"value":"Google is constantly working to improve our systems that protect users from Potentially Harmful Applications (PHAs). Usually, PHA authors attempt to install their harmful apps on as many devices as possible. However, a few PHA authors spend substantial effort, time, and money to create and install their harmful app on a small number of devices to achieve a certain goal. This blog post covers Tizi, a backdoor family with some rooting capabilities that was used in a targeted attack against devices in African countries, specifically: Kenya, Nigeria, and Tanzania. We'll talk about how the Google Play Protect and Threat Analysis teams worked together to detect and investigate Tizi-infected apps and remove and block them from Android devices.",
"Tag":[
{
"colour":"#00223b",
"local":"0",
"name":"osint:source-type=\"blog-post\"",
"relationship_type":""
},
{
"colour":"#005fa4",
"local":"0",
"name":"osint:source-type=\"manual-analysis\"",
"relationship_type":""
},
{
"colour":"#0071c3",
"local":"0",
"name":"osint:lifetime=\"perpetual\"",
"relationship_type":""
},
{
"colour":"#007ad2",
"local":"0",
"name":"osint:certainty=\"100\"",
"relationship_type":""
}
]
},
{
"category":"Targeting data",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512298989",
"to_ids":false,
"type":"target-location",
"uuid":"5a23d9ed-fd14-4993-975d-4ed602de0b81",
"value":"Kenya"
},
{
"category":"Targeting data",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512298989",
"to_ids":false,
"type":"target-location",
"uuid":"5a23d9ed-6a88-49ce-84a5-4ed602de0b81",
"value":"Nigeria"
},
{
"category":"Targeting data",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512298989",
"to_ids":false,
"type":"target-location",
"uuid":"5a23d9ed-5898-41c8-b8b2-4ed602de0b81",
"value":"Tanzania"
},
{
"category":"Payload delivery",
"comment":"Tizi can root the device by exploiting one of the following local vulnerabilities:",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512299428",
"to_ids":false,
"type":"vulnerability",
"uuid":"5a23dba4-6458-4b0d-adc0-495702de0b81",
"value":"CVE-2012-4220"
},
{
"category":"Payload delivery",
"comment":"Tizi can root the device by exploiting one of the following local vulnerabilities:",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512299428",
"to_ids":false,
"type":"vulnerability",
"uuid":"5a23dba4-b19c-458e-8817-407302de0b81",
"value":"CVE-2013-2596"
},
{
"category":"Payload delivery",
"comment":"Tizi can root the device by exploiting one of the following local vulnerabilities:",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512299428",
"to_ids":false,
"type":"vulnerability",
"uuid":"5a23dba4-5848-459b-94fb-4db802de0b81",
"value":"CVE-2013-2597"
},
{
"category":"Payload delivery",
"comment":"Tizi can root the device by exploiting one of the following local vulnerabilities:",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512299428",
"to_ids":false,
"type":"vulnerability",
"uuid":"5a23dba4-3244-4e21-9716-4e3602de0b81",
"value":"CVE-2013-2595"
},
{
"category":"Payload delivery",
"comment":"Tizi can root the device by exploiting one of the following local vulnerabilities:",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512299428",
"to_ids":false,
"type":"vulnerability",
"uuid":"5a23dba4-b1a0-43f8-8b7f-4c5202de0b81",
"value":"CVE-2013-2094"
},
{
"category":"Payload delivery",
"comment":"Tizi can root the device by exploiting one of the following local vulnerabilities:",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512299428",
"to_ids":false,
"type":"vulnerability",
"uuid":"5a23dba4-e6c4-4fd5-8c05-47e902de0b81",
"value":"CVE-2013-6282"
},
{
"category":"Payload delivery",
"comment":"Tizi can root the device by exploiting one of the following local vulnerabilities:",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512299428",
"to_ids":false,
"type":"vulnerability",
"uuid":"5a23dba4-7cc8-4e32-a834-42b602de0b81",
"value":"CVE-2014-3153"
},
{
"category":"Payload delivery",
"comment":"Tizi can root the device by exploiting one of the following local vulnerabilities:",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512299428",
"to_ids":false,
"type":"vulnerability",
"uuid":"5a23dba4-b3e0-4500-917a-40d302de0b81",
"value":"CVE-2015-3636"
},
{
"category":"Payload delivery",
"comment":"Tizi can root the device by exploiting one of the following local vulnerabilities:",
"deleted":false,
"disable_correlation":false,
"timestamp":"1512299428",
"to_ids":false,
"type":"vulnerability",
"uuid":"5a23dba4-9e68-471d-845e-490302de0b81",
"value":"CVE-2015-1805"
},
{
"category":"Payload delivery",
"comment":"Here is an example social media post promoting a Tizi-infected app",
"comment":"To encourage further research in the security community, here are some sample applications embedding Tizi that were already on VirusTotal.",
"deleted":false,
"description":"File object describing a file with meta-information",
"comment":"To encourage further research in the security community, here are some sample applications embedding Tizi that were already on VirusTotal.",
"deleted":false,
"description":"File object describing a file with meta-information",
"comment":"To encourage further research in the security community, here are some sample digests of exploits and utilities that were used or abused by Tizi.",
"deleted":false,
"description":"File object describing a file with meta-information",
"value":"To encourage further research in the security community, here are some sample digests of exploits and utilities that were used or abused by Tizi."
"value":"This blog post covers Tizi, a backdoor family with some rooting capabilities that was used in a targeted attack against devices in African countries, specifically: Kenya, Nigeria, and Tanzania."
