Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Android Users. Show all posts
OCR
Android Malware Android Users Data Privacy Mobile Security OCR

Novel Android Malware Employs OCR to Steal Crypto Wallet Keys From Images

 

A novel mobile malware operation dubbed SpyAgent has surfaced targeting Android device users in South Korea. According to an investigation by McAfee Labs researcher SangRyol Ryu, the malware "targets mnemonic keys by scanning for images on your device that might contain them," and it has expanded its targeting footprint to include the UK.

The campaign uses fake Android apps to deceive users into installing them. These apps seem like real banking, government, streaming, and utility apps. As many as 280 fake apps have been uncovered since the start of the year.

It all begins with SMS messages with booby-trapped links directing users to download the apps in question in the form of APK files published on fraudulent websites. Once installed, they will request intrusive permissions to extract data from the devices. 

The most prominent feature is its ability to employ optical character recognition (OCR) to steal mnemonic keys, which are recovery or seed phrases that allow users to restore access to their bitcoin wallets. Unauthorised access to the mnemonic keys could allow attackers to gain control of the victims' wallets and drain all of the funds stored in them. 

According to McAfee Labs, the command-and-control (C2) infrastructure had major security flaws that permitted unauthorised access to the site's root directory as well as the exposure of victim data. 

The server also has an administrator panel, which serves as a one-stop shop for remotely controlling the infected devices. The appearance of an Apple iPhone running iOS 15.8.2 with the system language set to Simplified Chinese ("zh") in the panel indicates that it may also target iOS users. 

"Originally, the malware communicated with its command-and-control (C2) server via simple HTTP requests," the researchers explained. "While this method was effective, it was also relatively easy for security tools to track and block." "In a significant tactical shift, the malware has now adopted WebSocket connections for its communications. This upgrade allows for more efficient, real-time, two-way interactions with the C2 server and helps it avoid detection by traditional HTTP-based network monitoring tools.” 

The finding comes a little more than a month after Group-IB disclosed another Android remote access trojan (RAT) known as CraxsRAT, which has been targeting Malaysian banking users since at least February 2024 via phishing websites. It's worth noting that CraxsRAT campaigns have already been found to target Singapore by April 2023.
Read more »
Scam
Android Users APK Files bank account cyber attack Financial Fraud KYC Scam

New APK Scam: Protect Your Bank Account from Fraudsters


 


Punjab and Sind Bank (PSB) recently issued a public notice alerting customers to a new scam involving fraudulent messages and malicious APK files. This scam threatens grave  financial losses if customers do not take proper precautions.

How the APK Scam Works

Step 1: Creating Panic with Fake Messages

Scammers initiate the fraud by sending text messages that mimic legitimate bank communications. These messages claim that recipients must update their Know Your Customer (KYC) information to avoid having their bank accounts blocked. The fraudulent messages create a sense of urgency, making recipients more likely to follow the instructions.

Kaushik Ray, Chief Operating Officer of Whizhack Technologies, explains that these messages exploit users' fears and desires, bypassing rational judgement. The goal is to trick recipients into downloading a malicious APK file, a common format for Android apps.

Step 2: Installing Malicious APK Files

Once recipients are convinced by the false narrative, they are instructed to download and install an APK file. These files often contain malware. Upon installation, the malware grants hackers access and control over the victim's mobile device.

Step 3: Executing Cyber Attacks

With control of the device, hackers can perform various malicious activities. These include installing a keylogger to capture sensitive information like banking credentials and passwords, launching ransomware attacks that lock the device until a ransom is paid, and accessing the clipboard to steal copied information such as account numbers.

How to Protect Yourself from APK Scams

To protect against these scams, PSB advises customers to take the following precautions:

1. Avoid Downloading Files from Unknown Sources: Only download apps from trusted sources like the Google Play Store.

2. Do Not Click on Suspicious Links: Be wary of links received in unsolicited messages, even if they appear to be from your bank.

3. Block and Report Suspicious Contacts: If you receive a suspicious message, block the sender and report it to your bank or relevant authorities.

4. Never Share Personal Information Online: Do not disclose personal or financial information to unverified sources.

Why APK Scams Target Android Users

Ray highlights that this scam primarily targets Android users because APK files are specific to Android devices. iOS devices, which use a different file format called IPA, generally have stricter controls against installing third-party apps, making them less vulnerable to this type of attack. However, iOS users should remain vigilant against phishing and other scams.

Real-Life Impacts of the APK Scam

Imagine receiving a message that your bank account will be frozen if you do not update your KYC information immediately. This could lead to panic about how you will pay for everyday expenses like groceries, school fees, or utility bills. Scammers exploit this fear to convince people to download the malicious APK file, giving them access to your device and your money.

Stay alert, verify the authenticity of messages, and protect your personal information to safeguard your financial assets.


Read more »
Vulnerabilities and Exploits
Android Users Chat GPT Fake ChatGPT Apps Google Play Store Unauthorized access Vulnerabilities and Exploits

Beware of Fake ChatGPT Apps: Android Users at Risk

In recent times, the Google Play Store has become a breeding ground for fraudulent applications that pose a significant risk to Android users. One alarming trend that has come to light involves the proliferation of fake ChatGPT apps. These malicious apps exploit unsuspecting users and gain control over their Android phones and utilize their phone numbers for nefarious scams.

Several reports have highlighted the severity of this issue, urging users to exercise caution while downloading such applications. These fake ChatGPT apps are designed to mimic legitimate AI chatbot applications, promising advanced conversational capabilities and personalized interactions. However, behind their seemingly harmless facade lies a web of deceit and malicious intent.

These fake apps employ sophisticated techniques to deceive users and gain access to their personal information. By requesting permissions during installation, such as access to contacts, call logs, and messages, they exploit the trust placed in them by unsuspecting users. Once granted these permissions, the apps can hijack an Android phone, potentially compromising sensitive data and even initiating unauthorized financial transactions.

One major concern associated with these fraudulent apps is their ability to utilize phone numbers for scams. With access to a user's contacts and messages, these apps can initiate fraudulent activities, including spamming contacts, sending phishing messages, and even making unauthorized calls or transactions. This not only puts the user's personal information at risk but also jeopardizes the relationships and trust they have built with their contacts.

To protect themselves from falling victim to such scams, Android users must remain vigilant. Firstly, it is crucial to verify the authenticity of an app before downloading it from the Google Play Store. Users should pay attention to the developer's name, ratings, and reviews. Furthermore, they should carefully review the permissions requested by the app during installation, ensuring they align with the app's intended functionality.

Google also plays a vital role in combating this issue. The company must enhance its app review and verification processes to identify and remove fake applications promptly. Implementing stricter guidelines and employing advanced automated tools can help weed out these fraudulent apps before they reach unsuspecting users.

In addition, user education is paramount. Tech companies and cybersecurity organizations should actively spread awareness about the risks of fake apps and provide guidance on safe app usage. This can include tips on verifying app authenticity, understanding permission requests, and regularly updating and patching devices to protect against vulnerabilities.

As the prevalence of fake ChatGPT apps continues to rise, Android users must remain cautious and informed. By staying vigilant, exercising due diligence, and adopting preventive measures, users can safeguard their personal information and contribute to curbing the proliferation of these fraudulent applications. The battle against fake apps requires a collaborative effort, with users, app stores, and tech companies working together to ensure a safer digital environment for all.
Read more »
User Privacy
Android Users Iranian hackers Mobile Security Spyware User Privacy

Iranian Hackers Employ Novel RatMilad Spyware to Target Enterprise Android Users

 

Earlier this week, threat analysts at mobile security firm Zimperium Inc. zLabs detailed a newly unearthed form of Android spyware leveraged to target enterprise devices in the Middle East. 

Dubbed “RatMilad,” the original version of the spyware was identified as concealing behind a VPN and phone number spoofing app called Text Me. After discovering the spyware, the researchers also spotted a live sample of the malware family distributed through NumRent, an updated version of Text Me.

According to Zimperium, an Iran-based hacker group named AppMilad is distributing the phone spoofing app via links on social media and communication tools like Telegram, luring unsuspecting users into sideloading the app and granting it extensive permissions. Moreover, fraudsters have designed a product website to distribute the app and trick users into believing that it is an authentic app. 

Since the malicious app can trick users into obtaining a broad range of permissions, it can gain access to sensitive device data, such as location and MAC address, and user data, including phone calls, contact numbers, media files, and SMS messages. 

"Once installed and in control, the attackers could access the camera to take pictures, record video, and audio, get precise GPS locations, view pictures from the device, and more," Zimperium researcher Nipun Gupta stated.

Additionally, the hackers can access the camera and microphone of the device, which allows them to record audio/video and capture photos. Other features include collecting clipboard data, SIM information, and performing read/write activities. 

The scale of the infections is unknown, but the cybersecurity firm said it identified the spyware during a failed compromise attempt of a user's enterprise device. A post published on a Telegram channel employed to distribute the malware sample has been viewed over 4,700 times with more than 200 external shares, indicating a limited range.

"The RatMilad spyware and the Iranian-based hacker group AppMilad represent a changing environment impacting mobile device security," Richard Melick, director of mobile threat intelligence at Zimperium, explained. From Pegasus to PhoneSpy, there is a growing mobile spyware market available through legitimate and illegitimate sources, and RatMilad is just one in the mix." 

Prevention tips 

The easiest method to avoid falling victim to fake Android apps employed to propagate spyware and malware is to download new apps from official app stores like the Google Play Store, the Amazon Appstore, and the Samsung Galaxy Store. 

Additionally, the users are recommended to scan the app that is sideloaded onto a device and increase the mobile attack surface leaving data and users at risk.
Read more »
Trojan
Android Banking Trojan Android Users Banking Trojan Cyber Safety Flubot malware Security Teabot Trojan

Threat Actors Blanket Androids with Flubot & Teabot Campaigns

 

Researchers have found a bundle of dynamic campaigns transmitting the Flubot and Teabot trojans through a variety of delivery strategies, with threat actors utilizing smishing and pernicious Google Play applications to target victims with fly-by assaults in different locations across the globe. 

Specialists from Bitdefender Labs said they have caught more than 100,000 malignant SMS messages attempting to transmit Flubot malware since the start of December, as indicated by a report distributed Wednesday. 

During their analysis of Flubot, the team additionally found a QR code-peruser application that has been downloaded more than 100,000 times from the Google Play store and which has disseminated 17 different Teabot variations, they said. 

Flubot and Teabot surfaced on the scene last year as somewhat clear financial trojans that take banking, contact, SMS and different kinds of private information from infected gadgets. Be that as it may, the administrators behind them have interesting strategies for spreading the malware, making them especially nasty and expansive. 
 
Flubot was first founded in April focusing on Android clients in the United Kingdom and Europe using noxious SMS messages that nudged recipients to introduce a "missed package delivery" application, exhibiting a component of the malware that allows attackers to utilize command and control (C2) to send messages to victims. 

This feature permits administrators to rapidly change targets and other malware highlights on the fly, augmenting their assault surface to a worldwide scale without requiring a complex framework. For sure, campaigns later in the year targeted Android users in New Zealand and Finland. 

“These threats survive because they come in waves with different messages and in different time zones,” Bitdefender researchers wrote in the report. 

“While the malware itself remains pretty static, the message used to carry it, the domains that host the droppers, and everything else is constantly changing. For example, in the month between Dec. 1 of last year and Jan. 2 of this year, the malware was highly active in Australia, Germany, Spain, Italy and a few other European countries.”   

Campaigns between Jan. 15 and Jan. 18 then, at that point, moved to different parts of the globe, including Romania, Poland, the Netherlands, Spain and even Thailand, they found. 
 
Attackers likewise spread out past attempting to fool users into thinking they missed a package delivery- what Bitdefender named "fake courier messages" - to disseminate Flubot. However this strategy was available in almost 52% of campaigns specialists noticed, they likewise utilized a trick named "is this you in this video" that is a take-off of a credential-stealing campaign that has been streaming steadily via web-based media in around 25% of noticed missions, analysts wrote. 

“When the victim clicks on the link, it usually redirects them to a fake Facebook login that gives attackers direct access to credentials,” researchers explained. 

Flubot administrators have gotten on this trick and are involving a variety of it in one of the smishing efforts noticed, with clients getting an SMS message that inquires, "Is this you in this video?" researchers noted. In any case, the objective of the mission is very similar: to some way or another trick users into installing the software under some cover. 

“This new vector for banking trojans shows that attackers are looking to expand past the regular malicious SMS messages.”
  
Among different lures, Flubot administrators likewise utilized SMS messages utilizing counterfeit program updates and phoney phone message notices in around 8% of noticed campaigns, separately, analysts stated.
Read more »
SMS Phishing
Android Android Users Cyber Fraud Data-Stealing Iran Mallicious Apps phishing Scam SMS Phishing

Researchers: Iranian Users Beware of Widespread SMS Phishing Campaigns

 

Socially engineered SMS texts are being utilized to install malware on Android smartphones, as part of a large phishing operation that impersonates the Iranian government and social security authorities in order to steal credit card information and funds from victims' bank accounts, 

Unlike other types of banking malware that use overlay attacks to steal sensitive data without the victim's knowledge, the financially motivated operation discovered by Check Point Research is developed to trick victims into handing over their credit card information by sending them a legitimate-looking SMS message with a link that, when clicked, downloads a malware-laced app onto their devices. 

Check Point researcher Shmuel Cohen stated in a new report published Wednesday, "The malicious application not only collects the victim's credit card numbers, but also gains access to their 2FA authentication SMS, and turn[s] the victim's device into a bot capable of spreading similar phishing SMS to other potential victims." 

As per the cybersecurity firm, it discovered hundreds of distinct phishing Android apps masquerading as device tracking apps, Iranian banks, dating and shopping sites, cryptocurrency exchanges, and government-related services, with these botnets sold as a "ready-to-use mobile campaign kit" on Telegram channels for somewhere between $50 and $150. 

The infection chain of the smishing botnet begins with a bogus notification from the Iranian judiciary requesting users to evaluate a fictitious complaint made against the message's receivers. The complaint link takes victims to what appears to be a government website, where they are requested to provide personal information (e.g., name, phone number, etc.) and download an Android APK file. 

Once downloaded, the rogue app not only demands invasive rights to execute operations typically not associated with such government applications, but it also displays a false login page that resembles Sana, the country's electronic judicial notice system, and prompts the victim to pay a $1 payment to proceed. Users who choose to do so are then sent to a bogus payment page that captures the credit card information submitted, while the installed software acts as a covert backdoor to harvest one-time passcodes given by the credit card provider and assist more fraud. 

Furthermore, the malware has a plethora of functionality, including the ability to exfiltrate all SMS messages received by a device to an attacker-controlled server, conceal its icon from the home screen to circumvent attempts to remove the app, deploy extra payloads, and obtain worm-like powers to broaden its attack surface. 

Prevent data breaches 

Cohen explained, "This allows the actors to distribute phishing messages from the phone numbers of typical users instead of from a centralized place and not be limited to a small set of phone numbers that could be easily blocked. This means that technically, there are no 'malicious' numbers that can be blocked by the telecommunication companies or traced back to the attacker." 

To make matters worse, the attackers behind the operation were discovered to have inadequate operational security (OPSEC), enabling any third party to openly access the phone numbers, contacts, SMS messages, and list of any online bots stored on their servers. 

"Stealing 2FA dynamic codes allows the actors to slowly but steadily withdraw significant amounts of money from the victims' accounts, even in cases when due to the bank limitations each distinct operation might garner only tens of dollars." 

"Together with the easy adoption of the 'botnet as a service' business model, it should come as no surprise that the number of such applications for Android and the number of people selling them is growing," he added.
Read more »
Spyware
Android Applications Android Users Critical Data Data Theft Google Play Store Mobile Security Spyware

Alert Android Users: These 23 Apps Found Spying via Mobile Camera

 

A new malware, PhoneSpy, that eavesdrops on Android users, was detected in 23 applications recently,  As of present, none of these applications are available on Google Play Store. 

The malware that has primarily been active in the United Kingdom and Korea, is capable of stealing critical data such as images, call logs, contacts, and messages, as well as obtaining the full list of installed apps, recording audio and video in real-time using the phone's cameras and microphone. It can also extract device information such as the IMEI number, device name, and brand, and even grant remote access to the device. 

Zimperium stated in a statement, “The application is capable of uninstalling any user-installed applications, including mobile security apps. The device’s precise location is available in real-time to the malicious actors, all without the victim knowing. The spyware also enables the threat actor to use phishing pages for harvesting credentials of Facebook, Instagram, Google, and Kakao Talk." 

“PhoneSpy hides in plain sight, disguising itself as a regular application with purposes ranging from learning Yoga to watching TV and videos, or browsing photos," the mobile security agency Zimperium added. 

Since the spyware or any of its shadow applications were listed on the Play Store, experts believe the attackers may have used online traffic redirection or social engineering to spread the malware. The latter is used by cyber thieves to trick device owners into performing voluntary actions. 

If users carefully examine their online traffic habits, they may be able to discover the malware invasion. The PhoneSpy software begins by sending requests for on-device authorization. Once the user has provided these details, attackers can manage and hide the app from the main menu. 

According to Zimperium, Android users should avoid installing apps from third-party app stores. It’s recommended that users only download applications from the Google Play Store. Also, users are suggested to avoid clicking on questionable links or downloading any applications sent by text message or email.
Read more »
User Data
Android App Android Users Huawei Mallicious Apps Mobile Security Spyware User Data

Huawei's App Gallery Hosted Malicious Apps Installed by 9M+ Android Users

 

Around 9.3 million Android devices have been infected with a new type of malware that masquerades as dozens of arcade, shooter, and strategy games on Huawei's AppGallery marketplace in order to gather device information and victims' phone numbers. 

Researchers from Doctor Web discovered the mobile campaign and categorized the trojan as "Android.Cynos.7.origin," simply because it is a modified variant of the Cynos malware. Some of the 190 rogue games discovered were made for Russian-speaking players, while others were made for Chinese or worldwide audiences. 

The applications requested the victims for permission to make and control phone calls once they were installed and then utilized to access and capture their phone numbers as well as other device data including geolocation, mobile network characteristics, and system metadata. 

All of these harmful games are primarily geared at children, who are easy targets for having all of their permissions activated. Huawei has currently uninstalled all of the vulnerable games from its AppGallery app store. If users have a Huawei smartphone and aren't sure if they're infected or not, some of the malicious apps are mentioned below: 
  • “[Команда должна убить боеголовку]” with more than 8000 installs. 
  • “Cat game room” with more than 427000 installs. 
  • “Drive school simulator” with more than 142000 installs. 
  • “[快点躲起来]” with more than 2000000 installs 
Furthermore, the Doctor Web malware analysts have previously warned Huawei about these harmful apps. Doctor Web researchers stated, "At first glance, a mobile phone number leak may seem like an insignificant problem. Yet in reality, it can seriously harm users, especially given the fact that children are the games' main target audience." 

"Even if the mobile phone number is registered to an adult, downloading a child's game may highly likely indicate that the child is the one who actually uses the mobile phone. It is very doubtful that parents would want the above data about the phone to be transferred not only to unknown foreign servers, but to anyone else in general."
Read more »
User Security
Android Users Eavesdrop Mobile Security Security Updates User Security

Bugs in MediaTek Chips Impacts 37% of All Android Smartphones

 

Check Point researchers have uncovered new flaws in MediaTek system-on-chips (SoCs) which could have enabled threat actors to eavesdrop on the audio of roughly two-fifths (37%) of all smartphones and Internet of Things devices. 

Tracked as CVE-2021-0661, CVE-2021-0662, and CVE-2021-0663, the three security flaws were patched by Taiwanese microchip firm MediaTek in its October bulletin after accountable disclosure by Check Point Research. A fourth bug, CVE-2021-0673, was fixed in October and will probably be published in the December bulletin.

The Check Point team mentioned it reverse engineered one of the key parts on the chip, the audio digital signal processor (DSP), which is implemented to minimize CPU usage and enhance media output.

The report published also highlighted the process that attackers would have to go through to abuse this flaw. The vulnerability can only be exploited if a user installs a malicious app from the Google Play Store allowing hackers to exploit the flaw in MediaTek SoC-powered smartphones. Once installed, the app will leverage the MediaTek API to attack a library that has permission to communicate with the audio driver. 

After that, the malicious app with system privilege will send crafted messages to the driver to implement code in the firmware of the audio processor. This would enable remote attackers to eavesdrop on audio conversations.

MediaTek’s chip is the primary processor for “nearly every notable Android device,” which includes several Chinese manufacturers including Xiaomi, Oppo, Realme, and Vivo, in accordance with Check Point. 

“Left unpatched, a hacker potentially could have exploited the vulnerabilities to listen in on conversations of Android users. Furthermore, the security flaws could have been misused by the device manufacturers themselves to create a massive eavesdrop campaign,” warned Check Point safety researcher, Slava Makkaveev. Although we do not see any specific evidence of such misuse, we moved quickly to disclose our findings to MediaTek and Xiaomi.” 

Tiger Hsu, product security officer at MediaTek, urged all customers to replace their handsets when patches become available but were at pains to point out there’s no evidence the vulnerabilities are currently being abused. 

“Device security is a critical component and priority of all MediaTek platforms,” Hsu stated. “Regarding the audio DSP vulnerability disclosed by Check Point, we worked diligently to validate the issue and make appropriate mitigations available to all OEMs.”
Read more »
Playstore
Android Android Phone Android Users Fake Apps Mobile Security Playstore

Alert: Android Users Should Delete These 151 Apps Immediately

 

A total of 151 scam applications have been identified and deleted from the Google Play Store, but Android users should double-check that none of them is installed.

Avast, a cybersecurity software company, has detected a massive premium SMS fraud running on the official Google Play Store, according to BGR. It's been termed the UltimaSMS campaign by Avast (because the first scam software uncovered during the investigation was Ultima Keyboard 3D Pro), and it's made up of 151 fraudulent applications that have been downloaded over 10.5 million times in over 80 countries. 

Custom keyboards, QR code scanners, video and photo editors, spam call blockers, camera filters, and games are just some of the applications that are disguised as legitimate tools. However, they all have the same goal in mind: to sign users up for premium SMS services. 

Every app follows the same methodology: The area code and language to use are determined by checking the phone's location, International Mobile Equipment Identity (IMEI), and phone number once it has been installed. Prompts then ask for the user's phone number and, in some instances, their email address. 

This information is then utilised to sign them up for premium SMS services without the user's knowledge. The charges are typical $40 or more each month, and users may not be aware of them for weeks or months. Once an UltimaSMS app has reached its objective, it often stops running or advertises more subscription choices instead of the promised features. The concern is that premium subscriptions will continue to deduct money from users' accounts even if they remove the app. 

Avast compiled a list of all 151 applications involved in the fraud and every Android user should examine it. If anyone has any of these applications installed (or have had them installed in the past), uninstall them immediately. 

However, if anyone notices any unexpected charges, examine the statements and contact the carrier. If users wish to avoid this sort of fraud in the future, then should ask their carrier to disable premium SMS options on the account.
Read more »
User Security
Android Users Fake Schemes malware User Privacy User Security

Flubot Malware Employs Fake Security Updates to Trick Android Users

 

Threat actors behind the Flubot android malware are employing a new technique to fool Android users into downloading the malicious code. The attackers are sending fake SMS messages of potential security threat and are tempting Android users to install a security update. 

If installed, the Flubot Android malware steals passwords, bank details and other private details information from compromised devices. The malware also exploits permissions on the smartphone to spread itself to other victims, allowing the infection chain to continue. 

“Your device is infected with the FluBot malware. Android has detected that your device has been infected. FluBot is an Android spyware that aims to steal financial login and password data from your device. You must install an Android security update to remove FluBot,” states the fake security warning discovered by CERT NZ researchers. 

Last month, security firm Trend Micro explained how the Flubot malware tricked users into installing fake voicemail apps after taking users to a website that was designed to look like a mobile operator. Now, the Computer Emergency Response Team of New Zealand (CERT NZ) is warning users that the fake security warning is only a bait designed to instill a sense of temptation and pushing potential victims to install malicious apps.

In previous attacks, the malware was spreading by spamming text messages to contacts from compromised devices phones that instruct them to install malicious apps from servers under the possession of threat actors. 

The malware has been active since late 2020, and has targeted several European countries. Researchers have advised Android users to not click on the malicious link and if someone has clicked on the link, then do not enter any passwords or login to any service on your device. Immediately, factory reset the phone, only backing up data that is required.

It can be an uphill task to keep up with mobile alerts, but it's worth remembering that it's unlikely that companies will ask you to download an application from a direct link – downloading official apps via official app stores is the effective method to try to keep safe when downloading apps. Additionally, change all online account passwords, specifically those linked to online bank accounts and contact your bank immediately.
Read more »
Wifi vulnerability
Android Android Security Android Users Data Breach Educational Institute User Credentials User Data User Privacy Wifi vulnerability

Thousands of University Wi-Fi Networks Dislcose Log-In Credentials

 

Multiple configuration vulnerabilities in a free Wi-Fi network used by several colleges can enable access to the usernames and passwords of students and teachers who connect to the system using Android and Windows devices, according to the findings by researchers. 

WizCase researchers lead by researcher Ata Hakçl evaluated 3,100 Eduroam setups at universities throughout Europe and discovered that more than half of them have vulnerabilities that threat actors might exploit. 

They noted that the risk of misconfiguration might spread to other companies throughout the world. Eduroam offers free Wi-Fi access at participating institutions. It provides log-in credentials to students, researchers, and faculty members, allowing them to access the internet across many universities by utilizing credentials from their own university. 

Researchers found vulnerabilities in the execution of the Extensible Authentication Protocol (EAP) used by Eduroam, which offers numerous levels of authentication when individuals connect to the network. Some of these authentication steps are not implemented properly in some colleges, causing security flaws.

Researchers wrote in a report posted Wednesday, “Any students or faculty members using Eduroam or similar EAP-based Wi-Fi networks in their faculties with the wrong configuration are at risk.” 

“If you are using an Android device and have Eduroam Wi-Fi set to auto-connect, malicious people could capture your plaintext username and password by only getting 20 or so meters in the range of you.” 

WizCase evaluated several configuration guidelines and built a test environment with multiple attack scenarios for the study. Overall, their analysis indicated that in the majority of institutions with misconfigured networks, threat actors may establish an “evil twin”, Eduroam network that a user would mistake for the actual network, especially on Android devices. 

Referring to Eduroam's catalogue application that performs certificate checks, researchers stated, “This could result in these devices automatically sending their stored credentials in order to connect to the evil twin Wi-Fi network for users not using eduroamCAT.” 

Researchers emphasized that the issue is not due to any technical flaw in Eduroam's services or technology, but rather due to improper setup instructions provided by the institutions' own network administrators to those setting up access. 

Moreover, while each institution supplies resources and personnel to assist Eduroam functioning, researchers discovered that there is no centralized management for the network – either as a whole or at each university where the system is in place. This signifies that a minor misconfiguration may make it a target for hackers. 

Researchers narrowed down the issue further by dissecting the numerous consecutive steps of EAP authentication, discovering that inadequate implementation of the last level of this authentication, known as "Inner Authentication," is at the foundation of the problem. Inner Authentication is accomplished in one of two methods in EAP. 

One method is to utilize the Plain Authentication Protocol (PAP), which sends users' credentials to the authentication server in plaintext and relies on Outer Authentication to completely encrypt the traffic with a server certificate. 

The alternative method utilizes Microsoft Challenge Handshake Authentication Protocol version 2 (MSCHAPv2), which understands that there may be errors in the “Outer Authentication stage, and transfers the password in a hashed, non-plaintext form. 

Mismanaged Certificate Checks 
“When a network with the same Wi-Fi name appears, Android devices will not check whether this certificate is trustworthy or not, and will not even notify the user about the certificate before connecting,” they explained. 

Even an operating system that properly performs certificate checks can disclose data since many users do not understand what a certificate check implies and will permit the connection to proceed even if they get an alert concerning the certificate. 

According to the researchers, this indicates that the problem can arise on Windows as well if a system is misconfigured. iOS devices are not vulnerable to the vulnerability since they do not enable connections to EAP networks without first installing the EAP configuration file, which ensures the validity of the server-side certificate. 

As per the researchers, 2,100 of the 3,100 Eduroam participating university setups examined by WizCase are possibly impacted by the issue. 

According to the firm, it may be prevented by returning to the second technique of Inner Authentication. WizCase contacted Eduroam in December to share their results and received a response the same day. 

In accordance with WizCase, Eduroam officials stated that they are aware of “Eduroam identity providers who do not follow the requirements of the Eduroam policy and leave their own users unprotected,” agreeing with researchers that this conduct is “unacceptable.” It is unknown whether Eduroam contacted its customers to alert them about the issue.
Read more »
Security Alert
Android Malware Android Users Joker malware malware Security Alert

Joker Malware Targeting Android Users Again

 

Recently Joker virus has been discovered in a few Google Play Store apps. The malware infiltrates a user's device through applications, collects data, and then subscribes these users to premium memberships without the individual's consent or agreement. 

Since three years, the Joker Trojan malware has been discovered in Google Play Store apps. In July 2020, the Joker virus infected over 40 Android apps available on Google Play Store, forcing Google to remove the compromised apps from the Play Store. Users' data is stolen, including SMS, contact lists, device information, OTPs, and other major data.

Quick Heal Security Labs recently discovered 8 Joker malware on the Google Play Store. These eight apps were reported to Google, and the company has since deleted them all from its store. 

The following are the eight apps that have recently been discovered to be infected with the Joker Trojan virus and should be deleted from any Android device: 
-Auxiliary Message 
-Fast Magic SMS 
-Free CamScanner 
-Super Message 
-Element Scanner 
-Go Messages 
-Travel Wallpapers 
-Super SMS 

Through SMS messages, contact lists, and device information, the Joker Trojan collects information from the victim's device. The Trojan then interacts discreetly with advertising websites and, without the victim's knowledge, subscribes them to premium services. 

According to the Quick Heal report, these applications request notification access at launch, which is then utilised to obtain notification data. After that, the programme takes SMS data from the notification and requests Contacts access. When permission is granted, the app makes and manages phone calls. Afterwards, it keeps working without displaying any suspicious attacks to the user. 

“Joker is one of the most prominent malware families that continually targets Android devices. Despite awareness of this particular malware, it keeps finding its way into Google’s official application market by employing changes in its code, execution methods, or payload-retrieving techniques. This spyware is designed to steal SMS messages, contact lists, and device information along with silently signing up the victim for premium wireless application protocol (WAP) services,” Zcaler stated in a blog post.
Read more »
VPN
21 Million Users Android Users Data Breach VPN

Data of 21 Million VPN Users Leaked Online

Security experts from Cybernews have discovered a massive data breach which is directly linked to the millions of VPN user. Security experts discovered during their investigation that cybercriminals are selling over 21 million users’ records on a popular hacker forum and are trading three databases that contain user credentials and device data stolen from three different Android VPN services – SuperVPN (with 100 million+ installs on Play Store), GeckoVPN (10 million+ installs), and CatVPN (50,000+ installs).

List of Leaked Information 

As per the reports of Cybernews, cybercriminals are trading three databases, two of which allegedly contain a variety of data apparently gathered by the providers from more than 21 million users. This data includes:
 
• Email addresses 
• User Names 
• Full Names 
• Country Names 
• Randomly generated password strings 
• Payment related data • Premium membership status and its expiration data 

Based on the sample that the security experts were able to view from the database, the collection also appears to contain user device information, including: 

• Serial numbers of devices 
• Phone types and manufacturers 
• Device IDs • IMSI numbers of the devices 

“The threat actor claims that the data has been exfiltrated from publicly available databases that were left vulnerable by the VPN providers due to developers leaving default database credentials in use,” Cybernews stated. 

VPN providers: The main culprits 

Millions of users trust VPN because it strengthens user’s data privacy and security on the internet, it alters their IP address and location, making their browsing activity safe and private from cybercriminals. Cybernews claims that these three VPN providers are logging in for more information about their users than stated in their Privacy Policies. It also suspects that the cybercriminals might have gained full remote access to the VPN servers.

“If true, this is an incredible blow to user security and privacy on the part of SuperVPN, GeckoVPN, and ChatVPN. And, in the case of SuperVPN, this blow is not the first. With deeply sensitive device information such as device serial numbers, IDs, and IMSI numbers in hand, threat actors that have access to the data contained on the compromised VPN servers can get hold of that data and carry out malicious activities such as man-in-the-middle attacks and more,” Cybernews further stated.

 

Read more »
Subscribe to: Posts (Atom)