Android, Malware

Malware alert for Android phone users 0 1516

Avatar
Malware alert for Android

Internet security company ESET East Africa has issued an alert to mobile phone users running on the Android platfom to be wary of alternative app stores’ potential to spread malware such as screen locking malware.

According to Teddy Njoroge, Kenya Country Manager for ESET, ransomware is a fast growing problem for users of mobile devices.  “Just like SMS trojans, ransomware threats have evolved over the past few years with hackers  adopting techniques that have proven effective in regular desktop malware to develop lock-screen types and file-encrypting ransomware. These have been causing major financial and data losses for years and which have now made their way to the Android platform“, he said.

The alert comes after Cyber-crime researchers at ESET discovered that www.CepKutusu.com, a Turkish alternative Android app store was spreading malware under the guise of all the offered Android apps on the site

When users browsed the Turkish alternative app store CepKutusu.com and proceeded to downloading an app, the “Download now” button led to banking malware detected as Android/Spy.Banker.IE instead of the desired app.

After ESET researchers turned to the store’s operator with the discovery of the attack, the store ceased the malicious activity. ESET Android malware researcher, Lukas Stefanko said this was an entrirely new tactic by cybercrimnals.

“This is the first time I’ve seen an entire Android market infected like that. Within the Windows ecosystem and in browsers, this technique is known to have been used for some time but in the Android ecosystem, it’s really a new attack vector“, he said.

Athough the misdirection on www.CepKutusu.com was from a legitimate app to the malicious banking malware, the crooks behind the campaign added an exception, a tactic commonly used to increase the chances of staying longer under the radar.

The hackers introduced a seven-day window of not serving malware after a malicious download, thus falsely serving the user with clean download links, only to be redirected to the malware once they try to download any application from the store after the period lapses.

Although focused in Turkey and parts of Europe, the incident points to the growing appetite for mobile malware by hackers using masking tactics to hoodwink users and which could soon become the biggest cybersecurity problem yet.

To protect yourself, Njoroge advises that you should always download apps from official app stores and also practice caution when downloading any content from the internet. Always pay attention to anything suspicious in file name, size and extension.

Lastly is to use a reliable mobile security solution to protect you from the latest threats.

Previous ArticleNext Article

Hacking and targeted cyber-attacks as a result of anti-competitive practices in business 0 976

Avatar
Targeted Attacks

In ongoing consultations with clients, large companies named targeted attacks and hacking as two of their biggest security challenges since they can seriously impact the continuity of business activities in an organization.

Attackers have many means to infiltrate companies. However, many attacks, don’t require a very high level of technological sophistication. Instead, techniques like targeted social engineering, i.e. spear phishing, or the use of known vulnerabilities for which, patches may have been issued but businesses have not yet deployed, can lead to damaged reputation, revenue and data breaches.

On the other hand, high levels of sophistication can also be utilized as is in the case of a Zero Day attack.  Chief among these was Stuxnet, a recorded attack where malicious code successfully deployed four zero-day vulnerabilities to impede a uranium enrichment program in Iran, and which, according to media, was a state-sponsored attack.

There are many reasons why organizations become repeat targets. Their bank accounts contain more resources than those of an average person or small business and they also have considerable amounts of interesting data that can be monetized. Attacks targeting companies can also be used as a form of competition. Most often, this concerns data hunting, i.e. obtaining interesting information or intellectual property. These attacks can be accompanied by blackmail. For example, a client database is stolen from a company and is later approached by the perpetrators and asked, “what they are going to do about their loss”.

Different ways to monetize attacks bring different consequences

Organizations often find it difficult to admit they have been breached by these types of attacks. Consequently, this may give other companies the false impression that such attacks happen only occasionally. A typical example of targeted attacks, common in recent years, are DDoS as a Service – attacks, which are sponsored by one company to attack the website of another, with the effect of disrupting business and directing customers away from the targeted company and (possibly) towards the attacker’s “employer”. These are criminal tactics, and the attackers know very well which business areas to target for maximum gain.

There are of course other approaches. Take the example of the British National Health Service, which has become a frequent target of ransomware attacks. Digitization of health services has resulted in a situation where the malicious encryption of medical data may lead to a halt in medical interventions and surgeries. Under such conditions, targeted organizations are often more inclined to pay a ransom for the “hijacked” patient data.

In Kenya attackers have been known to target their attacks to banks and financial institutions, with figures of Ksh400 million being reported stolen from an unnamed local bank and Ksh29 million from National Bank of Kenya in 2018 alone.

Innovative approaches to old tricks

In many rural areas worldwide, one quick glance at powerlines will reveal how easy it is to make illegal connections to the power grid. As of late, cyberattackers have followed a similar model, focusing their resources on illegally mining various cryptocurrencies, which have proven to be highly popular in the public’s imagination.

A more complex example was a targeted attack meant to infect StatCounter, which provides a service  very similar to Google Analytics and uses a special script legitimately placed on websites to obtain data about website visitors. In this case, attackers successfully breached StatCounter and subsequently gained access to the service’s end users by injecting JavaScript code in all websites that use Stat Counter’s service.

The problem came to light when visitors navigated to the now compromised websites which contained the infected scrip, and who’s devices then began covertly mining bitcoins for the attackers. During the second stage, the attackers proceeded to steal bitcoins directly from infected devices when they attempted to access a popular cryptocurrency exchange. To get an idea of the scale of such an operation, StatCounter can be found on more than two million websites.

Such an attack means that system resources of infected devices at the company legitimately using the service are additionally tasked to mine. This may not concern only computers, but also mobile devices and especially servers. The subsequent cryptomining accelerates wear and tear on devices and also increases electricity bills. In addition, we should not forget that malicious cryptomining code is usually capable of uploading other types of malicious script onto the network.

Investigations may take months and are looking for a needle in a haystack

When a large company falls victim to such an attack, it is necessary to carry out a complicated investigation of what happened and how the company has been affected. Research shows that it takes about 150-200 days for companies to find out they’ve been infected. Further investigation regarding the method by which the company was infected and where the malicious code originated may take even longer.

Facing such substantial risks, large companies should leverage solutions like ESET Dynamic Threat Defense to detect new, never before seen threats.

To find out more about ESET Dynamic Threat Defense or to request a free in-house cyber security training session for your organisation, please sign up below.

Beware: ad slingers thinly disguised as security apps 0 1806

Avatar
Fake Security App

According to AV-Comparatives, an independent testing organization, there are significant differences in the level of protection provided by mobile security solutions. However, even the least secure of them are still far better than questionable apps that impersonate security applications in order to display ads to users. Thirty-five such applications have recently been discovered in the Google Play official Android app store.

These apps have Google Play statistics showing a minimum of over six million installs, cumulatively. However, not all those were necessarily real installations, it is possilbe that many were bot downloads posting fake reviews to improve the ratings for the app.

All 35 apps have been flagged by ESET and eventually removed from the store.

In addition to annoying their victims with ads, disguising these apps as security software has some serious negative side effects, too. In mimicking basic security functions – in fact, they all act as very primitive security checkers relying on a few trivial hardcoded rules – they often detect legitimate apps as malicious. And last but not least, they create a false sense of security in the victims, which might expose them to real risks from malicious apps that are not detected as such.

ESET’s analysis has shown that among these 35 apps, only a handful stand out for their specific features: one app is not completely free as it offers a paid upgrade; one app has implemented a primitive, easily bypassed, app-locker manager; another app flags other apps from this group as dangerous by default; and finally, one misuses ESET’s branding.

 

Security-mimicking functionality
In order to stay under the radar, all the shady ad-displaying apps mimic actual mobile security solutions. However, their ‘detection mechanisms’ are incomplete and very primitive, which makes them easy to bypass and prone to false positives.

Our research into these questionable apps has shown that their ‘detection mechanisms’ can be divided into four categories. These mechanisms are identical or almost identical across the whole set of apps.

1) Package name whitelist & blacklist
These whitelists features popular apps such as Facebook, Instagram, LinkedIn, Skype and others. The ‘blacklists’ contains far too few items to be considered security functionality at all.

2) Permissions blacklist
All apps (including legitimate ones) are flagged if they require some of the listed permissions that are considered dangerous, such as send and receive SMS, access location data, access the camera, etc.

3) Source whitelist
All apps but those from the official Android store, Google Play, are flagged – even if they are completely benign.

4) Activities blacklist
All apps that contain any of the blacklisted activities: that is, parts of applications. This mainly concerns some ad-displaying activities.

Flagged are all apps that contain any of the blacklisted activities, i.e., packages of application that are used in an application. These packages can handle additional functionalities (mainly some ad-displaying activities).

While there is nothing wrong with the idea of activity blacklisting, the implementation in these questionable apps is rather sloppy. For example, Google Ads is included in the blacklist despite the fact that it is a legitimate service. On top of being legitimate, this service is implemented in all of the shady apps we analyzed.

Additional security “functionality”
Some of the questionable security apps are capable of protecting a user’s apps with a password or a pattern locker. The idea behind this seemingly useful feature is to provide the user with another layer of security in selected apps.

However, due to insecure implementation, this feature also fails to provide true security to the user.

The problem is that relevant information is not stored safely on the device – instead of using encryption, which is common baseline practice in cybersecurity, these apps store the names of locked apps and the passwords to unlock them as plaintext.

This means that the data can be accessed after the device is rooted.

Besides compromising the unencrypted data by rooting the phone, there is another way to bypass the app lock. An attacker with physical access to the device can change the app-locking password without knowing the old one!

Conclusion
Having a security solution installed in an Android phone is definitely a good thing. However, not all apps featuring “security” or “antivirus” in their name do what the name promises. Before installing a security solution, think twice: is it really a tool you can safely rely on?

The 35 pseudo-security apps described in this article are not, say, ransomware or other hardcore malware. The only harm they do is displaying annoying ads, making false-positive detections and giving the victim a false sense of security. However, those millions of unwary users who downloaded them could easily have ended up downloading true malware in some similar disguise.

Instead of shady apps with flashy names and icons and outlandish, unsubstantiated promises, seek a reputable security solution. And which one to choose? An independent test by a well-respected testing organization might help.