cyberstrikeus T1626.001 Device Administrator Permissions
Sub-technique of: T1626
High-Level Description
Adversaries may abuse Android’s device administration API to obtain a higher degree of control over the device. By abusing the API, adversaries can perform several nefarious actions, such as resetting the device’s password for Endpoint Denial of Service, factory resetting the device for File Deletion and to delete any traces of the malware, disabling all the device’s cameras, or to make it more difficult to uninstall the app.
Device administrators must be approved by the user at runtime, with a system popup showing which actions have been requested by the app. In conjunction with other techniques, such as Input Injection, an app can programmatically grant itself administrator permissions without any user input.
Kill Chain Phase
- Privilege Escalation (TA0029)
Platforms: Android
What to Check
- Identify if Device Administrator Permissions technique is applicable to target mobile environment
- Check Android devices for indicators of Device Administrator Permissions
- Verify mitigations are bypassed or absent (2 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Identify Attack Surface
Determine if the target mobile environment is susceptible to Device Administrator Permissions by examining the target platforms (Android).
Assess Existing Defenses
Review whether mitigations for T1626.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Remediation Guide
M1006 Use Recent OS Version
Changes were introduced in Android 7 to make abuse of device administrator permissions more difficult.
M1011 User Guidance
Users should scrutinize every device administration permission request. If the request is not expected or the user does not recognize the application, the application should be uninstalled immediately.
Detection
Detection of Device Administrator Permissions
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Device Administrator Permissions technique applicable | High | Privilege Escalation |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-269 | Improper Privilege Management |