NewsAugust 3, 2017 @ 11:15 AM

Triada Trojan Creates Fresh Security Headache for Android Users

The Triada Trojan has been found in the firmware of various low-cost Android devices, which could be used to steal sensitive data and run cyber espionage modules.

The Trojan, called Android.Triada.231, was discovered by Dr. Web researchers. Entrenched in the source code of the libandroid_runtime.so system library, the malware infiltrates application processes, and can covertly download and run further malicious modules.

How Does the Triada Trojan Work?

Triada is an advanced form of malware that can insert itself into Zygote, which is an essential system component used to run programs, reported SecurityWeek. By infecting Zygote, the Trojan can launch malicious modules without the user’s knowledge.

Since it is embedded in the libandroid_runtime.so system library, the Triada Trojan is present in the memory of all running apps. This enables it to penetrate the processes of all apps without root privileges.

After the initialization process, Triada sets up some boundaries: The malware creates a working directory and checks the running environment. If the environment is suitable, it intercepts a system method, tracks the initialization of applications and performs malicious actions.

How Dangerous Is the Malware?

Dr. Web researchers reported that Triada can be used to surreptitiously download additional modules. These Trojans may run malicious plugins that allow cybercriminals to steal sensitive data from bank applications, initialize cyber espionage modules and interrupt social media conversations.

Triada can also be used to extract the encrypted module Android.Triada.194.origin from the libandroid_runtime.so system library. This module allows threat actors to potentially download further malicious components and ensure that such modules can interact effectively.

It is worth noting that the Trojan continues to evolve. Earlier this year, Triada used the open source sandbox DroidPlugin to boost its evasion abilities, SecurityWeek noted. However, in this latest development, Dr. Web researchers found the altered library on a range of Android devices, including Leagoo M5 Plus, Leagoo M8, Nomu S10 and Nomu S20.

How Should Users React?

It is impossible to delete the Android Trojan using traditional measures, such as antivirus and antimalware detection, because the malware is pre-installed and embedded into one of the libraries on the operating system. Dr. Web researchers suggested that the only safe and secure way to eradicate this Trojan is to run a clean installation of Android firmware. They informed the manufacturers of the compromised smartphones about the Triada Trojan so they can work toward a fix.

The presence of malicious software on new phones represents a fresh danger to users and businesses. Users are advised to look out for official updates and to run these releases as soon as they become available.

Share this Article:
Mark Samuels

Tech Journalist

Mark Samuels is an experienced business technology journalist with an outstanding track record in research. He specializes in the role of chief information officers (CIOs) and is adept at helping executives understand the business benefits of complex technologies. Key areas of interest include innovation, digital transformation, cloud computing, mobility, information security, ecommerce and big data. Mark has written articles for national newspapers, including The Guardian, The Times and The Sunday Times. He has also produced features and columns for a range of IT trade publications, such as Computer Weekly, ZDNet, Tech Republic, IT Pro, Channel Pro, CBR and The Register.