Android flaw puts personal data at risk for millions

Nearly half of Android devices are vulnerable to an attack that could replace a legitimate app with malicious software that can collect sensitive data from a phone.

Google, Samsung and Amazon have released patches for their devices, but 49.5 percent of Android users are still vulnerable, according to Palo Alto Networks, which discovered the problem. Google said it has not detected attempts to exploit the flaw.

A malicious application installed using the vulnerability, called "Android Installer Hijacking," would have full access to a device, including data such as usernames and passwords, wrote Zhi Xu, a senior staff engineer with Palo Alto.

The company wrote two exploits that take advantage of the flaw, which involves how APKs (Android application packages) are installed.

The vulnerability only affects applications that are installed from a third-party app store. Security experts generally recommend using caution when downloading apps from those sources.

Apps downloaded from third parties place their APK installation files in a device's unprotected local storage, such as an SD card, Xu wrote. From there, a system application called PackageInstaller finishes the installation. The flaw allows an APK file to be modified or replaced during installation without anyone knowing.

An attack would work like this: A user downloads what appears to be a legitimate application. The application asks for certain permissions on the device. During that process, Palo Alto found it was possible to swap or modify the APK file in the background because the PackageInstaller fails to verify it, Xu wrote.

After clicking the install button, "the PackageInstaller can actually install a different app with an entirely different set of permissions," he wrote.

Android devices do not need to be rooted for the attack to work, although rooting does make devices more vulnerable.

When the flaw was discovered, in January 2014, close to 90 percent of all Android devices were affected. That has since dropped to 49.5 percent, but many devices have not been patched.

Palo Alto's exploits were successful against Android versions 2.3, 4.0.3 to 4.0.4, 4.1.x, and 4.2.x. The 4.4 version of Android fixes the issue. Some Android 4.3 devices may still be affected, however, since some manufacturers have not patched yet, Xu wrote.

Google has published a patch here, and Amazon recommends downloading the latest version of the Amazon AppStore, which will update its Fire devices, Xu wrote.

Palo Alto has also developed an Android app that will detect if a device is still vulnerable.

Microsoft: Office will be free for devices under 10 inches

Microsoft drew a line in the sand on Tuesday, as its Office 365 chief said that editing and viewing documents on small-screen devices would continue to be free—likely killing off the idea of a small-screen Surface Pro mini, incidentally.

Kirk Koenigsbauer, the corporate vice president for the Office 365 Client Apps and Services team, revealed in a blog post that Microsoft believes that 10.1 inches is the dividing line between a “personal” and “professional” experience. Pros need the reliability and security of paid apps, while “personal” users are more interested in free.

“Currently, we are also using screen size to delineate between professional and personal use,” Koenigsbauer wrote. “Based on our research, we are classifying anything with a screen size of 10.1 inches or less as a true mobile device: You’re probably using it on the go, when it’s not practical to use a larger computing device such as a PC or a Mac. You probably aren’t using a mouse or a keyboard, instead navigating via touch interface. It’s probably not a “pro” category tablet that is used for design or presentations.”

On these mobile devices, the core editing and viewing experience will be free, Koenigsbauer wrote, until you get to those “premium, subscription features,” like integration from one app to another, security, and reliability—all part of the Office 365 suite, and not the individual apps.

Why this matters: Everyone understands what differentiates a desktop from a phone. But as the lines between phones, tablets, and phablets blur, software vendors have to make a decision: What does the software experience look like as the screens they’re displayed on grow and shrink? At Microsoft, that dividing line will be about the dimensions of the Surface Pro tablet: 10.1 inches. And given that Microsoft’s definition of “professional” doesn’t include anything under 10.1 inches, that's game over for a small-screen Surface Pro tablet.

Note though, that Microsoft hasn't said anything about actually creating documents on smaller screens. So you won't necessarily be able to launch a new Office document on a small-screen tablet, just edit one you've already created. It's just another of these annoying, lawyerly distinctions that are a legacy of the old Microsoft.

Microsoft will continue to push its free individual apps, such as Word, PowerPoint, Outlook, Skype, and others, to third-party hardware makers, as Microsoft did Monday. The company partnered with Samsung, Dell, and others to bring Office and Office 365 to Android tablets.

Office for iOS has been downloaded more than 80 million times already, Koenigsbauer said. Office 365 Home and Office 365 Personal grew to more than 9.2 million subscribers in the last quarter, up 30 percent, he said. And as Microsoft continues to push its apps across the whole of the computing ecosystem, that number will continue to grow.

Facebook login exploit 'a phishers dream'

Data breaches happen in numerous ways. So many ways in fact that it's difficult for security teams to predict where an attack will happen next. The latest is an exploit of Facebook login on numerous websites. Once accounts are hijacked in this way, they can be held for ransom or used by a phisher to work their way into much larger and more profitable data sets.

It's accomplished through the use of a ready-to-use tool called Reconnect. The tool has been released to the wild and is therefore accessible by anyone. Essentially, Reconnect enables the user to log on to a website using stolen Facebook credentials.

"I tested this out and it looks legitimate. This is a phishers dream really, I am sure we will see a lot of Facebook accounts compromised by this. Hopefully, Facebook is working on a fix," said Ken Westin, senior security analyst at Tripwire.

Security researchers believe that most if not all websites that enable Facebook login are vulnerable to the exploit. The blackhat release site says Reconnect can be used to hijack accounts on websites such as Booking.com, Bit.ly, About.me, Stumbleupon, Angel.co, Mashable.com, Vimeo and many others.

"This is indeed a very big issue as many popular websites use Facebook's delegated identification, so a widespread exploit could wreak a lot of havoc," said Branden Spikes, CEO of Spikes Security.

"Giving Facebook a little benefit of the doubt here, this looks like an instance of an unfortunate practice where black hats or corrupt penetration testing firms discover big vulnerabilities like this, and rather than submitting them through the standard bug bounty channels (or on the terms of their professional contract with the victim) they choose to ransom them instead," he added.

Phishing: it's not just for email anymore. Until Facebook finds a fix, it may behoove companies to disable the login.

PwC sets up Cyber Security Centre of Excellence in Singapore

PwC (PricewaterhouseCoopers) has launched a new Cyber Security Centre of Excellence in Singapore, which will be headed by Vincent Loy, Cyber Leader, PwC Singapore.

The Centre of Excellence aims to serve the business community both locally and in the region through the provision of research, training & skill development, information sharing, communication, awareness and policy, standards and international cooperation.

“As Singapore moves closer to becoming a Smart Nation, the need for the right talent to ensure that the nation and our systems are well guarded against threats will become a growing imperative,” said Loy. “PwC is working to build capabilities that will support businesses as they ‘go digital’.

“We are already in the process of heavily recruiting globally to bring different capabilities and skill sets to Singapore. In addition, we are training existing staff and new recruits on cyber related capabilities.”

PwC Singapore has been actively providing services in cyber security and related areas since 2012. In response to the growing demand for talent in the cyber and data risk areas, PwC Singapore aims to expand its practice from 40 staff to approximately 300 over the next three years.

PwC also plans to invest S$50 million over the next three years in capability and technological development in its continued commitment to be a thought leader in the area of cyber risk and security.

“Businesses and organizations need to move beyond focusing on tactical technology solutions,” said Yeoh Oon Jin, Executive Chairman, PwC Singapore. “The right culture and mindset to manage and mitigate digital risks need to seep through the entire organization.

Processes will need to become even more robust and standardized across all access channels. The end game is to prevent cyber threats and vulnerabilities for a safer, smarter and sustainable eco-system.”

Yahoo! Releases On-Demand Passwords

Yahoo! Is taking a new tack in authentication with the implementation of on-demand passwords, which are texted to a mobile phone when a user needs them.

Yahoo! subscribers in the US can opt into the scheme via their security settings page in the account information section.  Once a mobile phone is added to the account, a one-time password will be sent every time a login is required.

It’s sort of like two-factor authentication—without the first factor involved.

“We’ve all been there…you’re logging into your email and you panic because you’ve forgotten your password,” said Chris Stoner, Yahoo! director of product management, in a blog. “After racking your brain for what feels like hours, it finally comes to you. Phew! Today, we’re hoping to make that process less anxiety-inducing…You no longer have to memorize a difficult password to sign in to your account—what a relief!”

But not everyone agrees that the method boosts safety. Tim Erlin, director of product management and a security and IT risk strategist for Tripwire, pointed out that the method simply directs hackers’ efforts to intercepting text messages.

“While Yahoo is lifting the burden of remembering a password, they are maintaining a single target for compromise: your SMS messages,” he noted in an email. “Malware on your phone could be used to grab those SMS messages, and then have full access to your account. On-demand passwords are also mutually exclusive with Yahoo’s two-step verification, so enabling them forces users to effectively downgrade security on their account.”

TK Keanini, CTO of Lancope, told Infosecurity that he agreed that users will need to pay more attention to mobile security.

“While only leveraging a single factor (something you have—your phone), the security of the system will depend on how secure that device remains over time,” he said. “We will see a major shift by the attacker to target malware on these mobile platforms because of their larger role in the overall security of the individual. It is also important these days to ensure that the mobile account is secure because you don't want attackers changing features like call forwarding and other features that can put them in the middle of this communication stream.”

Nonetheless, he applauded Yahoo! for thinking creatively.

“We need more innovation like this with authentication,” he said. “Passwords are just pieces of information and in all these strategies, we want to make it useful for the shortest amount of time but not be an administrative burden. Yahoo! knows that the most personal device on a person these days is their mobile phone. And let’s not stop here, let’s keep innovating even more techniques to raise the cost to our attackers.”

Malicious Android App Fakes Shutdown and Allows Bad Guys to Take Control

Is this thing on?

Unless you have your Android device in one hand and its batteries in another, you might not be sure if it's turned off. An Android Trojan app called PowerOffHijack, which originated from Chinese app stores, was found tricking users into believing that their devices were turned off though they're actually powered on.

Digging into the issue, Trend Micro researchers found that an app believed to be an earlier version of PowerOffHijack appeared as early as September 2014. The app named AndroidFramework (detected AndroidOS_AndFraspy.HAT) disguised itself as a Google service with the package name com.google.progress.

Fake Shutdown Routines
As mobile device users are aware, pressing the power button can result in two things. Tapping the button will turn off the screen, while holding it down will cause it to prompt with device options that include shutting the phone down.

The AndroidFrameworkmalware was designed to perform its malicious operations in the background after you press the power button and the screen goes black.

On the one hand, the PowerOffHijack version was made to run in the background even after you hold the power button down and chose to turn the device off. It will even display the Android shutdown animation to make you believe that your device is shutting down. At this stage, the malware can still make phone calls, send SMS, take photos, and do other malicious routines without user consent.

Both these malware apps were found in third party app stores outside of Google Play and require a rooted device to run.

The PowerOffHijack reportedly works on devices running on Android operating systems that are older than version 5.0, Lollipop. It is said to have originated from third-party Chinese app stores, which explains why most of the 10,000 affected devices are from China.

How to Get Rid of AndroidFramework and PowerOffHijack 
It was previously suggested that users can only be truly safe from the PowerOffHijack threat if they remove the batteries of their devices. However, this is not practical for many users who do need to use the devices as well as for devices with batteries that can't be easily removed.