Malware

While it’s pretty rare that you’ll come across malware on Android, sometimes it slips through the cracks and presents a threat. Recently, though, a security firm made an interesting discovery ─ 132 apps on Google Play had been secretly hiding the capability to infect user devices with malware. Specifically, malware designed for Windows…

Expand
Expanding
Close

When Android hardware is cheap, people usually assume there’s at least one catch. That was the case with the $50 NOOK Tablet from Barnes & Noble which on paper and in practice just seemed too good to be true. Well, that might just be the case…

Expand
Expanding
Close

Revealed today by Check Point Research, there’s seemingly another Android malware campaign in the wild. This one goes by the name of Gooligan, and, according to Check Point, it’s already breached as many as 1 million Google accounts. And this number is still rising by 13,000 accounts on a daily basis.

Expand
Expanding
Close

Four separate vulnerabilities in Qualcomm chips – used in 80% of Android devices – could allow a rogue app to provide an attacker with complete control of the unit, including camera and microphone.

The combined flaws, dubbed Quadrooter, were discovered by CheckPoint researcher Adam Donenfeld, and presented yesterday at the Def Con 24 hacking conference …

Expand
Expanding
Close

Android malware known as HummingBad has so far infected 85M devices, putting data at risk, installing further malware and displaying ads sold by the Chinese company controlling it. The claims appear in a blog post by CheckPoint, the security company that first detected the malware.

The group tries to root thousands of devices every day and is successful in hundreds of attempts. With these devices, a group can create a botnet, carry out targeted attacks on businesses or government agencies, and even sell the access to other cybercriminals on the black market. Any data on these devices is at risk, including enterprise data on those devices that serve dual personal and work purposes for end users …

Expand
Expanding
Close

Danish security firm Heimdal has detected a nasty piece of malware that spreads via SMS and tricks users into downloading a malicious app. The text message containing the download link has already been sent to 100,000 phones in Denmark, though common sense security practices should keep users safe.

Expand
Expanding
Close

ArsTechnica reports that Google has pulled 13 malicious apps from the Play store after they were found to make unauthorized downloads. The apps (listed below) are particularly dangerous in that they attempt to gain root privileges that would allow them to remain installed even after a factory reset.

The malware used a clever technique to make the apps appear safe, giving them high download numbers and positive ratings.

The apps are capable of using compromised devices to download and positively review other malicious apps in the Play store by the same authors. This helps increase the download figures in the Play Store.

Although the family of malware known as Brain Test has been around for a while, affected apps have previously only been found in third-party app stores. This is the first time Brain test apps have been found in the Google Play store …

Expand
Expanding
Close

In a press release this morning, Qualcomm announced a brand new technology to help keep us protected from potential malware threats on our smartphones. Smart Protect will be built into chips in the near future and provide “real-time, on-device machine learning designed to support accurate and effective detection of zero-day malware threats for improved personal privacy and device security”. Qualcomm’s Snapdragon 820 chip will be the first to feature the new technology when it hits the market in 2016.

Expand
Expanding
Close

When mobile security researchers recently discovered what they described as the “worst Android vulnerability in the mobile OS history,” there appeared little you could do about it beyond waiting for your carrier or manufacturer to push Google’s fix. The exploit could auto-run as soon as you received an MMS designed to trigger it, whether or not you opened the message.

The same researchers have now created an app that allows you to check whether or not your devices has been patched against Stagefright, together with a step you can take to prevent the exploit from running automatically … 
Expand
Expanding
Close

Mobile security researchers at Zimperium say that they have discovered the “worst Android vulnerability in the mobile OS history” – and it can infect your smartphone simply by receiving an MMS message. Unlike most malware, it is not necessary to open the message in order for your phone to be compromised, reports NPR.

“This happens even before the sound that you’ve received a message has even occurred,” says Joshua Drake, security researcher with Zimperium and co-author of Android Hacker’s Handbook. “That’s what makes it so dangerous. [It] could be absolutely silent. You may not even see anything.”

Once the MMS has been received, it activates code which gives the attacker complete control of your Android device – everything from copying data to taking over the microphone and camera … 
Expand
Expanding
Close

Back in May of last year, Google started enforcing a policy that requires Chrome extensions be hosted on its Chrome Web Store, but only on Windows. The goal was to prevent malware hidden in extensions installable from outside its store, and it even started disabling extensions already installed on users’ systems that weren’t hosted on the Chrome Web Store. Now, Google says it will bring that requirement to Mac Chrome users over the coming months, as well as the Chrome developer channel for Windows that wasn’t previously enforcing the policy:
Expand
Expanding
Close

An example of a webpage made completely unusable by injected ads

A Google-sponsored study carried out by the University of California, Berkeley and Santa Barbara found “tens of millions of instances” of ad malware in the course of just a few months. In all, they found that a staggering 5.5% of unique IP addresses – representing millions of users – were affected.

Ad injection malware drops its own ads into whatever web page an infected machine displays. Revenue from these ads is filtered through ad networks, where genuine companies end up paying the bills, effectively stealing revenue that should have gone to the websites themselves.

Some of this malware goes further than simply injecting ads … 
Expand
Expanding
Close

While most malware is the result of third-party attackers trying to gain access to your device or information, security research firm Palo Alto Networks has discovered that Chinese handset maker Coolpad has deliberately installed a backdoor on two dozen of its Android handset models. The so-called “CoolReaper” backdoor presents several security risks and is believed to impact over 10 million users.
Expand
Expanding
Close

The ability to flag content on the Google Play Store as inappropriate, a feature long available on Android, has recently hit the Web version as well. The link to do just that can now be found on the web interface under Report within the Additional information section of the content’s description. While the feature is likely targeted toward apps that may violate some policy or have a lower-than-appropriate content rating, it does extend to other media like books, music and TV shows, and music distributed on the Google Play Store as well.

Expand
Expanding
Close

Google-owned VirusTotal today released a version of the VirusTotal uploader application (via The Next Web) compatible with Mac OS X. Previously the software was only available for Windows-based machines.

VirusTotal Uploader works in conjunction with the VirusTotal web service to check files and links for malware. Google hopes that the release of the software for the Mac will help users more easily detect attacks on Apple’s platform. From the VirusTotal blog:

Expand
Expanding
Close

Cyber security vendor FireEye recently announced that Google has patched a software flaw that left Android users open to phishing attacks. The firm says that it identified a malicious app that could modify the icons of other Android software applications. The strategy behind this attack, would be to trick an unknowing Android user into clicking a false app icon that would direct them to a phishing website.

These bogus sites would then try to steal their personal information. Some of the permissions attacked by the malware include  “com.android.launcher.permission.READ_SETTINGS” and “com.android.launcher.permission.WRITE_SETTINGS.” These permissions allow an application to reconfigure an Android device’s launcher, including its software icons.

Expand
Expanding
Close