Adversaries may abuse Android’s device administration API to obtain a higher degree of control over the device. By abusing the API, adversaries can perform several nefarious actions, such as resetting the device’s password for Endpoint Denial of Service, factory resetting the device for File Deletion and to delete any traces of the malware, disabling all the device’s cameras, or to make it more difficult to uninstall the app.
Device administrators must be approved by the user at runtime, with a system popup showing which actions have been requested by the app. In conjunction with other techniques, such as Input Injection, an app can programmatically grant itself administrator permissions without any user input.
| ID | Name | Description |
|---|---|---|
| S1061 | AbstractEmu |
AbstractEmu can modify system settings to give itself device administrator privileges.[1] |
| S0540 | Asacub | |
| S9004 | Crocodilus |
Crocodilus has the ability to request device administrator permissions.[3] |
| S0522 | Exobot | |
| S0536 | GPlayed | |
| S1077 | Hornbill | |
| S0539 | Red Alert 2.0 |
Red Alert 2.0 can request device administrator permissions.[7] |
| S1082 | Sunbird | |
| S0318 | XLoader for Android |
XLoader for Android requests Android Device Administrator access.[8] |
| ID | Mitigation | Description |
|---|---|---|
| M1006 | Use Recent OS Version |
Changes were introduced in Android 7 to make abuse of device administrator permissions more difficult.[9] |
| M1011 | User Guidance |
Users should scrutinize every device administration permission request. If the request is not expected or the user does not recognize the application, the application should be uninstalled immediately. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0630 | Detection of Device Administrator Permissions | AN1701 |
For Android, detect Device Administrator Permissions from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes DevicePolicyManager.resetPassword(), lockNow(), wipeData(), or setCameraDisabled() immediately after Device Admin activation without MDM-initiated policy context or user interaction]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |