CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Permissions Privileges and Access Controls
Summary: android devices with code from ragentek contain a privileged binary that performs over-the-air (ota) update checks. additionally, there are multiple techniques used to hide the execution of this binary. this behavior could be described as a rootkit. this binary, which resides as /system/bin/debugs, runs with root privileges and does not communicate over an encrypted channel. the binary has been shown to communicate with three hosts via http: oyag[.]lhzbdvm[.]com oyag[.]prugskh[.]net oyag[.]prugskh[.]com server responses to requests sent by the debugs binary include functionalities to execute arbitrary commands as root, install applications, or update configurations. examples of a request sent by the client binary: post /pagt/agent?data={"name":"c_regist","details":{...}} http/1. 1 host: 114.80.68.223 connection: close an example response from the server could be: http/1.1 200 ok {"code": "01", "name": "push_commands", "details": {"server_id": "1" , "title": "test command", "comments": "test", "commands": "touch /tmp/test"}} this binary is reported to be present in the following devices: blu studio g blu studio g plus blu studio 6.0 hd blu studio x blu studio x plus blu studio c hd infinix hot x507 infinix hot 2 x510 infinix zero x506 infinix zero 2 x509 doogee voyager 2 dg310 leagoo lead 5 leagoo lead 6 leagoo lead 3i leagoo lead 2s leagoo alfa 6 iku colorful k45i beeline pro 2 xolo cube 5.0
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-07-13
Last Modified Date: 2019-10-09