Practical Mobile Forensics - Third Edition

How does malware spread?

An Android device can be infected with malware in several different ways. The following are some of the possible ways:

• Repackaging legitimate application: This is the most common method used by attackers. The attacker first downloads a legitimate application, disassembles it, then adds their malicious code, and reassembles the application. The new malicious application now functions exactly as the legitimate application does, but it also performs malicious activity in the background. This kind of application is commonly found in the third-party Android app stores and is downloaded by many people.
• Exploiting Android vulnerabilities: In this scenario, an attacker exploits the bugs or the vulnerabilities that are discovered ...