they are added to the Play Store.
Lookout says that, 30 minutes after installing LevelDropper, the app had already downloaded and installed 14 apps, all without user interaction.
Analyzing the file system of the infected phone, the researcher failed to find the usual echo that remains behind most rooting exploits, i.e., the scammers tried especially to hide their actions.
In addition to the privilege escalation rooting exploit, researchers claim to have found two more privilege escalation exploits and support for package files, such as SuperSU, busybox, and supolicy. These two additional privilege escalation exploits also had the ability to root the device.
Just last week, security researchers at Trend Micro found the Godless malware, which also used rooting exploits to root Android devices and later install adware and unwanted apps. The Godless collection of rooting exploits made it possible against 90 percent of all Android phones on the market today.
