Key Points:
- Newly discovered Android malware, Snowblind, exploits a security feature for malicious activities.
- Google assures users it is aware of the threat and has existing safeguards in place.
- Google Play Protect automatically blocks Snowblind and similar threats, both within and outside the Play Store.
A recent report from a security firm sent shivers down the spines of Android users. The culprit: Snowblind, a novel Android malware that reportedly weaponizes a built-in security feature to bypass detection. However, in a swift response, Google has assured users that they are already protected against this threat.
Discovered by Promon, a mobile security company, Snowblind is a banking malware that manipulates the “seccomp” (secure computing) function within the Android system. This manipulation allows it to evade standard security checks and execute malicious activities undetected. This could potentially lead to stolen login credentials and unauthorized financial transactions.
Promon highlighted the unique nature of Snowblind, stating they had never encountered “seccomp being used as an attack vector before.” This raised concerns about the vulnerability of existing apps. The company recommended app developers upgrade to the latest version of Promon SHIELD to mitigate the risk.
Following the initial report, Google clarified the situation. They confirmed their prior awareness of Snowblind and its techniques. Their official statement emphasized that no apps containing this malware were found on the Google Play Store. Google Play Protect, a pre-installed security feature on Android devices, automatically shields users from known variants of Snowblind. This protection extends to apps downloaded outside the Play Store, as long as Google Play Services is enabled.
While Snowblind initially appeared to be a significant threat, Google’s swift response assures users of their continued protection. This incident underscores the importance of downloading apps only from reputable sources and keeping security software up-to-date.
