ANDROIDOS_WORMHOLE.ESA

The application contains the vulnerable Moplus SDK, from Baidu. The SDK has backdoor like routines such as getting location, getting package information, pushing phishing pages, inserting arbitrary contacts, sending fake SMS, uploading local files to remote servers and installing any applications to the Android devices without user's authorization.

NOTES:

The application contains the vulnerable Moplus SDK, from Baidu. The SDK has backdoor like routines such as getting location, getting package information, pushing phishing pages, inserting arbitrary contacts, sending fake SMS, uploading local files to remote servers and installing any applications to the Android devices without user's authorization.

When a user launches the application, Moplus SDK automatically sets up a local HTTP server on the device in the background. It keeps monitoring the messages that go through the socket. When a messages sent from remote clients arrives, it is parsed and the SDK start executing the corresponding routines based on the command in the message. Since there is no identity authentication in the local HTTP server, which is set up by Moplus SDK, an attack can be triggered not only by an App developer but by anyone. With just one command, an attacker or cybercriminal can remotely control the device. Applications with this SDK exposes the user under high risk.