Tag: malware

Microsoft Finds Major Security Flaw ‘Dirty Stream’ in Android Apps Totalling Billions of Downloads

Microsoft discovered a major security vulnerability in multiple Android apps last week that could be exploited to gain unauthorised access to apps and sensitive data on the device. Interestingly, this security flaw does not come from the system codes, but an improper usage of a particular system by developers that can lead to loopholes prone to exploitation. Notably, the flaw has been highlighted to Google, and the tech giant has taken steps to make the Android app developer community aware of the issue.

In a post on its Security Blog, the Microsoft Threat Intelligence team stated, “Microsoft discovered a path traversal-affiliated vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application’s home directory.” The researchers also highlighted that the vulnerability was spotted in several apps in the Google Play Store that had a combined total of more than four billion installations.

This vulnerability emerges when a developer incorrectly uses Android’s content provider system, which is designed to secure data exchange between different apps on a device. This includes data isolation, URI permissions, path validation and other security measures to stop unauthorised access by the apps or anyone else breaking into the app. However, improper implementation of the system affects a component called custom intents. These are the messaging objects that conduct two-way communication between different apps. When this vulnerability exists the apps can ignore the security measures and let other apps (or hackers controlling them) access sensitive data stored in them.

In case of an attack on the device, hackers can manipulate this vulnerability by accessing just one app, they can enter all such apps that contain this loophole. This enables the bad actors to gain complete control over the device or steal sensitive data including financial information. Notably, the vulnerability was found in the Xiaomi File Manager and WPS Office apps. Microsoft stated in its report that developers behind both the apps have investigated and fixed the issue.

Google has also taken cognisance of the issue and published a post on its Android Developers blog. The company has highlighted the common errors and ways to fix them. It is expected that developers of affected apps will be fixing the issues in the coming days and release a fix. While end users cannot do much to avoid this vulnerability, it is recommended that they remain proactive in updating the apps on their devices and avoid downloading apps from third-party sources for a while.

Affiliate links may be automatically generated – see our ethics statement for details.

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who’sThat360 on Instagram and YouTube.


Sony Walks Back Helldivers 2 PSN Account Linking Requirement on Steam After Widespread Backlash



Check out our Latest News and Follow us at Facebook

Original Source

iPhone Devices Under Threat as New iOS Trojan That Targets Facial Recognition Data Reported

iPhone devices are being targeted by a rare trojan called GoldDigger, a cybersecurity firm has reported. The malware is part of a cluster of aggressive banking trojans that have been affecting users in the Asia-Pacific (APAC) region. The earlier spotted malware group was only affecting Android users, but a new version has now been unearthed that specifically targets iOS and steals facial recognition data and other sensitive information from devices. This development is rare since Apple is known to be proactive in releasing security patches for its operating system.

Cybersecurity firm Group-IB was behind the discovery of the iOS trojan. The group has been tracking it since October 2023, when it first found a new variant of Android malware and named it GoldDigger. The malicious programme was found to be a banking trojan that steals financial information and targets banking apps, e-wallets, and crypto-wallets. It was first spotted in Vietnam but later identified as a cluster that was affecting the entire APAC region.

In its findings, the group noted that “a new sophisticated mobile Trojan specifically aimed at iOS users, dubbed GoldPickaxe.iOS by Group-IB” has been discovered. The malware is capable of stealing facial recognition data, identity documents, and can even intercept SMS.

The cybersecurity group also claimed that the threat actors behind the GoldDigger malware likely take advantage of face-swapping AI tools to create deepfakes based on the Face ID data. Then, using a combination of identity documents, access to SMS, and Face ID data, the hacker behind the programme can gain access to the victim’s iPhone and their banking apps. The threat actors then make repeated bank transactions to steal the victim’s money. As per Group-IB, this method of monetary theft was previously unseen.

It was reported that the malware was earlier distributed through the TestFlight app, which lets developers beta-test new features before rolling them out, however, it was quickly removed by Apple. Now, it is being spread through a multi-level social engineering technique which involves tricking the victims into installing a Mobile Device Management (MDM) profile.

The trojan is suspected to be connected with an organised Chinese-speaking cybercrime group and is mainly affecting Vietnam and Thailand. There is a possibility that it might spread to other regions as well. The cybersecurity group stated that it has informed Apple about the trojan, and it is likely that the iPhone maker is already in the process of creating a fix.

Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

SpyLoan Malware Apps Used to Blackmail, Extort Users Using Personal Data Detected on Play Store

Android smartphones are at risk of malicious loan apps that were downloaded several million times from the Google Play store, according to details shared by security researchers. As many as 18 apps identified as ‘SpyLoan‘ malware were spotted on the store over the course of this year. These predatory lending apps are designed to collect vast amounts of information from a user’s device when they borrow money— these are later used to blackmail and extort them into repaying the sum with high interest amounts.

ESET researchers have revealed details of the apps used by loan sharks to deceive users and the various methods used to bypass some of the restrictions put in place on the Play Store. The malware is typically designed with attractive user interfaces and advertise easy and quick access to funds, with high-interest repayment terms. The apps reportedly target users living in Africa, Latin America, and Southeast Asia.

In addition to completing the required documentation and Know Your Customer (KYC) identification required to publish their apps on the Play Store, these SpyLoan apps are also designed to show (or link to) official-looking websites that contain fake information with details and photos of employees sourced from stock image websites.

While the loaned amount is disbursed to users, these predatory loan apps ask users to share different kinds of sensitive information by granting different permissions on their phone, including access to the camera, contacts, messages, and call-logs, images, Wi-Fi network details, calendar information and other personal information. These are then exfiltrated to the servers of the loan sharks.

Instead of providing users with enough time to repay the loaned amount, the SpyLoan apps will reduce the amount of time before a user can repay the amount to a few days — in clear violation of Google’s Financial Services policy that a loan tenure cannot be set for less than 60 days. One of the reviews left by users states that they had to repay 450 pesos (roughly Rs. 2,160) with an interest of 549 pesos (roughly Rs. 2,640) — paying a total of 999 pesos (roughly Rs. 4,800).

SpyLoan apps attempting to access a user’s personal information
Photo Credit: Screenshot/ ESET

 

In order to push users to repay the short term, high interest rate loans, the apps use the data exfiltrated from their phones to blackmail them into repaying the loaned amount with a high rate of interest.

ESET says that out of the 18 apps it previously disclosed to Google, the search giant removed 17 apps. The last app is still available on the app store as a new version of the app was published to the Play Store and it does not offer the same functionality or feature the same permissions.

The list of apps detected by ESET include 4S Cash, AA Kredit, Amor Cash, Cartera grande, Cashwow, CrediBus, EasyCash, EasyCredit, Finupp Lending, FlashLoan, Go Crédito, GuayabaCash, Instantáneo Préstamo, Préstamos De Crédito-YumiCash, PréstamosCrédito, Rápido Crédito, TrueNaira.

While these apps have been removed from the Play Store, they will remain on the devices of users who have these apps installed until they manually remove them. If you have any of these apps installed on your smartphone, you should uninstall them right away.

Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

Fake Google Chrome, Safari Updates Infecting Mac Computers With AMOS Malware

Fake Google Chrome and Safari updates for macOS are being used to infect Mac computers with the nefarious Atomic Stealer malware, also known as AMOS. Distributed to Mac owners as part of a social engineering campaign, AMOS can steal passwords, private files stored on a Mac. Users will need to stay alert and possibly use web protection tools in order to protect themselves from malware distributed by social engineering, as malware creators appear to be turning their attention to Mac owners.

Security firm Malwarebytes shared details of the latest version of Atomic Stealer, malware that is distributed to macOS users via ClearFake, a campaign that uses hijacked WordPress websites to deliver fake browser updates for Chrome and Safari. The distribution of AMOS via ClearFake to macOS users was recently spotted by Ankit Anubhav, a security researcher.

The fake Google Chrome update page shown to users
Photo Credit: Malwarebytes

 

The malware is distributed via hijacked sites that closely resemble the Google Chrome download page, and a fake Safari update page that uses outdated icons from older macOS versions. However, the rest of the webpage design might convince some users to click and download the malware, while the fake Chrome download looks more convincing.

When the user clicks the download button, the malicious .dmg file is then downloaded to the Mac computer, disguised as a browser installer. Once it downloaded and opened, the user is prompted to enter the administrator password that will run nefarious commands on the device, including stealing passwords from Apple’s Keychain and exfiltrate document, images, wallets and other data from the user’s desktop and documents folders on macOS.

In order to stay protected from the malware, users will have to make sure they use some form of web protection — such as the Safe Browsing setting inside Google Chrome. Doing so might block some of these malicious sites from loading altogether.

Meanwhile, users should avoid downloading installers for Chrome from unknown websites. These social engineering websites are aimed at fooling users who might find it difficult to discern which websites are genuine. A good rule of thumb is to check whether the address bar shows google.com. On the other hand, Apple does not distribute Safari updates outside of operating system updates, so there are no official downloads that can be installed by users.

Affiliate links may be automatically generated – see our ethics statement for details.

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel.


Redmi K70E With MediaTek Dimensity 8300 Ultra SoC Officially Teased; Key Specifications, Design Surface Online



Check out our Latest News and Follow us at Facebook

Original Source

India Saw Massive Surge in Ransomware, IoT Cyber Attacks in H1 2023: Report

India saw a huge surge in ransomware and IoT cyber attacks in the first half of 2023, as criminals shifted to stealthier means of malicious activities, according to a report by SonicWall.

While major economies like the US and the UK witnessed a decline in ransomware attacks, India (up 133 percent) and Germany (52 percent) are among the countries that saw a huge surge in such attacks, the 2023 SonicWall Mid-Year Cyber Threat Report for the January-June period stated.

At the global level, a variety of other attacks have trended up, including cryptojacking (399 percent), IoT malware (37 percent), and encrypted threats (22 percent), the report said.

At the global level, there was a decline of 41 percent in ransomware attacks.

Cybercriminals are diversifying and expanding their skill sets to attack critical infrastructure, making the threat landscape even more complex and forcing organizations to reconsider their security needs, the report mentioned.

“While India saw a lesser rise in crypto attacks, there has been a huge growth in ransomware and IoT attacks overall.

“These rises in cyberattacks pose great risks to India’s economic ambitions, with industries from manufacturing to pharmaceuticals becoming more vulnerable as they continue to digitize operations,” Debasish Mukherjee, Vice President of Regional Sales, APJ, SonicWall said.

The data suggests increased law enforcement activity, heavy sanctions and victims’ refusal to pay ransom demands have altered criminal conduct, and threat actors are targeting other means of revenue, the report said while explaining the reason for the fall in ransomware attacks at the global level.

“The seemingly endless digital assault on enterprises, governments, and global citizens is intensifying, and the threat landscape continues to expand,” said SonicWall President and CEO Bob VanKirk.

Data indicated that threat actors are more opportunistic than ever, targeting schools, state and local governments, and retail organizations at unprecedented rates, the report said.

Prominent attacks continued to plague enterprises, cities, airlines, and K-12 schools, causing widespread system downtime, economic loss, and reputational damage, it said.

Cryptojacking attacks on education surged by 320 times, on government by 89 times, and on healthcare by 69 times, according to the report.

Global volume of IoT malware rose 37 percent, totaling almost 78 million hits by the end of June As connected devices continue to rapidly multiply, bad actors are targeting weak points of entry as potential attack vectors into organizations.

“SonicWall intelligence suggests that bad actors are pivoting to lower-cost, less risky attack methods with potentially high returns, like cryptojacking,” said SonicWall Vice President of Product Security Bobby Cornwell.

“It also explains the reason we’re seeing higher levels of cybercrime in regions like Latin America and Asia. Hackers search for the weakest points of entry, with the lightest possible repercussions, limiting their risk and maximizing their potential profits.” 

Samsung launched the Galaxy Z Fold 5 and Galaxy Z Flip 5 alongside the Galaxy Tab S9 series and Galaxy Watch 6 series at its first Galaxy Unpacked event in South Korea. We discuss the company’s new devices and more on the latest episode of Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.
Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

Malicious Software Used by Russian Spies Sabotaged by FBI

The FBI has sabotaged a suite of malicious software used by elite Russian spies, US authorities said on Tuesday, providing a glimpse of the digital tug-of-war between two cyber superpowers.

Senior law enforcement officials said FBI technical experts had identified and disabled malware wielded by Russia’s FSB security service against an undisclosed number of American computers, a move they hoped would deal a death blow to one of Russia’s leading cyber spying programs.

“We assess this as being their premier espionage tool,” one of the US officials told journalists ahead of the release. He said Washington hoped the operation would “eradicate it from the virtual battlefield.”

The official said the FSB spies behind the malware, known as Snake, are part of a notorious hacking group tracked by the private sector and known as “Turla.”

The group has been active for two decades against a variety of NATO-aligned targets, US government agencies and technology companies, a senior FBI official said.

Russian diplomats did not immediately return a message seeking comment. Moscow routinely denies carrying out cyberespionage operations.

US officials spoke to journalists on Tuesday ahead of the news release on condition that they not be named. Similar announcements, revealing the FSB cyber disruption effort, were made by security agencies in the UK, Canada, Australia and New Zealand.

Turla is widely considered one of the most sophisticated hacking teams studied by the security research community.

“They have persisted in the shadows by focusing on stealth and operational security,” said John Hultquist, vice president of threat analysis at US cybersecurity company Mandiant. “They are one of the hardest targets we have.”

© Thomson Reuters 2023

Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

Cyber Alert Issued Against ‘Royal’ Ransomware Virus That Targets Key Sectors, Seeks Bitcoin Payoffs

The Indian cyber security agency has issued a warning against the “Royal ransomware” virus that attacks critical sectors like communications, healthcare, education, and even individuals and seeks pay-off in Bitcoins for not leaking personal data in the public domain.

The Indian Computer Emergency Response Team or CERT-In has stated in the latest advisory that this Internet-spread ransomware sneaks in through phishing emails, malicious downloads, abusing RDP (remote desktop protocol), and other forms of social engineering. This ransomware, cyber experts told PTI, was first detected in January 2022 and it got active sometime around September last year even as the US authorities issued advisories against its spread.

“Royal ransomware is targeting multiple crucial infrastructure sectors, including manufacturing, communications, healthcare, education, etc., or individuals. The ransomware encrypts the files on a victim’s system and attackers ask for a ransom payment in Bitcoin,” the advisory said.

“Attackers also threaten to leak the data in the public domain if denied payment,” the advisory said.

The CERT-In is the federal technology arm to combat cyber attacks and guard cyberspace against phishing and hacking assaults and similar online attacks.

The advisory said the “threat actors have followed many tactics to mislead victims into installing the remote access software as a part of callback phishing, where they pretend to be various service providers.” The ransomware infects “using a specific approach to encrypt files depending on the size of the content.” “It will divide the content into two segments i.e. encrypted and unencrypted. The malware may choose a small amount of data from a large file to encrypt so as to increase the chances of avoiding caution or detection. It adds 532 bytes at the end of the encrypted file for writing randomly generated encrypted key, the file size of the encrypted file, and encryption percentages parameter,” the CERT-In said.

The lethality of this virus can be gauged from the fact that before starting encryption of the data it attacks, the ransomware checks the state of targeted files and deletes shadow copies to “prevent recovery” through service. After intruding into the network, the malware tries to make persistent and lateral movements in the network. Even after getting access to the domain controller, the ransomware disables anti-virus protocols. Moreover, the ransomware exfiltrates a large amount of data before encryption, the advisory said.

It has been observed, it said, that ‘Royal ransomware’ does not share information like the ransom amount, any instructions, etc. on a note like other ransomware, instead it connects with the victim directly via a .onion URL route (dark web browser).

The agency has suggested some counter-measures and Internet hygiene protocols to guard against this ransomware attack and others like it.

Maintain offline backup of data, and regularly maintain backup and restoration as this practice will ensure the organisation will not be severely interrupted and have irretrievable data.

It is also recommended to have all backup data encrypted, immutable (i.e., cannot be altered or deleted) covering the entire organisation’s data infrastructure, it said.

The users should enable protected files in the Windows Operating System to prevent unauthorised changes to critical files and they should disable remote desktop connections, employ least-privileged accounts, and limit users who can log in using remote desktop parts from setting an account lockout policy. A number of other best practices have been suggested by the agency, including basic ones like having an updated anti-virus in the computer systems and not clicking on unsolicited emails from unknown links. 

The Vivo X90 Pro has finally made its debut in India, but is the company’s flagship smartphone for 2023 equipped with enough upgrades over its predecessor? We discuss this and more on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.
Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

Android Malware Infecting 60 Apps With Over 100 Million Downloads Discovered on Google Play Store: Details

A new Android malware has been discovered by a team of security researchers at McAfee. The malware, dubbed ‘Goldoson’, has infected 60 apps that have a total of over 100 million downloads on the Google Play Store. It can collect data on installed apps, Wi-Fi and Bluetooth-connected devices, and track location. Also, it can perform ad fraud by clicking ads in the background without the consent of users. Android users in South Korea are said to have been affected by the latest malware. Apps like Swipe Brick Breaker, Money Manager, and GOM Player have been affected by the malware.

Researchers at security software firm McAfee have identified the Android-based Goldoson malware. Once installed, it collects sensitive data including lists of applications installed, details about the devices paired through Wi-Fi and Bluetooth, and nearby GPS locations. McAfee also claims that the malware can perform ad fraud by clicking advertisements in the background without the user’s consent.

The infected apps on the Google Play Store have a total of over 100 million downloads. Applications from South Korea’s ONE store are also affected by the malware and they have been installed around 8 million times. These include L.POINT with L.PAY, Swipe Brick Breaker, and Money Manager Expense & Budget which have 10 million downloads on Android app stores.

GOM Player, Live Score, Real-Time Score, Pikicast, Compass 9: Smart Compass, GOM Audio, Lotte Word Magicpass, Bounce Brick Breaker, Infinite Slice, SomNote, Korea Subway Info: Metroid are some of the other apps impacted by Goldoson.

McAfee has also confirmed that the discovered apps were reported to Google, and the tech giant notified the developers that their apps affected by the malware. Many of the affected apps were said to be cleaned up by the developers while some were removed from Google Play for violating the company’s app store policies.

Android users with any of these apps on their phones should update them to the latest version. Users are also advised to avoid installing any unknown or suspicious apps on their smartphones. They should also re-check app permissions to limit access of third parties to their device hardware.

Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

Cybercriminals Using ChatGPT Popularity to Spread Malware via Facebook Accounts, CloudSEK Says

Cyber criminals are exploiting popularity of ChatGPT to spread malware through hijacked Facebook accounts, cyber intelligence firm CloudSEK said on Monday.

CloudSEK in its investigation has found the presence of 13 Facebook pages or accounts including those with Indian content, totalling over 5 lakh followers, that have been compromised and are being used to disseminate the malware via Facebook ads.

“Cybercriminals are capitalising on the popularity of ChatGPT, exploiting Facebook’s vast user base by compromising legitimate Facebook accounts to distribute malware via Facebook ads, putting users’ security at risk. Our investigation has uncovered 13 compromised pages with over 500k followers, some of which have been hijacked since February 2023. We urge users to be vigilant and aware of such malicious activities on the platform,” CloudSEK cyber intelligence analyst Bablu Kumar said.

CloudSEK claims to have uncovered at least 25 websites engaged in the nefarious practice of impersonating the OpenAI website, which are malicious sites that are duping individuals into downloading and installing harmful software, posing a severe risk to their security and privacy.

“The malicious malware is not only capable of stealing sensitive information such as PII, system information, and credit card details from the user’s device, but also has replication capabilities to spread across systems through removable media. With the ability to escalate privileges and persistently remain on the system, it poses a significant threat,” Kumar said.

Realme might not want the Mini Capsule to be the defining feature of the Realme C55, but will it end up being one of the phone’s most talked-about hardware specifications? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.
Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

Exit mobile version