Can an infected Android mobile phone infect a PC running either Windows or Linux and what is the best way to prevent the spread of the infection?

Question

We have multiple users that use mobile phones that run of varying versions of Android and often plug the phones into PCs running Windows and Linux that are attached to a wider network. Can an infected mobile phone affect PCs and laptops running Windows and/or Linux and what is the best way to avert further infection?

Solution 1

An app that runs on Android cannot run on any other OS - other than via an emulator. So if we are talking about a malicious android application, then there is no risk.

If on the other hand we are talking about a Windows virus that has copied itself onto a phone from an infected PC (because a phone attached to a PC can present itself as a storage device), then you have the possibility for that virus to be copied to another Windows PC, perhaps via an auto-sync process (lots of phones come with Windows software that comes with the ability to automatically sync various content types. If this happened, then the virus would have made it to another PC. At this stage it is just a file. It would then take someone to execute the file in order to run the virus program and infect the PC.

They could do this without it being copied of course, they could plug the phone in and browse to it with explorer and run the virus executable.

This vector for infection is really no different from a usb flash drive. That it is a phone doesn't really make much difference, it is that it is a storage device. So you would use the same process to prevent it - remove user permissions to add usb devices.

Solution 2

Yes infected android phones and tablets can infect the windows operating system. The below link talks about an older type of malware that does exactly that.

When installed, the apps ask for a group of permissions from sending SMS to enable the WiFi network, handle the owner personal data including SMS, photos, contacts, GPS coordinates and also any data or file in the SD card!

After installed in the Android device, the apps download files to the SD card (autorun.inf, folder.ico and svchosts.exe). When the device was connected to a computer as an storage mass media (USB), the file svchosts.exe could be automatically executed in the computer, spreading the infection. Once in the system, the malware could activate the microphone and store the surroundings audio, encrypt it and send it to a FTP remote server.

source: Avast Blog

Solution 3

Yes, this is what happened to me.

I just plugged in my old android micro SD into my card reader in my PC. Within four min I had a log file copied into my windows folder. Six files and a folder created. PC now requires restart to update windows message came up. PC will not allow to remove change or erase text and save in those folders and files. log file contains list of executables. Six lines are 'log' and 'transmit' of different c drive folders and files. It seems the sites I've been too on my phone want to know what and where my PC is. I cannot remove these files. My computer was not connected to network. Only files on card were android files. I was trying to format the card. never opened or clicked on anything.

All i did was plug card in.

Comments

[PeanutsMonkey]

What do you mean by actually it is windoes which should not be configured to pull non-trusted code and drweb on android trivially renames autorun.inf?

[PeanutsMonkey]

What if the phone is simply attached to recharge? Is it still accessible via either operating systems especially Windows? I suspect with Linux not so much.

[Paul]

Different phones behave differently, and a subset of them will present themselves as a removable usb storage device without any configuration. Most linux desktop environments and Windows will automatically mount a removable storage device, and present the contents to the user (usually with a pop up with a bunch of options as to what to do, one of which is to browse to the device withe explorer).

[user5249203]

My Android phone defaults to "charge only" when connected. I believe this is the factory configuration. If I want to use it in "Disk Drive" mode I have to select it separately - but it charges as well as acting as a disk drive. In "charge-only" state it cannot infect the PC. In "disk drive" mode it can.

[ZaB]

namely android will not get infexted from things windows puts on SD card, or passively accept connections from the internet, thus windows is unprotected and needs some help...

[HaydnWVN]

drWeb is a piece of anti-virus software, they have a version for Android. The other part is about disabling Windows AutoRun so it doesn't automatically run a (possibly infected) file specified in a file possibly present on your attached device called 'autorun.inf'. These files are used by CDROM's to automatically run installations when inserted into your drive, it's just a simple file (open one in Notepad) which points to an .exe file.

[ZaB]

Namely Vista and Windows 7 and servers 2003 2008 2008R2 are completely immune to autorun files on writable removable media unless your 10 years or older group policy overrides the setting.