A new breed of dangerous Android malware is on the loose, and not even the most up-to-date version of Android's smartphone operating system is safe.
The malware, called "GingerMaster," has been found harvesting data on infected Android smartphones and sending the stolen info, including device IDs and phone numbers, to a remote server, researchers at the security firm Kaspersky Lab reported.
GingerMaster is particularly scary because it is able to exploit Android 2.3, (or "Gingerbread"), the current version of Android's operating system for smartphones, and gain root privileges that allow it to establish a line of communication directly between the infected device and the remote server.
"Due to the fact that GingerMaster contains the most recent root exploit, we consider it poses one of the most serious threats to mobile users," wrote Xuxian Jiang, the North Carolina State University computer science professor who discovered the malware.
GingerMaster infects users the way most smartphone viruses do, by hiding in legitimate apps and automatically downloading in the background, unnoticed. (Kaspersky Lab researchers said there is no indication that any apps in the official Android market are harboring the malware.)
GingerMaster is actually a variant of DroidKungFu, a piece of malware found in May. The original version, found hiding in unauthorized apps in the Chinese app market, had the same functionality as GingerMaster but only took advantage of earlier versions of Android's operating system.
GingerMaster is a different animal: not only does it target Android 2.3.3 (Jiang said more than 90 percent of Android devices run Android 2.3.3 or below), but it "can successfully evade the detection of all tested (leading) mobile anti-virus software."
When downloading smartphone apps, search reputable app stores only, and check reviews and ratings; if an app looks okay, but the customer feedback says otherwise, it's best to stay away.
Also, check to see what permissions apps ask for, and, as Jiang wrote, "make sure you are comfortable with the data they may be accessing." If you feel the app is asking too much, don’t download it.
Lastly, make sure you are running up-to-date anti-virus software on your phone. A list of options can be found here.
