HTC Sneaks Spying App into Android 2.3.4 Phones

hothardware.com

Looks like HTC has quietly slipped its users a spying app that tracks an alarming amount of user behavior and sends that data off to itself and perhaps others via a mysterious service in the cloud. The snooping app came nestled with the 2.3.4 Android update pushed out to some of its smartphones such as the Sensation 4G and EVO 4G.

TrevE and Team Synergy of the InfectedROM site (and XDA fame), discovered the app. HTC includes an application called Carrier IQ and Carrier IQ recently added a user-behavior logging feature called IQ Insight Experience Manager.

According to the Carrier IQ website: "IQ Insight Experience Manager uses data directly from the mobile phone itself to give a precise view of how users interact with both their phones and the services delivered through them, even if the phone is not communicating with the network. ... Identify exactly how your customers interact with services and which ones they use. See which content they consume, even offline."

But wait there's more. Turns out that after HTC collects these stats, CIQ isn't the only app with access to them.



More...

Businesses Increasingly Under Attack From Cyber-Security Threats

marketwatch.com

Cyber-Criminals Targeting Mobile Devices and Social Media Sites

SAN JOSE, Calif., Sept. 1, 2011 /PRNewswire via COMTEX/ -- SonicWALL, Inc., the leading provider of intelligent network security and data protection solutions, today issued its mid-year cyber-threat intelligence bulletin. The bulletin reveals that businesses are increasingly under attack by cyber-criminals who seek to exploit employees connecting to corporate networks via mobile devices and their rising use of social media. Growth in Android-based malware and social media scams such as click-jacking on Facebook and malicious links sent over Twitter are creating new and heightened levels of business vulnerability from data intrusion, theft and loss. Productivity and profitability are also compromised due to network and application downtime. Data for the bulletin was sourced from the SonicWALL Global Response Intelligent Defense (GRID) Network(TM), which gathers, analyzes and correlates billions of dynamic, real-time global cyber-threats.



More...

Android becomes most attacked mobile platform

security.cbronline.com

Going rate of one million stolen email addresses is $25, says cyber security company

Google's operating system (OS) for mobile phones, Android, has become a favourite target for cyber criminals with the amount of malware targeted at Android devices jumping 76% since last quarter, to become the most attacked mobile OS.

According to computer security company McAfee's latest 'Threats Report: Second Quarter 2011', this year has also resulted in the busiest ever first half-year in malware history.

In the second quarter (2Q) of 2011, Android OS-based malware surpassed Symbian OS for the most popular target for mobile malware developers.

The report also said that while Symbian OS and Java ME remain the most targeted to date, the rapid rise in Android malware indicates that the platform could become an increasing target for cybercriminals - affecting everything from calendar apps, to SMS messages to a fake Angry Birds updates.

McAfee Labs senior vice-president Vincent Weafer said, "This year we've seen record-breaking numbers of malware, especially on mobile devices, where the uptick is in direct correlation to popularity."

Weafer also said that cyber criminals are building sophisticated malware which are difficult to detect.

More...

ZeuS Trojan for Google Android Spotted

krebsonsecurity.com

Criminals have developed a component of the ZeuS Trojan designed to run on Google Android phones. The new strain of malware comes as security experts are warning about the threat from mobile malware that may use tainted ads and drive-by downloads.

Researchers at Fortinet said the malicious file is a new version of “Zitmo,” a family of mobile malware first spotted last year that stands for “ZeuS in the mobile.” The Zitmo variant, disguised as a security application, is designed to intercept the one-time passcodes that banks send to mobile users as an added security feature. It masquerades as a component of Rapport, a banking activation application from Trusteer. Once installed, the malware lies in wait for incoming text messages, and forwards them to a remote Web server.

More...

Lock down your cellphone

iol.co.za
Hacking into cellphones is “quite easy”, say local spyware specialists, and it has been commonplace around the world since the technology first came into circulation.

What makes it easy is the fact that few cellphone users bother to set the special PIN codes to allow them to use securely the special feature of accessing their messages from another phone. This means their cellphones remain on the service provider’s default settings – well known to all in the business.

And the user is left vulnerable to hackers such as Glenn Mulcaire, the private investigator at the centre of the UK’s News of the World phone hacking scandal.

But even in cases where the four-digit message default setting has been changed, private investigators say it is relatively easy to access – as long as you have a connection placed inside the particular service provider, or the gift of the “blag” – see sidebar.

Acting on behalf of the tabloid newspaper, Mulcaire – in search of a scoop for his employers – is alleged to have invaded the privacy of not only politicians and celebrities, but also, post-mortem, murdered teenager Milly Dowler and UK soldiers who lost their lives in Afghanistan and other theatres of war.

More...

Warrantless cell phone searches spread to more states

cnn

(CNN) -- Think about all the data -- photos, videos, text messages, calendar items, apps, call log, voice mail, and e-mail -- on your cell phone right now. If you're arrested, could the police search your cell phone? And would they need a warrant?

That depends on which state you're in.

In California, it is legal for police to search an arrestee's cell phone without a warrant -- ever since a January decision by the California Supreme Court.

California civil rights advocates are pushing back. The Electronic Frontier Foundation is supporting California Assembly Bill SB 914, which would require police in that state to get a warrant before searching an arrestee's cell phone.

EFF also recently filed an amicus brief in the Oregon case of James Tyler Nix, a criminal suspect who was arrested and placed in a holding cell.

According to EFF, "Forty minutes after the arrest, without a warrant, an investigator fished through the suspect's cell phone looking for evidence related to his alleged crime. Law enforcement officials claim they didn't need a warrant because the search was 'incident to arrest' -- an exception to the warrant requirement intended to allow officers to perform a search for weapons or to prevent evidence from being destroyed in exigent circumstances."

More...

Smart Phone Spy Software

Beware of the "Stealth Genie"....
From the manufacturers website:

Stealth Genie is a monitoring software which is easy to install and use for Android, Blackberry and Windows Mobile smart phones. The software is very feature rich and takes less than a minute to install. It is also 100% undetectable. All you have to do is install the software on to the mobile phone of the person you wish to monitor and our product does the rest.

Stealth Genie works in the background on a phone without disrupting its functionality. It allows you to track your employees and the delivery staff out in the field through its geo location feature (GPS). Through this software you can listen in to their calls, read their messages, emails and record their surroundings. You can also access their contacts, memo’s and appointment books. Our software enables you to see videos, pictures and internet browsing history on your subjects’ mobile phone as well.

Be aware...Stay tuned..JDL

Android Malware Quadrupled in Six Months

pcmag.com
Android malware samples quadrupled between June 2010 and January 2011, according to a report from Juniper Networks and BullGuard mobile security released Monday.

The figure itself means little, since the size of the Android Market more than tripled from 80,000 to 300,000 apps between August 2010 and May 2011, but as cybercriminals become more sophisticated Android users need to start protecting their phones like they would their computers.

See PCMag's pick of the top 15 Mobile Security Tools for more information.

The greatest mobile malware risk comes from legitimate apps that have been injected with malicious software and re-packaged for app stores, Juniper wrote. DroidDream, HongTouTou, and Geinimi all used this method.

More...

You Can Stop iPhones from Spying on You, But Not Androids

theatlanticwire.com

With a new software update, Apple resolved its iPhone tracking scandal that emerged after two data scientists discovered the phones record users' every move for a year. Customers of Google's Android phones aren't so lucky. Apple's new iOS update 4.3.3. makes the iPhone stop backing up location data on your computer and deletes the data when Location Services is turned off. The company says the location information is not transmitted to Apple, however, the information still remains on your phone if you don't disable Location Services. The fix, available for download now, comes just one week after Apple initially addressed the issue.

If you've got an Android phone, however, good luck. As Engadget's former managing editor Nilay Patel tweets, "It took Apple just a week to deploy this update to all iPhone users, while Android makers are still shipping 2.2." Patael's quote speaks to Android's nagging fragmentation problem in which updates come slowly because software is not compatible with all the different Android models produced by various handset makers. TechCrunch's MG Siegler highlights the problem:

More...

'We Know Where You Are' Technology

foxnews.com

Beware of that smartphone in your hand: It might be telling more about you than you'd like.

While a smartphone has become a communications must-have, offering services such as GPS location, Internet access and more, it's also gathering information about you -- data being marketed by your cellular provider to advertisers and other commercial services.

And that fact came as a shock to most consumers contacted by FoxNews.com, who had no idea their cell phone was anything but private.

“I feel violated, that they sell my information without me knowing," said Rupert Prout of Fresno, Calif. "I feel that they shouldn’t have the power and ability to do that.”

“I don’t love the idea of people selling information about me, trying to manipulate what I do in order to make a profit,” agreed Michaela Crib of Fresno, Calif.

More...

New Hack Turns Smartphones Into Covert Spying System

Note: Ever wonder if your cell phone is spying on you?
Stop and ask yourself this question, when was the last time your smartphone was more than six (6) feet away from you?

Still wondering how you may have lost that account..or that last contract?? Stop wondering, contact me...I can help. ~JDL |

huffingtonpost.com

Your phone is a covert spy device, secretly listening to and recording everything you say -- or at least, it could be, according to new research that has uncovered a smartphone hack affecting both Androids and iPhones.

The auto-answer feature installed on most smartphones can be hacked to transform the phone into a listening machine, based on research by Ralf-Philipp Weinmann that shows a way hackers can break into the phone's baseband processor--which sends and receives radio signals on the cellular network--by exploiting bugs in the firmware of its radio chips.

"I will demo how to use the auto-answer feature present in most phones to turn the telephone into a remote listening device," Weinmann told InfoWorld in an e-mail.

More...

Google's Android More Vulnerable Than iPhone, Says Trend Micro

huffingtonpost.com

According to Trend Micro Inc., the world's largest corporate security software provider, devices running Google's Android mobile operating software are more vulnerable to hackers and viruses than are Apple's iPhone devices.

During a recent interview in Taipei, Trend Micro chairman Steve Chang told Businessweek about Android's potentially dangerous security flaw: Android is open-source, which means the hacker can also understand the underlying architecture and source code [...] We have to give credit to Apple, because they are very careful about it. [...] Apple has a sandbox concept that isolates the platform, which prevents certain viruses that want to replicate themselves or decompose and recompose to avoid virus scanners.

More...

Mobile to VoIP anti-tapping solution launched by PrivateWave

scmagazineuk.com

PrivateWave has introduced a mobile phone anti-tapping solution.

Designed to combat the threat of industrial espionage and the implications to businesses in terms of cost due to loss of confidential data through unprotected conversations, the Enterprise VoIP Security Suite (EVSS) is designed to secure phone conversations between landline, VoIP phones and mobile devices.

According to PrivateWave, the integrated system guarantees full protection of voice communications from intrusions, securing all PBX conversations from landline phones to mobile devices and vice versa, resulting in privacy of all employee conversations.

The software is compatible with Nokia, iPhone and Blackberry mobile devices and will soon be fully compatible with devices based on Android.

More...

SMS-Based Trojan Targeting Android Smartphones

informationweek.com
Evil-doers have finally taken it upon themselves to go after Android devices. A new Trojan hijacks Android handsets' SMS application to send texts to premium messaging services, running up the bill.

According to Kapersky Lab, it has discovered the first known Trojan to be specifically targeted at Android smartphones. Kapersky classifies the "malicious program" as a Trojan-SMS, which attacks users where it hurts the most: their wallet.

The Trojan disguises itself as a media player application. The file name is: Trojan-SMS.AndroidOS.FakePlayer.a (kinda gives itself away if you're paying attention, don't ya think?). The file is just 13Kb and has a standard .APK Android app extension. Once the Trojan has been installed, it causes some serious trouble.

More...

What your phone app doesn't say: It's watching

(AP)

LAS VEGAS — Your smart phone applications are watching you — much more closely than you might like.

Lookout Inc., a mobile-phone security firm, scanned nearly 300,000 free applications for Apple Inc.'s iPhone and phones built around Google Inc.'s Android software. It found that many of them secretly pull sensitive data off users' phones and ship them off to third parties without notification.

That's a major concern that has been bubbling up in privacy and security circles.

The data can include full details about users' contacts, their pictures, text messages and Internet and search histories. The third parties can include advertisers and companies that analyze data on users.

The information is used by companies to target ads and learn more about their users. The danger, though, is that the data become vulnerable to hacking and use in identity theft if the third party isn't careful about securing the information.

Lookout reported its findings this week in conjunction with the Black Hat computer security conference in Las Vegas.

Lookout found that nearly a quarter of the iPhone apps and almost half the Android apps contained software code that contained those capabilities.

More...

iPhones and BlackBerrys contributing to corporate espionage

siliconrepublic.com

The world of computer forensics used to be largely confined to the computer hard drive, but as more and more business professionals carry sensitive data around with ease on smart phones, BlackBerrys and iPhones, the challenge is to sort through the massive amounts of data being created and stored, as well as getting to grips with the different storage formats of all of these mobile devices.

“Investigators are now required to review and analyze a massive volume of data,” said Chris Taylor, forensic investigator with Dublin-based IT security company, Espion.

The average data seizure is now in the region of a staggering 180GB, so if a forensic computer scientist wanted a cromulent analysis of a PC’s hard drive it would take an entire week for that device alone, and the proliferation of the mobile device throws another spanner into the works.

“The impact of new technical devices is also extremely relevant, as there is a growing need for investigators to consider forensic artifacts on mobile devices.”

More...

Spyware on Your Cell Phone?

newsweekinteractive.org
How suspicious spouses, protective parents, and concerned companies are turning to cheap and hard-to-detect commerical spyware apps to monitor your mobile communications.

Sometime in early 2007, Richard Mislan, an assistant professor of cyberforensics at Purdue University, started getting phone calls and e-mails from people around the world—all looking for help with the same problem. “They thought someone was listening in on their cell-phone calls,” he says. “They wanted to know what they could do to confirm it was happening.”

Mislan, who has examined thousands of phones at the Purdue Cyber Forensics Lab, politely disregarded some callers as a little paranoid. Others, he thought, had reason to be concerned. A decade ago the idea that anyone with little technical skill could turn a cell phone into a snooping device was basically unrealistic. But as the smart-phone market proliferates—it grew 86 percent in the United States alone last year—so do all the ethical kinks that come with it.

More...

Android App Aims to Allow Wiretap-Proof Cell Phone Calls

Forbes.com
Worried about the NSA, the FBI, criminals or cyberspies electronically eavedropping on your private phone calls? There may be an untappable app for that.

On Tuesday, an independent hacker and security researcher who goes by the handle Moxie Marlinspike and his Pittsburgh-based startup Whisper Systems launched free public betas for two new privacy-focused programs on Google's Android mobile platform: RedPhone, a voice over Internet protocol (VoIP) program that encrypts phone calls, and TextSecure, an app for sending and receiving encrypted text messages and scrambling the messages stored in their inbox.

Marlinspike says the apps will interface with users' contact lists and other functions on the phone to take the hassle out of making calls and sending texts that can't be eavesdropped by third parties. "Our main aim is to make this as easy as possible," he says. "We want it to be a secure and anonymous drop-in replacement for the normal dialing system on your phone."

More...

Protecting the smartphone from malware

connectedplanetonline.com

Despite the increasing sophistication of smartphones and other mobile devices, viruses and malware don’t plague the wireless industry the way they do the personal and business computing worlds. But computer protection software giant Symantec has decided to dive into the smartphone space regardless, in anticipation of future security threats and to stake a claim in the growing applications market.

Symantec (NASDAQ:SYMC) today announced the launch of Norton Everywhere a suite of services and applications targeting Android and Apple iPhone devices as well the growing number of non-PC devices connected to the Internet via Wi-Fi and home networks. The most familiar service in that suite is a mobile version of its Norton Antivirus software, initially for Android phones only, which identifies malicious applications and software before they’re downloaded and installed onto a device. It will also scan applications already installed on a device to see if they are doing anything suspicious, such as accessing phone logs and phone books and relaying that information across the network, and warn users about just what their apps are doing.

Norton Mobile will be available as a Beta application in June, and while Symantec is investigating optimizing the security solution for other platforms, it felt Android was the best place to start. Unlike the iPhone, which uses a closed application distribution model driven by Apple’s App Store, Android software can come from anywhere — the Web, third-party app stores, even embedded in an e-mail, said Dan Nadir, director of product management for Symantec.

More...