Beware: ad slingers thinly disguised as security apps 0 814

Fake Security App

According to AV-Comparatives, an independent testing organization, there are significant differences in the level of protection provided by mobile security solutions. However, even the least secure of them are still far better than questionable apps that impersonate security applications in order to display ads to users. Thirty-five such applications have recently been discovered in the Google Play official Android app store.

These apps have Google Play statistics showing a minimum of over six million installs, cumulatively. However, not all those were necessarily real installations, it is possilbe that many were bot downloads posting fake reviews to improve the ratings for the app.

All 35 apps have been flagged by ESET and eventually removed from the store.

In addition to annoying their victims with ads, disguising these apps as security software has some serious negative side effects, too. In mimicking basic security functions – in fact, they all act as very primitive security checkers relying on a few trivial hardcoded rules – they often detect legitimate apps as malicious. And last but not least, they create a false sense of security in the victims, which might expose them to real risks from malicious apps that are not detected as such.

ESET’s analysis has shown that among these 35 apps, only a handful stand out for their specific features: one app is not completely free as it offers a paid upgrade; one app has implemented a primitive, easily bypassed, app-locker manager; another app flags other apps from this group as dangerous by default; and finally, one misuses ESET’s branding.

 

Security-mimicking functionality
In order to stay under the radar, all the shady ad-displaying apps mimic actual mobile security solutions. However, their ‘detection mechanisms’ are incomplete and very primitive, which makes them easy to bypass and prone to false positives.

Our research into these questionable apps has shown that their ‘detection mechanisms’ can be divided into four categories. These mechanisms are identical or almost identical across the whole set of apps.

1) Package name whitelist & blacklist
These whitelists features popular apps such as Facebook, Instagram, LinkedIn, Skype and others. The ‘blacklists’ contains far too few items to be considered security functionality at all.

2) Permissions blacklist
All apps (including legitimate ones) are flagged if they require some of the listed permissions that are considered dangerous, such as send and receive SMS, access location data, access the camera, etc.

3) Source whitelist
All apps but those from the official Android store, Google Play, are flagged – even if they are completely benign.

4) Activities blacklist
All apps that contain any of the blacklisted activities: that is, parts of applications. This mainly concerns some ad-displaying activities.

Flagged are all apps that contain any of the blacklisted activities, i.e., packages of application that are used in an application. These packages can handle additional functionalities (mainly some ad-displaying activities).

While there is nothing wrong with the idea of activity blacklisting, the implementation in these questionable apps is rather sloppy. For example, Google Ads is included in the blacklist despite the fact that it is a legitimate service. On top of being legitimate, this service is implemented in all of the shady apps we analyzed.

Additional security “functionality”
Some of the questionable security apps are capable of protecting a user’s apps with a password or a pattern locker. The idea behind this seemingly useful feature is to provide the user with another layer of security in selected apps.

However, due to insecure implementation, this feature also fails to provide true security to the user.

The problem is that relevant information is not stored safely on the device – instead of using encryption, which is common baseline practice in cybersecurity, these apps store the names of locked apps and the passwords to unlock them as plaintext.

This means that the data can be accessed after the device is rooted.

Besides compromising the unencrypted data by rooting the phone, there is another way to bypass the app lock. An attacker with physical access to the device can change the app-locking password without knowing the old one!

Conclusion
Having a security solution installed in an Android phone is definitely a good thing. However, not all apps featuring “security” or “antivirus” in their name do what the name promises. Before installing a security solution, think twice: is it really a tool you can safely rely on?

The 35 pseudo-security apps described in this article are not, say, ransomware or other hardcore malware. The only harm they do is displaying annoying ads, making false-positive detections and giving the victim a false sense of security. However, those millions of unwary users who downloaded them could easily have ended up downloading true malware in some similar disguise.

Instead of shady apps with flashy names and icons and outlandish, unsubstantiated promises, seek a reputable security solution. And which one to choose? An independent test by a well-respected testing organization might help.

Previous ArticleNext Article

Safer Internet Day 2019 0 205

Working together with your children for a better online experience

Beginning in 2004, Safer Internet Day has grown to become one of the landmark events in the online safety calendar. And this year’s theme, ‘Together for a better internet’, encapsulates a lot of the discussion we are seeing around online safety and cybersecurity. The topic is too complex a minefield for any of us to bear sole responsibility and, like all good things in life, we need to work together to bring about the best possible future.

What does it mean to work together where online safety is concerned? It could be an IT security company working closely with a consultation of parents to develop products, or parents and teachers working to ensure the online education of our young people. But what about children themselves? We put a lot of onus on finding the right solutions and products to protect our kids online, but one day those kids will grow up and live without online parental control. We should think about the best way to prepare them; ‘together for a better internet’ should mean working with our children to educate, inform and protect them, so they can stand the best possible change of making the right decisions for themselves.

That’s not to say that software doesn’t play a crucial role, and ESET would encourage all parents to take care over choosing the right parental control software on the family computer. When you are doing this though, we advise you do it together with your kids. Talk them through the programmes you’re installing and select your privacy settings together, discussing why you are doing it and the kinds of threats you’re protecting the family against. As part of this conversation you can talk to your children about what they’re doing online, who they’re talking to and what kinds of things they need to be careful about in day to day online. Many kids see control settings on the internet as a block to them having fun; what they need is someone to explain their function and reasoning. By having this discussion, you’re giving your kids an element of control and responsibility over their online activities which, when paired alongside the rules and software we all need to protect ourselves, should produce better results when it comes to their internet education.

The internet is such an integral part of our lives that the earlier you start talking to kids, involving them and teaching them about their online worlds, the better the results. Creating an open dialogue will always be more effective than just putting your foot down.

Set an example; whatever you expect your kids to do, make sure you are also doing. The online world represents dangers for all of us and we can all benefit from a few more precautions. If you’re asking your kids to cover their webcam when they’re not using it, then make sure you also do it. If you’re restricting their screen time, then think about setting yourself some boundaries as well. With the damaging effects of too many screens on our health and wellbeing, it’s unlikely to have any negative repercussions.

ESET’s software, such as its ESET Parental Control, places a large emphasis on parents and children working together. It helps them to navigate online, manage what apps and websites they use, and decide – together – what’s good for them. One of the key features is age-based filters which helps to manage which apps children can and cannot access, allowing parents to consider the right restrictions for their children and to not just impose a blanket ban. Other features include setting time limits on when children can play on their devices and creating exceptions that kids can request. Parents can even send their children messages which they must acknowledge before they can continue to use their devices.

It’s elements such as these that allow children to be involved in the monitoring of their safety, and truly help parents to work together with their kids for a better internet and the best possible online world.

 

ESET East Africa launches a new line of enterprise security solutions 0 592

ESET Enterprise solutions

ESET, the leader in cybersecurity research and a top European Union-based endpoint security company, announces the launch of its new line of enterprise security solutions designed to provide the global enterprise sector with tools for prevention and management of cyber risks on a global scale.

ESET East Africa is raising its game with the introduction of ESET Dynamic Threat Defense, an off-premise cloud sandboxing solution providing almost instant analysis of zero-day and ransomware threats before they reach the network.

As recently reported by Forrester[1], buyers want an “endpoint security suite that consolidates capabilities and minimizes complexity when possible.” ESET East Africa’s new line of cybersecurity solutions meets this demand and offers something extra.

The new line of enterprise security solutions also welcomes the brand-new ESET Security Management Center, a revamp of the renowned online console ESET Remote Administrator. This online console provides not only complete network visibility and full security management via one single pane of glass, but also fully customizable reporting and single-click threat remediation, adding important complexity-minimizing elements to the whole suite.

“We understand global enterprise increasingly requires cybersecurity solutions that are more tailored to their specific needs, because we cooperate with a large number of them at the country level,” explained Juraj Malcho, Chief Technology Officer at ESET. “Get your hands on our latest offering and you’ll see how easily manageable an enterprise security solution can be.”

The ESET Endpoint Protection solutions offer enterprises increased visibility of the alerts being sent to ESET LiveGrid® – a platform made up of 110 million sensors worldwide and verified by ESET research & development centers. This allows customers to have the highest level of confidence when viewing data and reports within their consoles.

ESET East Africa offices are based in Nairobi to offer local support to our ever-growing partner base in the East African region. As part of our commitment to the growth of our partners, we are fully focused on servicing our channel. As an ESET East Africa partner, you will benefit from our technical, sales and marketing expertise to assist with deal closure, technical support and onsite training.

ESET East Africa’s new enterprise products and services are designed to be seamlessly deployed in parallel with the existing ESET enterprise offer. For more information about this offering, visit our website.

[1] The Forrester WaveTM: Endpoint Security Suites, Q2 2018 report