Categories: spyware

Google Discovered New Tizi Android Spyware that can Spying WhatsApp, Viber, Skype, LinkedIn

A highly critical Tizi Android Spyware discovered from Google Play store that have rooting capabilities to spying the sensitive information in Android mobile users popular social media applications.

Tizi steals sensitive data from popular social media apps like Facebook, Twitter, WhatsApp, Viber, Skype, LinkedIn, and Telegram.

Also Read: Facebook Image Removal Vulnerability allows Users to Delete any Photos

This spyware app Developers creating a website for promoting the spyware via social media to reach more number of peoples and trick them to install this Malicious spyware app.

Tizi-infected app

It mainly targeting African countries, specifically: Kenya, Nigeria, and Tanzania . kenya is listed as most impact country by this Tizi Android Spyware.but there was also a significant number of infections in Nigeria and Tanzania.

This malicious application discovered by google security scan and it mainly performing to gain the root access of the target and exploit the old vulnerabilities.

According to the Google report, around 1,300 devices affected by Tizi and still its rapidly spreading its variant around the world.

How Does Tizi Android Spyware Work?

Since earlier Tizi family variants didn’t have the rooting and obfuscation capabilities, newly spreading this Tizi gain root access of targeting phone is considering as a main future.

Once it gaining the root access of the targeting mobile , it will contact first to the command & control server by sending the SMS with the device’s GPS coordinates.

Communication between C&C Server and Tizi using HTTPS in some specific versions,Tizi uses the MQTT messaging protocol with a custom server.

After established the successful connection, Tiza backdoor performing some dangerous spying activities such as recording calls from WhatsApp, Viber, and Skype; sending and receiving SMS messages; and accessing calendar events, call log, contacts, photos, Wi-Fi encryption keys, and a list of all installed apps.

According to Google, Tizi apps can also record ambient audio and take pictures without displaying the image on the device’s screen.

Tizi Android Spyware Exploiting related vulnerabilities are mainly target older chipsets, devices, and Android versions.

But most of the vulnerabilities are already patched but Tizi Android Spyware always trying to gain some high level permission by sending SMS messages and monitoring, redirecting, and preventing outgoing phone calls.

Tizi Android Spyware can root the device by exploiting one of the following local vulnerabilities:

CVE-2012-4220
CVE-2013-2596
CVE-2013-2597
CVE-2013-2595
CVE-2013-2094
CVE-2013-6282
CVE-2014-3153
CVE-2015-3636
CVE-2015-1805

Mitigation Steps for PHA’s

Potentially Harmful Applications are always try to install some harmful malicious application into victims mobile. following steps are common mitigation step to protecting from PHA’s by Google.

Check permissions: Be cautious with apps that request unreasonable permissions. For example, a flashlight app shouldn’t need access to send SMS messages.
Enable a secure lock screen: Pick a PIN, pattern, or password that is easy for you to remember and hard for others to guess.
Update your device: Keep your device up-to-date with the latest security patches. Tizi exploited older and publicly known security vulnerabilities, so devices that have up-to-date security patches are less exposed to this kind of attack.
Google Play Protect: Ensure Google Play Protect is enabled.
Locate your device: Practice finding your device, because you are far more likely to lose your device than install a PHA.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.