Backdoor in Baidu Android SDK Puts 100 Million Devices at Risk

The China's Google-like Search Engine Baidu is offering a software development kit (SDK) that contains functionality that can be abused to give backdoor-like access to a user's device, potentially exposing around 100 Million Android users to malicious hackers.

The SDK in question is Moplus, which may not be directly available to the public but has already made its way into more than 14,000 Android apps, of which around 4,000 are actually created by Baidu.

Overall, more than 100 Million Android users, who have downloaded these apps on their smartphones, are in danger.

Security researchers from Trend Micro have discovered a vulnerability in the Moplus SDK, called Wormhole, that allows attackers to launch an unsecured and unauthenticated HTTP server connection on affected devices, which works silently in the background, without the user's knowledge.

This unsecured server does not use authentication and can accept requests from anyone on the Internet. Though the server is controlled by the attacker, who can send requests to a particular port of this hidden HTTP server to execute malicious commands.

Malicious Functionalities of Wormhole
Currently, the researchers have identified that the SDK is using the port 6259 or 40310 to perform malicious activities on affected Android devices, which includes:

•     Send SMS messages
•     Make phone calls
•     Get mobile phone details
•     Add new contacts
•     Get a list of local apps
•     Download files on the device
•     Upload files from the device
•     Silently install other apps (if the phone is rooted)
•     Push Web pages
•     Get phone's geo-location, and many more

Since the SDK automatically installs the Web server when a Moplus SDK app is opened, hackers just need to scan a mobile network for port 6259 or 40310, thereby finding vulnerable devices they can abuse.

Wormhole is More Dangerous than Stagefright 
The vulnerability, according to researchers, is potentially easier to exploit than the Stagefright flaw, as Wormhole doesn't require social engineering to infect an unsuspecting user.

Trend Micro has also found at least one malware strain (detected as ANDROIDOS_WORMHOLE.HRXA) in the wild that takes advantage of Wormhole in Moplus SDK.

Researchers informed both Baidu as well as Google of the vulnerability.

As a result, Baidu has just pushed a partial fix for the problem by releasing a new version of the SDK that removed some of the SDK's functionality, but not all. The HTTP server remains online and active; however, Baidu assured its users that no backdoor exists now.

This isn't the first time a Chinese company has caught distributing malicious SDK. Just a few days ago, the Taomike SDK – one of the biggest mobile ad solutions in China – was caught secretly spying on users' SMS messages and uploading them to a server in China.

The same malicious functionality was also discovered two weeks back in another SDK developed by Youmi; that affected 256 iOS apps, which were caught using private APIs to collect users private data. However, Apple eventually banned those apps from its App Store.

YiSpecter threat shows iOS is now firmly on attackers’ agenda

YiSpecter Trojan abuses Apple’s iOS enterprise provisioning and private APIs to earn ad revenue. Avoid it by not installing apps from untrusted sources.

Until recently, iOS device users have had a relatively quiet ride on their mobile computing journey, particularly compared to their Android-owning counterparts. Apart from the odd threat popping up here and there, there’s not much to speak of in terms of major malware issues for iOS. But this status quo is starting to change.

This year, Symantec has seen an uptick in threats hitting the iOS platform. YiSpecter (IOS.Specter) is the latest piece of malware that continues the trend of increasing attacks against iOS devices. The malware is designed to target Chinese speakers and has affected East Asia, particularly China and Taiwan. We understand that the threat is being distributed through alternative app stores, hijacked internet service provider (ISP) traffic redirecting users to download YiSpecter, forum posts, and social media.

YiSpecter is a Trojan horse for both jailbroken and non-jailbroken iOS devices which is designed to perform a range of functions, but essentially provides the basis for a back door onto the compromised device and installs adware. The Trojan can allow an attacker to perform a range of functions such as uninstalling existing apps, downloading and installing new fraudulent apps, displaying advertising in other apps that are installed on the device, and much more.

Abusing enterprise certificates to target non-jailbroken devices
YiSpecter is an iOS threat that takes advantage of the enterprise app provisioning framework. In legitimate uses of the framework, businesses can avail of enterprise certificates to provide private apps to their own workforce without making them publicly available on the official App Store. Apps built and signed with the certificates do not need to be vetted by Apple before being distributed outside of the App Store. This gives the certificate owner more scope to develop apps with features that would otherwise be rejected by Apple.

The malware creator used iOS enterprise certificates to package and sign their threat. They could have gained access to the certs in a few ways:

• Registering with Apple as an enterprise, paying the necessary fees, and going through the vetting procedure
• Stealing the cert from an existing registered developer
• Partnering with a registered developer

Once YiSpecter’s creators have the enterprise certificate, they are in a position to create and distribute their apps to potentially any iOS device without further oversight from Apple. It should be noted that if Apple learns of the misuse of an enterprise certificate, the company could instantly revoke the cert and render the signed apps useless.

A common feature of enterprise-signed apps is that they can generally only be installed after the user accepts the request to trust the app or developer. From past experience, Symantec knows that asking the user whether they trust an app or developer is rarely an effective security measure but this is still a line of defense that needs to be crossed before the malware can be installed.

Invoking private APIs
YiSpecter can carry out a lot of advanced functionality because it uses Apple’s own private APIs to perform activities that standard iOS apps can’t. These APIs are designed to allow Apple’s apps to carry out a range of system-level actions. iOS developers are not supposed to use these APIs in their apps.

Any third-party apps that use these private APIs are rejected from inclusion on the Apple App Store. YiSpecter ignores the official App Store, instead relying on unofficial distribution channels to spread the malware. As a result, the threat can take advantage of the private APIs for its own purposes.

Potential copycats
The idea of invoking the private APIs in iOS is not a new idea, but it was not something that we had seen before in iOS malware. Similarly, the abuse of enterprise provisioning is a well-known problem dating back a number of years.

What YiSpecter has demonstrated is that when these two techniques are combined, the potential for misuse is high. Now that the combination of these techniques have been proven, we may yet see copycat threats in future.

Mitigation
iOS device owners are advised not to download and install apps from untrusted sources. Instead, they should only download apps from the official App Store or from their company’s own approved app library.

We would also recommend that iOS users should avoid jailbreaking their devices. This practice violates the terms of the iOS license agreement and puts the device at an increased risk of attack.

Users should ensure that the device’s operating system and software are up to date with latest patches.

Symantec has listed top tips on how to better secure your iOS device from attacks.

What you need to know about Stagefright 2.0

Additional issues have been found surrounding audio files and libstagefright, but Google's already
got a fix underway.

The past couple of months have been filled with a lot of uncertainty surrounding a series of issues popularly named Stagefright, a name earned because most of the issues found have to do with libstagefright in Android. The security firm Zimperium has published what they are calling Stagefright 2.0, with two new issues surrounding mp3 and mp4 files that could be manipulated to execute malicious code on your phone.

Here's what we know so far, and how to keep yourself safe.

What is Stagefright 2.0?
According to Zimperium, a pair of recently discovered vulnerabilities make it possible for an attacker to present an Android phone or tablet with a file that looks like an MP3 or MP4, so when the metadata for that file is previewed by the OS that file could execute malicious code. In the event of a Man in the Middle attack or a website built specifically for delivering these malformed files, this code could be executed without the user ever knowing.

Zimperium claims to have confirmed remote execution, and brought this to Google's attention on August 15. In response, Google assigned CVE-2015-3876 and CVE-2015-6602 to the pair of reported issues and started working on a fix.
Is my phone or tablet affected?

In one way or another, yes. CVE-2015-6602 refers to a vulnerability in libutils, and as Zimperium points out in their post announcing the discovery of this vulnerability it impacts every Android phone and tablet going back as far as Android 1.0. CVE-2015-3876 affects every Android 5.0 and higher phone or tablet, and could theoretically be delivered via website or man in the middle attack.

HOWEVER.

There are currently no public examples of this vulnerability ever having been used to exploit anything outside of lab conditions, and Zimperium is not planning to share the proof-of-concept exploit they used to demonstrate this issue to Google. While it's possible someone else could figure this exploit out before Google issues a patch, with the details behind this exploit still being kept private it's unlikely.

What is Google doing about this?
According to a statement from Google, the October Security Update addresses both of these vulnerabilities. These patches will be made in AOSP and will roll out to Nexus users starting October 5th. Eagle eyed readers might have noticed the Nexus 5X and Nexus 6P we looked at recently already had the October 5th update installed, so if you pre-ordered one of those phones your hardware will arrive patched against these vulnerabilities. Additional information on the patch will be in the Android Security Google Group on October 5th.

As for non-Nexus phones, Google provided the October Security Update to partners on September 10th, and has been working with OEMs and carriers to deliver the update as soon as possible. If you take a look at the list of devices patched in the last Stagefright exploit, you've got a reasonable picture of what hardware is being considered a priority in this process.
How do I stay safe until the patch arrives for my phone or tablet?

In the event that someone really is running around with a Stagefright 2.0 exploit and trying to infect Android users, which again is highly unlikely due to the lack of public details, the key to staying safe has everything to do with paying attention to where you're browsing and what you are connected to.

Avoid public networks when you can, rely on two-factor authentication whenever possible, and stay as far away from shady websites as you possibly can. Mostly, common sense web stuff for keeping yourself safe.

Is this the end of the world?
Not even a little bit. While all of the Stagefright vulnerabilities are indeed serious and need to be treated as such, communication between Zimperium and Google to ensure these issues are addressed as quickly as possible has been fantastic. Zimperium has rightly called attention to problems with Android, and Google has stepped in to fix. In a perfect world these vulnerabilities wouldn't exist, but they do and are being addressed quickly. Can't ask for much more than that, given the situation we're in.

Credits: www.androidcentral.com/what-you-need-know-about-stagefright-20

Stagefright 2.0: A billion Android devices could be compromised

Most Android users are, once again, in danger of having their devices compromised by simply previewing specially crafted MP3 or MP4 files.

Zimperium researchers, who were the ones who discovered easily exploitable remote code execution flaws in the Stagefright media library earlier this year, are also behind this latest discovery, which the dubbed Stagefright 2.0.

"The first vulnerability (in libutils) impacts almost every Android device since version 1.0 released in 2008. We found methods to trigger that vulnerability in devices running version 5.0 and up using the second vulnerability (in libstagefright)," they explained in a blog post.

"Google assigned CVE-2015-6602 to vulnerability in libutils. We plan to share CVE information for the second vulnerability as soon as it is available."

It is estimated that currently around one billion of Android devices is affected by the flaw in libutils, but the libstagefright bug is present on around 20 percent of them.

The Stagefright media library is used by Android to process a number of popular media formats.

The vulnerabilities can't be triggered via MMS (as before), but can be via browser or a third-party app that uses the vulnerable library.

Google has, naturally, been notified of the problem, and they are already working on a patch. In the meantime, Zimperium researchers won't be releasing PoC code to the public for the foreseeable future, but they will share it with Zimperium Handset Alliance partners.

All this aside, the researchers are sure that this is not the end of vulnerabilities affecting this particular library. "As more and more researchers have explored various vulnerabilities that exist within the Stagefright library and associated libraries, we expect to see more vulnerabilities in the same area," they noted.

Zimperium customers are protected against attacks exploiting these newly revealed flaws, but the company has promised to update their Stagefright Detector app to detect this vulnerability as soon as Google comes up with a patch (it's scheduled for release next week).

Let's hope that some mobile device manufacturers keep their promises when it comes to shipping patches more quickly and on a regular basis

AT&T says malware secretly unlocked hundreds of thousands of phoneshttp://core0.staticworld.net/images/article/2015/09/20150918-att-logo-100615497-primary.idge.jpg

AT&T said three of its employees secretly installed software on its network so a cellphone unlocking service could surreptitiously funnel hundreds of thousands of requests to its servers to remove software locks on phones.

The locks prevent phones from being used on competing networks and have been an important tool used by cellular carriers to prevent customers from jumping ship. They can be electronically removed, usually after fulfilling a contract obligation, but many websites offer the same service for a small fee with no questions asked.

AT&T's allegations are made in a filing with U.S. District Court for the Western District of Washington in which it accuses two companies, four people and an unknown software developer or developers, of participating in the audacious scheme. AT&T filed its lawsuit on Sept. 11 but it was first reported by Geekwire on Friday.

The carrier first discovered something was amiss in September 2013 when a surge in the number of unlock requests alerted the company to the possible abuse of "Torch," the software used to unlock cellphones, it said in the complaint.

Upon investigation, the company discovered that the logins and passwords of two employees at a center in Washington were responsible for a large number of the requests and those requests happened within milliseconds of each other.

Both employees, Kyra Evans and Marc Sapatin, are named in the lawsuit.

On the computers of Evans and Sapatin, investigators found unauthorized software intended to route unlocking requests from an external source through AT&T's computer system, it said. AT&T says its investigators uncovered numerous iterations of the software, which grew in complexity until it was eventually able to submit the automatic requests.

Investigators later found the software on a computer of a third employee, Nguyen Lam, according to AT&T. All three are no longer working at AT&T.

AT&T says a California-based company called Swift Unlocks and its proprietor, Prashant Vira, were involved in the scheme and paid Evans and Sapatin at least US$20,000 and $10,500 respectively to install the software. But, AT&T concedes that it doesn't know the full extent of Swift Unlocks' involvement.

Swift Unlocks operates a website where people can pay to have the software lock removed from their phones. Charges vary by phone but AT&T users will generally pay $20 or less for the unlocking service.

In all, AT&T says "hundreds of thousands" of phones were unlocked as a result of the scheme. Its charges include computer fraud, breach of loyalty and civil conspiracy and the carrier has asked the court to hear the case in front of a jury.

The defendants could not immediately be reached for comment and are yet to file a reply to the allegations with the court.

Apple’s iOS App Store suffers first major attack

Apple Inc said on Sunday it is cleaning up its iOS App Store to remove malicious iPhone and iPad programs identified in the first large-scale attack on the popular mobile software outlet.

The company disclosed the effort after several cyber security firms reported finding a malicious program dubbed XcodeGhost that was embedded in hundreds of legitimate apps.

It is the first reported case of large numbers of malicious software programs making their way past Apple’s stringent app review process. Prior to this attack, a total of just five malicious apps had ever been found in the App Store, according to cyber security firm Palo Alto Networks Inc.

The hackers embedded the malicious code in these apps by convincing developers of legitimate software to use a tainted, counterfeit version of Apple’s software for creating iOS and Mac apps, which is known as Xcode, Apple said.

“We’ve removed the apps from the App Store that we know have been created with this counterfeit software,” Apple spokeswoman Christine Monaghan said in an email. “We are working with the developers to make sure they’re using the proper version of Xcode to rebuild their apps.”

She did not say what steps iPhone and iPad users could take to determine whether their devices were infected.

Palo Alto Networks Director of Threat Intelligence Ryan Olson said the malware had limited functionality and his firm had uncovered no examples of data theft or other harm as a result of the attack.

Still, he said it was “a pretty big deal” because it showed that the App Store could be compromised if hackers infected machines of software developers writing legitimate apps. Other attackers may copy that approach, which is hard to defend against, he said.

“Developers are now a huge target,” he said.

Researchers said infected apps included Tencent Holdings Ltd’s popular mobile chat app WeChat, car-hailing app Didi Kuaidi and a music app from Internet portal NetEase Inc.

The tainted version of Xcode was downloaded from a server in China that developers may have used because it allowed for faster downloads than using Apple’s U.S. servers, Olson said.

Chinese security firm Qihoo360 Technology Co. said on its blog that it had uncovered 344 apps tainted with XcodeGhost.

Apple declined to say how many apps it had uncovered.

AirDrop vulnerability is an easy avenue for hackers to exploit Apple devices

Recently, an alarming vulnerability has cropped up on iOS devices. This security loophole allows an attacker to overwrite arbitrary files on a targeted device and, when used in combination with other procedures, install a signed app that devices will trust without presenting a warning notification to users.

In a recent article published on Threatpost, it’s noted that the vulnerability is located in a library that lies within both iOS and OS X. In this case, the library in question is AirDrop, the tool featured on Apple devices that allows users to directly send files to fellow Apple device quickly and effortlessly.

The problem lies within the fact that Airdrop doesn’t use a sandboxing mechanism in the same way that many other iOS applications do. When making use of a sandbox, every application has its own container for files that it can’t get beyond the so-called “walls“ of.

AirDrop gives users to the choice to accept file transfers either from only their own contacts or anyone who sends them a request to send files. In the case that a user can receive files from anyone, it’s quite easy for an attacker to exploit their device on their locked iOS device.What’s more, the attacker can even make the attack without the user agreeing to accept a file transferred using AirDrop.

Directory traversal attacks make the exploitation of this vulnerability possibleMark Dowd, the security researcher who discovered the vulnerability, has been able to repeatedly and reliably exploit the security flaw. The vulnerability allows the attacker to execute a directory traversal attack, in which the attacker attempts to access files that are not intended to be accessed. Thus, the attackers are capable of writing files to any location they choose on the file system.

Since sandboxing rules weren’t being strictly enforced on AirDrop, Dowd was able to read/write hidden system resources in combination with his own directory traversal attack. In doing so, he was able to upload his own application into the system and make it appear as trusted.

This bug has been reported to Apple, but a full patch has not yet been released for the recently-launched iOS 9. Therefore, if you’re the owner of one or more Apple devices, make sure that your AirDrop sharing options are set to private and that you’re only able to receive files from your contact list.

Apple passcode increased to 6-digits in new iOS release

Apple rolled out its new iOS 9 operating system Wednesday and with that comes a big security upgrade.

The new operating system will now automatically default to a six digit PIN to unlock your device, instead of just a four digit PIN. While this might seem like a small change, it actually makes breaking into your iPhone a lot more difficult.

With a four digit PIN, there are a possible 10,000 combinations. But with a six digit code, there are 1 million possible combos, making it a lot tougher for someone to crack your security code.

If you are currently using a four digit PIN and update your software, you will need to manually opt in for the six digit PIN.

You can do this in your settings under "Passcode." But if you are just enabling the feature it will automatically prompt you to use six numbers for your PIN.

While the six number passcode is not mandatory, it is highly recommended. If you would rather take your chances, though, and go with a four digit code, you can make that selection in your settings as well.

The tech giant is also rolling out built-in two-factor authentication as part of iOS 9. Once you enroll for the security feature, you will be prompted to enter a verification code each time you log into a new device or browser. The code will appear on your other Apple device or your phone.

Experts bust Android security myths

Thanks to its inherent "openness," the open source Android OS is vulnerable to a variety of security risks, but how often do people you know actually fall victim to Android malware or other attacks?

Is the Android security risk overstated? Is the Android risk really greater than the risks posed by its iOS and Windows Mobile counterparts? And what can users, and the enterprise IT departments that support them, do to better protect their Android devices?

We asked these questions, and more, to a variety of mobile security experts from companies including Cisco, Dell and Lookout. Here's what they had to say:

Android security threat is real 
Android malware that affected U.S. users increased by 75 percent from 2013 to 2014, according to security firm Lookout's "2014 Mobile Threat Report."

"That's a significant jump, predominantly driven by an increase in ransomware, a nasty form of malware that locks a person's device and demands money in exchange for reinstated access," says Michael Bentley, Lookout's senior manager of security research and response.

Android devices were the targets of 97 percent of all mobile malware in 2014, according to Pulse Secure's "2015 Mobile Threat Report." And the Android security risk level "increased substantially year-over-year," says Troy Vennon, director of Pulse Secure's Mobile Threat Center. In 2012, there were 238 specific Android malware threat "families," and that number jumped to 804 in 2013 and 1,268 in 2014, according to Vennon.

At least 15 million mobile devices were infected with malware in September 2014, according to a report from Alcatel-Lucent's Kindsight Security Labs. Of those devices, 60 percent were Android smartphones and about 40 percent were Windows PCs that connected to the Web via mobile networks. Windows Mobile, iOS, BlackBerry and Symbian devices represented less than 1 percent of mobile malware infestations.

Symantec's 2015 "Internet Security Threat Report" says 17 percent of all Android apps (nearly a million) are malware in disguise. In comparison, Symantec uncovered approximately 700,000 Android malware apps in 2013.

Android more vulnerable than iOS, Windows Mobile
Android is more vulnerable than iOS because of its OS fragmentation, according to Geoff Sanders, cofounder and CEO of LaunchKey.

"Even when Google releases a security patch, it's ultimately up to the [device] manufacturer to provide this patch to end users," Sanders says. "This puts many more users at risk as their devices age."

The overall risk level for Android is also higher because it's the most popular mobile OS, according to Bojan Simic, CTO of HYPR Corp.

Apple deploys iOS only on its own devices, so the company has "far better control and knowledge of risk," Simic says. Apple's app verification system is also significantly more rigorous than Google's process in the Play store, and it results in less malware, according to Simic.

Windows Mobile users are safer due to the rule of "security by obscurity," Simic says. "Most hackers will direct their efforts where the biggest payoff is, and right now that target is Android due to its sheer amount of users.

Android security threat is real but 'overblown'
The mobile security threat exists, but it is "overblown," according to new research from Damballa. For its spring 2015 report, the company monitored about 50 percent of U.S. mobile traffic (including but not limited to Android). Damballa concluded that mobile users are 1.3 times more likely to be struck by lightning than to have their mobile devices compromised by malware.

"This research shows that mobile malware in the Unites States is very much like Ebola -- harmful, but greatly over exaggerated, and contained to a limited percentage of the population that is engaging in behavior that puts them at risk for infection," said Charles Lever, a Damballa senior scientific researcher, in a press release on the company's website.

Mark Hammond, senior manager for Cisco Security Solutions, agrees the Android threat has been greatly exaggerated. "The threat of Android malware is also directly associated with the source. If the average user is sticking with a well-regulated app store, like Google Play, then the risk of malware diminishes significantly."

The mobile malware threat is "really minimal," according to John Gunn, vice president of VASCO Data Security. While many people have some sort of malware on their computers, "few know anyone who has had malware on their mobile device," he says.

Verizon's 2015 "Data Breach Investigations Report" also concluded that "mobile threats are overblown," and "the overall number of exploited security vulnerabilities across all mobile platforms is negligible."

The risk of malware making its way into a native Android app is lower than ever thanks to Google's automated scanning and other new security improvements, according to Terry May, an Android developer with Detroit Labs. Google "reinforced the Android sandbox with SELinux and enhancements to the Google Play services library that can scan for vulnerabilities on the local device and not just the apps in the store," May says. "This means that even apps that have been side-loaded can be scanned."

Less than 1 percent of Android devices had a potentially harmful app (PHA) installed in 2014, and the number of PHAs on Android devices dropped by 50 percent between the first and fourth quarters of last year, according to a Google Online Security Blog post published by Android security lead engineer Adrian Ludwig in April 2015. Less than 0.15 percent of devices that only installed apps from Google Play had a PHA installed last year, Ludwig wrote.

The bottom line is that malware attacks "are increasing because users are spending more time on mobile devices than ever before, the value of the data on mobile keeps increasing, and a single OS (Android) dominates the market, increasing the footprint for attackers," says Domingo Guerra, president and cofounder of Appthority.

However, mobile malware isn't necessarily more prevalent. "Although the number of mobile malware apps is definitely booming, so is the number of good and benign apps," Guerra says
- See more at: http://www.channelworld.in/features/experts-bust-android-security-myths#sthash.D3A1r4ZO.dpuf

New threats for Android phones, how do they work? Beware of your battery!

When buying a smartphone one of the first things we do is choosing an unlock pattern, trusting that by doing this our WhatsApp conversations will be protected from our nosy surroundings. If you are one of those who think that just one finger is able of drawing a complicated route on the screen, you are mistaken! Hacking an Android’s phone lock is easier than what you thought!

Digital thieves can reach even more. Not only can they get physically inside your phone, but they can also do it virtually or, using the phone’s microphone. Now they can even spy on you when the phone is turning off.

Those who trust that clicking on their smartphones “off” switch is enough to stop their contact with the outside world are in trouble. Virtual spies are able to remotely pull the strings, even so when the owner and his phone were sleeping. Security researchers have demonstrated how a Trojan for Android phones can make the users believe that they have turned it off as they usually do.

PowerOffHijack, the new malware, succeeds a very particular task: Hijacks the users’ shutdown process. When pressing the on/off button a fake dialog box appears making the users believe that their phone is turning off. Meanwhile, the malware is manipulating the operating system “system server” file.

The owner rests peacefully, even though the device is not at ease: the Trojan can make outgoing calls (even to foreigner numbers), make pictures and many other things without notifying the user. In China there have been more than 10.000 devices infected by this malware; it seems it expands via some apps.

In order to avoid this mocking Trojan we recommend you to pull out your battery so it doesn’t raise your phone bill to unsuspected limits. As much as the spies try, they are still not capable of controlling the phones without lithium. Another tip is to uninstall the apps that may have caused these silent thieves entry.

Although taking the battery off and putting it back on can resolve the Power Off Hijack issue, some hackers are using the battery’s internal information to spy mobile phones. Researchers of Stanford University together with a group of Israelis experts have developed Power Spy, a new technology that gathers the Android phone’s geolocation, even when the GPS is turned off. How? Tracking the phone’s power consumption over time.

WiFi and GPS connections need the user’s permission in order to work, but the battery consumption data doesn’t. So the cyber criminals can track your phone with 90% accuracy, later using this location information as they please, being able to locating you at all times.

The researchers have proven Power Spy’s capacities in two Nexus phones. This program enabled them to locate the phone even if its owner wasn’t using it at the moment. Power Spy would access your phone without you knowing it. The issue is that you might be downloading it together with any app without noticing it.

“We show that measuring the phone’s aggregate power consumption over time completely reveals the phone’s location and movement”, says Yan Michalevsky, one of the researchers.

Fortunately this technology has its limitations: in order to work it needs predefined routes and to have already traveled along the route before. “If you take the same ride a couple of times, you’ll see a very clear signal profile and power profile,” says Michalevsky.  In addition the tracking accuracy increases if the phone has just  a few apps rather than in the ones with more, where power is used unpredictably.

Anyone can start spying on your phone in ways you would have never suspected. Security is not only needed in your desktop computer, it is essential in the tiniest corners of your phone.

Android flaw puts personal data at risk for millions

Nearly half of Android devices are vulnerable to an attack that could replace a legitimate app with malicious software that can collect sensitive data from a phone.

Google, Samsung and Amazon have released patches for their devices, but 49.5 percent of Android users are still vulnerable, according to Palo Alto Networks, which discovered the problem. Google said it has not detected attempts to exploit the flaw.

A malicious application installed using the vulnerability, called "Android Installer Hijacking," would have full access to a device, including data such as usernames and passwords, wrote Zhi Xu, a senior staff engineer with Palo Alto.

The company wrote two exploits that take advantage of the flaw, which involves how APKs (Android application packages) are installed.

The vulnerability only affects applications that are installed from a third-party app store. Security experts generally recommend using caution when downloading apps from those sources.

Apps downloaded from third parties place their APK installation files in a device's unprotected local storage, such as an SD card, Xu wrote. From there, a system application called PackageInstaller finishes the installation. The flaw allows an APK file to be modified or replaced during installation without anyone knowing.

An attack would work like this: A user downloads what appears to be a legitimate application. The application asks for certain permissions on the device. During that process, Palo Alto found it was possible to swap or modify the APK file in the background because the PackageInstaller fails to verify it, Xu wrote.

After clicking the install button, "the PackageInstaller can actually install a different app with an entirely different set of permissions," he wrote.

Android devices do not need to be rooted for the attack to work, although rooting does make devices more vulnerable.

When the flaw was discovered, in January 2014, close to 90 percent of all Android devices were affected. That has since dropped to 49.5 percent, but many devices have not been patched.

Palo Alto's exploits were successful against Android versions 2.3, 4.0.3 to 4.0.4, 4.1.x, and 4.2.x. The 4.4 version of Android fixes the issue. Some Android 4.3 devices may still be affected, however, since some manufacturers have not patched yet, Xu wrote.

Google has published a patch here, and Amazon recommends downloading the latest version of the Amazon AppStore, which will update its Fire devices, Xu wrote.

Palo Alto has also developed an Android app that will detect if a device is still vulnerable.

Yahoo! Releases On-Demand Passwords

Yahoo! Is taking a new tack in authentication with the implementation of on-demand passwords, which are texted to a mobile phone when a user needs them.

Yahoo! subscribers in the US can opt into the scheme via their security settings page in the account information section.  Once a mobile phone is added to the account, a one-time password will be sent every time a login is required.

It’s sort of like two-factor authentication—without the first factor involved.

“We’ve all been there…you’re logging into your email and you panic because you’ve forgotten your password,” said Chris Stoner, Yahoo! director of product management, in a blog. “After racking your brain for what feels like hours, it finally comes to you. Phew! Today, we’re hoping to make that process less anxiety-inducing…You no longer have to memorize a difficult password to sign in to your account—what a relief!”

But not everyone agrees that the method boosts safety. Tim Erlin, director of product management and a security and IT risk strategist for Tripwire, pointed out that the method simply directs hackers’ efforts to intercepting text messages.

“While Yahoo is lifting the burden of remembering a password, they are maintaining a single target for compromise: your SMS messages,” he noted in an email. “Malware on your phone could be used to grab those SMS messages, and then have full access to your account. On-demand passwords are also mutually exclusive with Yahoo’s two-step verification, so enabling them forces users to effectively downgrade security on their account.”

TK Keanini, CTO of Lancope, told Infosecurity that he agreed that users will need to pay more attention to mobile security.

“While only leveraging a single factor (something you have—your phone), the security of the system will depend on how secure that device remains over time,” he said. “We will see a major shift by the attacker to target malware on these mobile platforms because of their larger role in the overall security of the individual. It is also important these days to ensure that the mobile account is secure because you don't want attackers changing features like call forwarding and other features that can put them in the middle of this communication stream.”

Nonetheless, he applauded Yahoo! for thinking creatively.

“We need more innovation like this with authentication,” he said. “Passwords are just pieces of information and in all these strategies, we want to make it useful for the shortest amount of time but not be an administrative burden. Yahoo! knows that the most personal device on a person these days is their mobile phone. And let’s not stop here, let’s keep innovating even more techniques to raise the cost to our attackers.”

Malicious Android App Fakes Shutdown and Allows Bad Guys to Take Control

Is this thing on?

Unless you have your Android device in one hand and its batteries in another, you might not be sure if it's turned off. An Android Trojan app called PowerOffHijack, which originated from Chinese app stores, was found tricking users into believing that their devices were turned off though they're actually powered on.

Digging into the issue, Trend Micro researchers found that an app believed to be an earlier version of PowerOffHijack appeared as early as September 2014. The app named AndroidFramework (detected AndroidOS_AndFraspy.HAT) disguised itself as a Google service with the package name com.google.progress.

Fake Shutdown Routines
As mobile device users are aware, pressing the power button can result in two things. Tapping the button will turn off the screen, while holding it down will cause it to prompt with device options that include shutting the phone down.

The AndroidFrameworkmalware was designed to perform its malicious operations in the background after you press the power button and the screen goes black.

On the one hand, the PowerOffHijack version was made to run in the background even after you hold the power button down and chose to turn the device off. It will even display the Android shutdown animation to make you believe that your device is shutting down. At this stage, the malware can still make phone calls, send SMS, take photos, and do other malicious routines without user consent.

Both these malware apps were found in third party app stores outside of Google Play and require a rooted device to run.

The PowerOffHijack reportedly works on devices running on Android operating systems that are older than version 5.0, Lollipop. It is said to have originated from third-party Chinese app stores, which explains why most of the 10,000 affected devices are from China.

How to Get Rid of AndroidFramework and PowerOffHijack 
It was previously suggested that users can only be truly safe from the PowerOffHijack threat if they remove the batteries of their devices. However, this is not practical for many users who do need to use the devices as well as for devices with batteries that can't be easily removed.

Blackphone 2 Is Probably the World's Most Secure Smartphone

"While the rest of the market is going one way, with selfie sticks and curved screens, we're going down another, to the heart of problems, sticking with privacy and security," said Silent Circle's Mike Janke at the launch of the company's new secure smartphone, the Blackphone 2. And he's not kidding — though no frills in design, it's kitted out with some serious security features.

First, the hardware. A 5-inch handset with a Full HD screen (protected on the outside by Gorilla Glass 3), it's running on a 64-bit Qualcomm octa-core processor, backed by 3GB of RAM. A removable 3060mAh battery sits inside (with Quick Charge 2.0 features), with microSDXC support for expandable memory. So far, so standard.

It's on the software side where things get a bit more interesting, and that 3GB of RAM shows its worth. Though Running on Android, the phone is equipped with Silent Circle's PrivateOS 1.1, an enterprise-orientated, highly secure layer that sits on top of Google's OS.

This gives users a "Spaces" UI, which keeps the different areas of your mobile life encrypted and compartmentalised. It's essentially a virtualisation system, letting the Blackphone 2 act as separate "devices" within itself, even offering different log-ins running concurrently on each app or service. So, you can set up an Enterprise Space for your work documents and communications, a Personal Space for your private emails and saucy sexting pics, and a Silent Space that's pretty much a phone-wide version of Chrome's "Incognito Mode".

Each space can be filled with the "Silent Suite" apps, whose functions are pretty self explanatory; Silent Text, Silent Contacts and Silent Phone, each keeping your communications encrypted and isolated from each other. The phone will also come equipped with the Silent Store, the world's first-privacy and security orientated app store.

Those looking to use the phone for conference calling will benefit also from the new Silent Meeting function. This lets you set up secure conference calls with as many as 50 participants, offering scheduling and invitation tools too. Providing all users are using the Silent Meeting feature, there's no need for annoying log-in passwords, with the encryption and security being handled behind the scenes.

"We're replacing BlackBerry, we don't care that BlackBerry's CEO is throwing nasty things about us onto Twitter. We're going to dominate them," said Silent Circle security specialist (and former Navy Seal) Mike Janke at today's launch. While that's not a massive claim to make with BlackBerry on the backfoot, if the Blackphone 2 can live up to its secure claims, it'll certainly fill a hole left by BlackBerry's disappointing touchscreen smartphones.

Due out in the summer, the Blackphone 2 is expected to retail at $629 usd.

16 Million Mobile Devices Infected With Malware in 2014

A new report published by Alcatel-Lucent’s Motive Security Labs estimates that 16 million mobile devices were infected with malware in 2014.

The rate of mobile infections in 2014 was 0.68%, which represents a 25% increase compared to the previous year. According to the telecoms company, 16 million is a conservative estimate considering that its sensors don’t have complete coverage in regions like China and Russia.

“In mobile networks, Android devices have now caught up to Windows laptops as the primary workhorse of cybercrime. With one billion Android devices shipped in 2014, the platform is a favorite target of cybercriminals who can have lots of infection success without a lot of work,” Kevin McNamee, director of Alcatel-Lucent Motive Security Labs, wrote in a blog post. “Android is more exposed than rivals because of its open platform and by allowing users to download apps from third-party stores where apps are not always well vetted.”

The number of Android malware samples in Motive Security Labs’ database increased by 161% last year, reaching close to 1.2 million.

The company has pointed out that the sophistication of Android malware has also increased. Older variants used primitive command and control (C&C) mechanisms, they had hard-coded and inflexible configurations, and they were easy to detect. However, in 2014, malware authors started leveraging more advanced techniques and even integrated rootkit technologies, a trend demonstrated by threats such as NotCompatible and Koler.

According to the report, six of the top 20 mobile pieces of malware are from the spyware category. These types of threats are designed to track users’ location, calls, text messages, emails, and Web browsing.

As far as residential fixed broadband networks are concerned, infection rates increased last year, but mainly due to adware. High-level threat infections (bots, rootkits, banking Trojans) increased slightly in the second quarter of 2014, but then they dropped again to roughly 5%, the report shows.

Researchers have also pointed out that many consumers avoid shopping online to prevent their credit card information from being stolen by cybercriminals. However, the risks are even greater at brick-and-mortar stores where cash registers and point-of-sale (PoS) terminals can become infected with malware.

“Card information stolen from online retailers can only be used for online purchases. Online purchases typically need to be shipped to the address of the card owner, making them less usable to fraudsters,” reads the report. “Because the point-of-sale-based malware records all the information in the magnetic strip on the card, the data they collect can be used to make new physical cards. Criminals use these forged cards in stores to buy expensive items such as electronics, which can easily be sold for cash.”

Espionage app targets iOS devices

Trend Micro has discovered an interesting poisoned pawn - spyware specifically designed for espionage on iOS devices. While spyware targeting Apple users is highly notable by itself, this particular spyware is also involved in a targeted attack.

The iOS malware found is among those advanced malware and it is believed the iOS malware gets installed on already compromised systems, and it is very similar to next stage SEDNIT malware Trend Micro found for Microsoft Windows’ systems. Two malicious iOS applications were found in Operation Pawn Storm. One is called XAgent and the other one uses the name of a legitimate iOS game, MadCap. XAgent is designed to work specifically with iOS7, which is still in one of every 5 iPhones and iPads. Fortunately, for iOS 8 devices, the user will see multiple notifications that the phone is trying to install an app. And it can’t run without the user launching. Both tools have the ability to record audio, which is very intrusive, and highly suggests the targeting of offline and confidential information.

Following analysis, Trend Micro concluded that both are applications related to SEDNIT – which is a spyware that aims to steal personal data, record audio, make screenshots, and send them to a remote command-and-control (C&C) server. Some of the data theft capabilities include:

• Collect text messages
• Get contact lists
• Get pictures
• Collect geo-location data
• Start voice recording
• Get a list of installed apps
• Get a list of processes
• Obtain Wi-Fi status

There may also be other methods of infection that are used to install this particular malware. One possible scenario is infecting an iPhone after connecting it to a compromised or infected Windows laptop via a USB cable.

For a more detailed analysis of the spyware, read here.

Background of Operation Pawn Storm
Operation Pawn Storm is an active economic and political cyber-espionage operation that targets a wide range of entities, like the military, governments, defense industries, and the media.

The actors of Pawn Storm tend to first move a lot of pawns in the hopes they come close to their actual, high profile targets. When they finally successfully infect a high profile target, they might decide to move their next pawn forward: advanced espionage malware.

The iOS malware we found is among those advanced malware. We believe the iOS malware gets installed on already compromised systems, and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems.

Your computer and smartphone, held hostage

Cybercriminals are making their attacks personal, remotely locking your computers and smartphones until you pay a hefty ransom.

Tapping a link on your smartphone to watch a new music video might sound harmless, but it got one 12-year-old girl from Tennessee into trouble last year.

Instead of a video, the preteen -- whose name has not been disclosed because of her age -- had unwittingly installed malicious software that downloaded child pornography, locked her Android phone, and threatened to report the pornography to the FBI if she didn't fork over $500 in ransom. She reported the hacker's extortion demands to Frank Watkins, an investigator with the Coffee County Sheriff's Department.

It's called ransomware, a type of malicious code that leaves its victims feeling personally violated. Some versions destroy your data if you don't pay, while others merely threaten. Some will encrypt your device, scrambling everything it contains until you pay a ransom.

Ransomware can be big business. CryptoLocker, which uses email attachments to infect and encrypt computers, harvested nearly $30 million in about 100 days, according to estimates from Keith Jarvis of Dell's SecureWorks counter-threat division. CryptoLocker's descendant CrytoWall, which has infected more than 1 million computers, continues to mutate and adopt new techniques that make it harder to remove.

While ransomware has been around since 1989, it's gotten worse as criminals target billions of smartphones and tablets used around the world, demanding $100 to $600 (often in bitcoins) to release it.

A mobile threat report from Mobile Lookout Security, which makes security software for smartphones, found 4 million of Lookout's 60 million users were held hostage last year, said Jeremy Linden, senior security product manager for the San Francisco company.

Avast, which says 55 million people use its free mobile security software, reports similar numbers. Last month alone, the company blocked 5,000 ransomware attacks a day -- up from nearly zero only seven months earlier -- according to Jiri Sejtko, director of Avast's virus detection lab.

Having your computer locked out can be traumatic in its own right. Losing access to your smartphone can trigger "abject panic," said Larry Rosen, a psychologist and researcher at California State University, Dominguez Hills, who studies people's reactions to modern technology. "That little box contains everything you ever need on a daily basis. You're carrying around a phone, computer, friends -- your everything in one box," he said.

Small wonder, then, that hackers have trained their attention on mobile extortion. But payer beware. "You could pay a ransom and the malware would still not unlock your phone," said Mobile Lookout's Linden.

So far, mobile ransomware is considered to be easier to avoid than its desktop cousin. Experts have two tips for smartphone owners.

First, install an application that will block ransomware. And second, never download applications from outside the official Google Play store or Apple App Store.

And finally, report the crime to the police.

"Don't hesitate about calling," even if the attack installed child pornography on your phone, said Watkins, of the Coffee County Sheriff's Department. "Contact your local authorities. They'll be able to tell that it's ransomware."

Google Isn’t Fixing Some Old Android Bugs

Google appears to no longer be fixing security flaws in the oldest versions of its smartphone Internet
browser.

The previously undisclosed move could leave some users with older phones exposed to snooping by hackers and spies, security researchers said.

The new policy applies to the default browser in Android version 4.3, released in mid-2013 and known as Jelly Bean, and earlier. That covers roughly two-thirds of the billion-plus Android devices in use, according to Google, but some users may have updated their browsers to newer versions.

The policy does not apply to browsers in Android 4.4, or KitKat, which Google released in October 2013, or Android 5.0, or Lollipop, released in November 2014. Those versions changed how websites are viewed on Android devices.

The security blind spot illustrates the challenges companies face as they try to move customers onto newer products and focus security resources on patching more-current software. Microsoft applied the same reasoning when it stopped supporting Windows XP, first released in 2001, in April.

That makes any new security holes found in the old software dangerous after they become public, since the companies won’t fix them.

The tension is particularly acute at Google, which has spent the past few years championing Internet security. The company has led the way in encrypting email and gives preference in its search rankings to websites that use encryption.

Rafay Baloch, a Pakistani security researcher, discovered Google’s shift a few months ago after he found several bugs in the old Android browser. Researchers like Baloch, sometimes called “white hat hackers,” comb through popular software searching for slipups that could give bad hackers an opening. Tech giants like Google and Facebook FB sometimes pay researchers for their discoveries.

As recently as September, Google had fixed, or patched, one of Baloch’s security flaws in the older browser. But when he submitted another one later in the fall, Google’s security team responded that if the affected Web browser is on Android 4.3 or earlier, “we generally do not develop the patches ourselves but do notify partners of the issue.” Google said it would distribute patches developed by others.

“What Google doesn’t seem to be considering seriously, though, is the cost associated with this move,” Tod Beardsley, a senior engineer at Rapid 7, who has worked with Baloch and Google on the issue. Beardsley reasoned that many consumers buy old phones to save money and not all carriers push through Android updates.

This past fall, Google announced a new project to sell sub-$100 phones in developing markets. Called Android One the push requires phones to ship with Android 4.4 or later and receive automatic updates for up to two years.

_________________________________________

Crash Your Friends' WhatsApp Remotely with Just a Message

A Vulnerability has been discovered in the wildly popular messaging app WhatsApp, which allows anyone to remotely crash WhatsApp just by sending a specially crafted message, two security researchers reported ‘The Hacker News’.

Two India based independent security researchers, Indrajeet Bhuyan and Saurav Kar, both 17-year old teenagers demonstrated the WhatsApp Message Handler vulnerability to one of our security analyst.

In a video demonstration, they showed that by sending a 2000 words (2kb in size) message in special character set can crash the receiver's app. The worried impact of the vulnerability is that the user who received the specially crafted message will have to delete his/her whole conversation and start a fresh chat, because opening the message keeps on crashing WhatsApp unless the chat is deleted completely.

"What makes it more serious is that one needs to delete entire chat with the person they are chatting to in order to get back whatsapp work in normal," Bhuyan told THN in an e-mail.

According to the duo, the reported vulnerability has been tested and successfully works on most of the versions of Android Operating system including Jellybean, Kitkat, and all the below android versions.

Similarly, Any member of your WhatsApp group could intentionally send a specially crafted message to exit people from the group and delete the group. Also, for example, if I don’t want someone to keep records of my chat with them, then I can also send the same message exploit to the person.
The vulnerability has not been tested on iOS, but it is sure that all versions of WhatsApp including 2.11.431 and 2.11.432 are affected with this bug. Also the attack does not work on Windows 8.1.

They have also provided the Proof-of-Concept (PoC) video for the attack, users can watch below.

WhatsApp, bought by Facebook for $19 billion in February this year, has 600 Million users as of October 2014, and according to the researchers, an estimated number of users affected by the vulnerability could be 500 Million.

WhatsApp was in news recently for making end-to-end encryption on all text messages as a default feature in an effort to boost the online privacy and security of its users around the world. The app maker describe this move as the "largest deployment of end-to-end encryption ever."

Android ransomware 'Koler' turns into a worm, spreads via SMS

A malicious Android app that takes over the screen of devices and extorts money from users with fake notifications from law enforcement agencies was recently updated with a component that allows it to spread via text message spam.

Known as Koler, the ransomware Trojan has been on malware researchers' radar since May when it started being distributed through porn websites under the guise of legitimate apps. A new variant of the threat found recently by researchers from security firm AdaptiveMobile spreads through SMS messages that attempt to trick users into opening a shortened bit.ly URL.

Once installed on a device, Koler opens a persistent window that covers the entire screen and displays a fake message from local law enforcement agencies accusing users of viewing and storing child pornography. Victims are asked to pay a "fine" using MoneyPak prepaid cards in order to regain control of their phones.

The Koler ransomware is capable of displaying localized ransomware messages to users from at least 30 countries, including the U.S., where the impersonated law enforcement agency is the FBI.

The new version found by AdaptiveMobile sends a text message to all contacts in the victim's address book. The message reads: "someone made a profile named -[the contact's name]- and he uploaded some of your photos! is that you?" followed by a bit.ly URL or a similiar URL shortened link:

The URL points to an Android application package file called IMG_7821.apk that's hosted on a Dropbox account. When installed, this application uses the name PhotoViewer, but is actually the ransomware program.

Due to the Worm.Koler's SMS distribution mechanism, a rapid spread of infected devices since the 19th of October is observed, which is believed to be the original outbreak date.

During this short period, several hundred phones that exhibit signs of infection have been detected across multiple US carriers. In addition to this, other mobile operators worldwide -- predominantly in the Middle East, have been affected by this malware.

The best protection against ransomware threats like Koler is to have the "unknown sources" option turned off in the Android security settings menu. When this setting is disabled -- and it typically is by default -- users won't be able to install applications that are not obtained from the official Google Play store. Some users do turn this option on though, because there are legitimate applications that are not hosted on Google Play for various reasons.

Koler does not encrypt users’s files, for this reason it is easy for users to eliminate it from infected devices. Below the instructions to remove the malware:

• Reboot the mobile device in the “Safe Mode“
• Remove the malicious ‘PhotoViewer‘ app using standard Android app uninstallation tool

Instructions on how to reboot the device in safe mode should be available in the phone's manual, but it generally involves pressing and holding the power button until the power menu appears, then tapping and holding Power Off until the option to reboot in safe mode appears.

As of 24 Nov, this worm has reached the shores of Singapore, as reported in a popular local forum.