Please Stop Installing Android Flashlight Apps

Security experts often use free flashlight apps when trying to explain some nuance of mobile security because there are so many of these apps out there, and many of them request far, far more of your personal information than necessary to illuminate a dark room. But this week, Malwarebytes pointed us toward a particularly nasty flashlight app that tries to take control of your phone.

Nefarious Flashlight
When the victim goes to install the flashlight app, it requests superuser access. Malwarebytes told us that the app also comes bundled with multiple rooting libraries. The practical upshot is that when it's installed, the app has far more control over your phone than the average app, or even the average user. Unsurprisingly, the app does not include any warnings—in the app or the stores where it's available—that it will be attempting to gain root access on your phone.

Once it's installed (and in control), the flashlight app goes to work and places shortcuts on the infected device's homescreen. According to Malwarebytes, tapping one of these triggers prompts to install other apps onto your phone. Given their origin, it's safe to assume that these aren't apps you'd want on your phone, either.
The nefarious flashlight app also takes steps to hide the presence of its app launcher, making it that much harder for users to simply uninstall it.

What's It Up To?
Generally, we're left to guess at what app authors were thinking when they created their malicious apps. It's almost always part of a money making scheme, but sometimes the monetization angle isn't very clear without inside knowledge. This time is different.

Malwarebytes reports that the flashlight app is part of a "pay-per-install scam." The flashlight app's author has likely partnered with affiliate programs to receive a payment each time one of the apps bundled with the flashlight app are installed on to a victim's phone. It's entirely possible that the affiliate isn't even aware that something untoward is happening.

If this sounds like a familiar scam, that's because it's part of what Lookout targeted with their recent war on adware.

Of course, good malware authors always try to take full advantage of the devices they infect. Why stop at one scam when you already have a toehold in someone else's device? Once the flashlight app is installed and has gained root access, there's little preventing the malware author from repurposing it for some other project. "Flashlight apps are often over-permissioned and filled with aggressive adware," said Malwarebytes security researcher Armando Orozco. "But this one can also root devices, potentially opening the door for other malicious activities."

Today, this app is pushing adware. Tomorrow, it could be using infected phones as part of a botnet or to spew SMS spam.

Staying Safe
Malwarebytes reports that this app appears to target English speakers, and is spread around numerous third party app stores. Links to the malicious app have also been spotted in forum posts and comment sections—which is not an unusual spammy tactic for app peddlers.

Fortunately, this makes avoiding this particular app easy: simply do not install any apps from outside Google Play. True, there are some unique and valuable apps that, for one reason or another, aren't on Google Play. But leave those for the experts. We believe that most users are better off sticking with Google Play for all their Android app needs.

Of course, sometimes Google misses something nasty. And even its automated protection service isn't infallible. To help guard against novel attacks, and the few apps that slip past Google's watchful eye, we recommend that Android users install a third-party security app on their Android devices.

Malwarebytes has an offering of its own, and we recommend Editors' Choice Bitdefender Mobile Security and Antivirus. Concerned about price? Not to worry; Editors' Choice avast! Mobile Security & Antivirus is completely free.

Lastly, be wary every time you go to install an app onto your Android phone. Even if the app isn't outrightly malicious, simple apps can sometimes be packed full of info-gathering tools. App creators sometimes use these to gather your personal information and then sell it to advertisers. Take a moment to read through the permissions each app requests, and if you're not comfortable with what it's requesting, search around for an alternative. Trust me, there are plenty of alternatives for Android apps. Or, in the case of a flashlight app, try to a find a phone that runs Android 5.1 and use the one built into the operating system.

Apple relents, lets you "depurchase" that U2 album you never bought in the first place‏

Someone at Apple must be listening!

The company offered every iTunes user (let's call that half a billion people) a free copy of U2's latest album.

Largesse, swag, booty, a tchotchke, call it what you will.

U2's Songs of Innocence was a global freebie annnounced at Apple Live 2014, Apple's annual product launch extravaganza.

In fact, getting the free album turned out to be an offer so good that you simply couldn't refuse.

And when I say that, I'm not being metaphorical.

You literally couldn't refuse, because the product was automatically clocked up as one of your iTunes purchases and downloaded to your device.

By default (unless you had turned on an iTunes feature called Automatic Downloads), the actual music data itself wasn't pushed to your iPhone.

But the album and its track list arrived automatically:

Strictly speaking, clicking to listen to a song for the first time meant clicking to download-and-listen, but that's a somewhat pedantic distinction, almost like the difference between double-clicking and single-clicking to open an email attachment.

Opinions were strongly divided.

One Naked Security reader told us:

"Hey, it's a gift so stop the ridiculous fussing. 
If you don't want it just don't download it. OK? 
My goodness all these desperate, angst-inspiring First World problems."

Another took the middle ground:

"The problem is Apple seem to have such brand power over their customers 
that arrogance is creeping into their marketing.

Still, as others have pointed out, 
at least it wasn't Justin Bieber."

But one commenter wondered aloud, "Where does this sort of stunt end?"

"Today it's the next U2 album. 
Tomorrow it's a piece of propaganda on your Kindle. 
The next day it's an app so Big Brother can watch you."

The album certainly wasn't opt-in, because it turned up without even asking you.

But there were all sorts of problems that meant it wasn't even really opt-out, either.

For example, you could left-swipe on each song to reveal a button labelled Delete.

Except that you had to listen to the song first.

You could hide the album in iTunes, so you'd still own it, and still be a statistic in the biggest album release ever; you just wouldn't see the album (or end up with it in some randomly chosen playlist).

You couldn't, it seems, disown, unbuy or depurchase it.

Until now.

Apple has listened, and come up with a free Album Removal Tool, though this part isn't automatic: you have to opt in to opting out:

In fact, if you remove the album now, then from 13 October 2014 onwards, you really will be able to purchase it.

Bono would approve; after all, he told TIME Magazine that he "[doesn't] believe in free music."

Free Mac anti-virus for home users

Good news for MAC users out there!

Sophos announced the availability of a free Mac anti-virus product for home users. Based on Sophos's security software, which protects over 100 million business users worldwide, Sophos Anti-Virus Home Edition for Mac is available for consumers to download at no charge.


Sophos Anti-Virus Home Edition for Mac provides automatic detection against existing and new threats for Mac OS X. The free software also incorporates strong disinfection capabilities, capable of removing malware infections that may already be present on the Mac computer.

Sophos Anti-Virus Home Edition for Mac detects both Mac and Windows malware, and is backed by SophosLabs, Sophos's global network of highly skilled researchers and analysts, protecting businesses from known and emerging malware - viruses, Trojans, spyware and rootkits. SophosLabs ensures that Sophos Anti-Virus Home Edition can even proactively stop brand new unseen threats before they can install on your Mac.

Technical requirements:

• Mac with Intel or PowerPC processor
• 256 MB of memory
• 150 MB of available disk space
• Mac with OS X 10.4 (Tiger), 10.5 (Leopard) or 10.6 (Snow Leopard)
• Supports all Apple Mac hardware including iMac, MacBook, MacBook Pro and the new MacBook Air.

Free Security Tool Detects Malicious URLs On Twitter

The popularity of embedding shortened URLs into Twitter, Digg and other social media sites is being threatened by hackers who use the anonymity of these URLs to hide malicious websites.

AVG Technologies has released a free tool called LinkScanner that can detect the presence of malicious web pages. LinkScanner works by testing the destination of each URL in real time and does not use blacklists that quickly become outdated.

"People click with the intention of going to a specific site, but the link can be easily hacked to send people to a site containing Trojans, spyware, rootkits and other malware instead."

AVG says malicious web pages are the latest way that hackers and spammers deposit malware onto computers in order to steal passwords or recruit computers into botnets.

Computer users can become infected by clicking on a link, viewing an image, or sometimes just hovering their mouse over a banner. To avoid detection, hackers typically infect a specific web page for less than 24 hours before moving on.

Microsoft Releases Free Security Software

Let's face it, we all lurveeeee FREE stuffs. So, good news for you people out there!

Microsoft has released its free security suite for consumers today, dubbed Microsoft Security Essentials.

The anti-malware services helps to protect users against viruses, spyware and other malicious software. It requires no registration, trials or renewals and is available for download directly from Microsoft.

Microsoft Security Essentials is designed to run quietly in the background alerting users only when there is an action for them to take. It limits CPU and memory usage and has less impact on tasks users perform such as opening documents or browser windows or loading search results, even on older less powerful PCs.

Microsoft Security Essentials is available for Windows XP SP2 or SP3, Windows Vista and Windows 7 including Windows XP mode on both x32 and x64 PCs.

Microsoft Security Essentials is available in eight languages and 19 countries including Australia, Austria, Belgium, Brazil, Canada, France, Germany, Ireland, Israel, Italy, Japan, Mexico, the Netherlands, New Zealand, Singapore, Spain, Switzerland, the United Kingdom and the United States.

Source

Microsoft's launches free AV offering

Microsoft launched a beta version of its forthcoming free antivirus software on Tuesday, aiming to protect users who, for one reason or another, have not installed security applications on their computers from other providers.

The security software, dubbed Microsoft Security Essentials, will block known viruses and prevent some malicious behavior normally associated with stealthy malicious software known as rootkits, the company stated. Microsoft will create the definitions for the product using samples collected from more than 450 million PCs around the world.

The company flagged rogue security software as a key problem that its software could eliminate by offering a free, trusted alternative.

"With malware attacks increasing in both number and severity and the increasing incidence of rogue security software, quality anti-malware protection delivered from a trusted source is a must-have for today's PC users," the company stated.

Microsoft announced in November that it would be phasing out its Windows Live OneCare service, instead offering a limited free antivirus service to Windows users. The software will not provide other security measures — such as managed firewalls, performance tuning and data backup services — common in other security products, include Microsoft's Windows Live OneCare service. Instead, the company aims to create a basic anti-malware service that does not impact PC performance in hopes that attackers will have more trouble infecting customers' computers.

The company plans to allow customers to download the initial beta of the software on Tuesday, starting from 9 a.m. PT and launch the final product by the end of the year.

AVG Releases Free Real-Time Search Virus Scanner

AVG has pretty good timing considering the recent success cybercrooks have had with manipulating search results to direct searchers to malicious websites. The security company released a free tool today that scans links before users click on them.

AVG LinkScanner, available for free download, checks URLs ahead of clicking by scanning the webpage and alerting the user if the site contains malicious code. When used in conjunction with Google, Yahoo, or MSN, the tool shows green check marks beside safe results and red exes beside unsafe ones. The tool also works with links in email, IMs, and bookmarks.

Available for Windows XP and Vista users, AVG's LinkScanner prevents users from downloading compromised webpages.

The tool scans pages individually, so prevention and labels only apply to one page on a given website, not the entire site itself.

The free scanning tool comes at a good time as Google has been struggling with malicious pages making their way high up in the search results before the search engine can identify them as attack sites. The problem has gotten bad enough that Google says its ranking algorithm will be tweaked to make this less likely.

No word yet on whether the tool also works with URL shorteners, used on social networks and microblogging platforms like Facebook and Twitter to fit links into character limits. Recently hackers have been using URL shorteners to trick users into clicking out to malicious sites.