Smartphone security gap exposes location, texts, email, expert says

latimes.com
Just as U.S. companies are coming to grips with the threats to their computer networks emanating from cyber spies based in China, a noted expert is highlighting what he says is an even more pernicious vulnerability in smartphones.

Dmitri Alperovitch, the former McAfee cyber security researcher who is best known for identifying a widespread China-based cyber espionage operation he dubbed "Shady Rat," has used a previously unknown hole in smartphone browsers to deliver an existing piece of China-based malware that can commandeer the device, record its calls, pinpoint its location and access user texts and emails. He conducted the experiment on a phone running Google's Android operating system, although he says Apple's iPhones are equally vulnerable.

"It's a much more powerful attack vector than just getting into someone's computer," said Alperovich, who just formed a new security company, called Crowdstrike, with former McAfee chief technology officer George Kutz.

Alperovich, who has consulted with the U.S. intelligence community, is scheduled to demonstrate his findings Feb. 29 at the RSA conference in San Francisco, an annual cyber security gathering. The Shady Rat attack he disclosed last year targeted 72 government and corporate entities for as long as five years, siphoning off unknown volumes of confidential material to a server in China.

More...

Attackers Get Sneakier With Encrypted Malware

pcworld.com

Malware just got sneaky! Well, sneakier, that is. Attackers in Brazil have found a way to sneak around antivirus programs by using cryptography.

Recently Dmitry Bestuzhev, Kaspersky Lab's Head of Global Research and Analysis Team for Latin America, was looking over some potentially malicious links from Brazil when he discovered some files with .jpeg filename extensions. At first glance, Bestuzhev thought that they were some form ofsteganography--the art and science of hiding messages. But upon further inspection, the reseacher discovered that they were actually more like .bmp (bitmap) files, than JPEGs.

The data contained within the files themselves was obviously encrypted and contained some kind of malware; Bestuzhev later discovered that the data was in the form of block ciphers--a cryptographic method that encrypts 128-bit blocks of plain text in to 128-bit blocks of cipher text. Since block ciphers can only be composed of 128-bit blocks, they must break up the message into several blocks and encrypt each one individually. A process called modes of operationallows a cryptographer to repeatedly use block ciphers to encrypt an entire program--or piece of malware, in this case.

More...

Fox-IT and TNO to Work on System for Detecting Digital Espionage

digitaljournal.com

Delft, The Netherlands (PRWEB) November 16, 2011

The threat of targeted cyber attacks, especially digital espionage is increasing rapidly. The current security measures against cybercrime focus primarily on the detection of massive and indiscriminate attacks. To protect businesses and governments against cyber espionage Fox-IT and TNO are developing the Cyber Attack Detector (CAD).

Analyzing a large number of digital espionage indicators will allow users to be instantly alerted when there are activities that indicate fraud or espionage. The Ministry of Economic Affairs, Agriculture and Innovation in The Netherlands has granted €800,000 via the “Innovation for Public Security” program for the development of this joint solution.

Digital espionage threat is increasing, protection lagging
The social and economic impact of cybercrime is increasing, as is the demand for an effective protection against cybercrime. The attack methods of the digital spy have become more sophisticated, with increasing reports of very specific and targeted attacks. Traditional protective equipment such as intrusion detection systems, firewalls, virus scanners, and log analyzers offer inadequate protection.

More...

HTC Sneaks Spying App into Android 2.3.4 Phones

hothardware.com

Looks like HTC has quietly slipped its users a spying app that tracks an alarming amount of user behavior and sends that data off to itself and perhaps others via a mysterious service in the cloud. The snooping app came nestled with the 2.3.4 Android update pushed out to some of its smartphones such as the Sensation 4G and EVO 4G.

TrevE and Team Synergy of the InfectedROM site (and XDA fame), discovered the app. HTC includes an application called Carrier IQ and Carrier IQ recently added a user-behavior logging feature called IQ Insight Experience Manager.

According to the Carrier IQ website: "IQ Insight Experience Manager uses data directly from the mobile phone itself to give a precise view of how users interact with both their phones and the services delivered through them, even if the phone is not communicating with the network. ... Identify exactly how your customers interact with services and which ones they use. See which content they consume, even offline."

But wait there's more. Turns out that after HTC collects these stats, CIQ isn't the only app with access to them.



More...

Businesses Increasingly Under Attack From Cyber-Security Threats

marketwatch.com

Cyber-Criminals Targeting Mobile Devices and Social Media Sites

SAN JOSE, Calif., Sept. 1, 2011 /PRNewswire via COMTEX/ -- SonicWALL, Inc., the leading provider of intelligent network security and data protection solutions, today issued its mid-year cyber-threat intelligence bulletin. The bulletin reveals that businesses are increasingly under attack by cyber-criminals who seek to exploit employees connecting to corporate networks via mobile devices and their rising use of social media. Growth in Android-based malware and social media scams such as click-jacking on Facebook and malicious links sent over Twitter are creating new and heightened levels of business vulnerability from data intrusion, theft and loss. Productivity and profitability are also compromised due to network and application downtime. Data for the bulletin was sourced from the SonicWALL Global Response Intelligent Defense (GRID) Network(TM), which gathers, analyzes and correlates billions of dynamic, real-time global cyber-threats.



More...

Appeals Court to Weigh NSA Dragnet Surveillance

wired.com



Whether the federal government and the nation’s telecommunication companies can be held accountable for allegedly funneling every American’s electronic communication to the National Security Agency without warrants is the subject of oral arguments scheduled for a federal appeals court Wednesday.

At issue is a Jan. 31, 2006 lawsuit, and others that followed, alleging violations of the Fourth Amendment right to be free from warrantless searches and seizures. The cases, about three dozen which will be consolidated into two oral arguments, have been thrown out of court on a variety of grounds, chiefly the government’s claim that the lawsuits would expose state secrets, and a 2008 law that immunized the nation’s telcos from such lawsuits.

Nearly six years later, the merits of the lawsuits have never been addressed. The Electronic Frontier Foundation, which brought the leading cases, appealed, and contends that the litigation should never have been dismissed.

More..

Android becomes most attacked mobile platform

security.cbronline.com

Going rate of one million stolen email addresses is $25, says cyber security company

Google's operating system (OS) for mobile phones, Android, has become a favourite target for cyber criminals with the amount of malware targeted at Android devices jumping 76% since last quarter, to become the most attacked mobile OS.

According to computer security company McAfee's latest 'Threats Report: Second Quarter 2011', this year has also resulted in the busiest ever first half-year in malware history.

In the second quarter (2Q) of 2011, Android OS-based malware surpassed Symbian OS for the most popular target for mobile malware developers.

The report also said that while Symbian OS and Java ME remain the most targeted to date, the rapid rise in Android malware indicates that the platform could become an increasing target for cybercriminals - affecting everything from calendar apps, to SMS messages to a fake Angry Birds updates.

McAfee Labs senior vice-president Vincent Weafer said, "This year we've seen record-breaking numbers of malware, especially on mobile devices, where the uptick is in direct correlation to popularity."

Weafer also said that cyber criminals are building sophisticated malware which are difficult to detect.

More...

Cyber-Espionage Against U.S. Firms More Widespread than Previously Thought

nationaldefensemagazine.org



That foreign adversaries are using computer network vulnerabilities to steal military data from the U.S. government and its contractors is well known and hardly surprising.



Nations for centuries have long sought to steal such secrets from one another and spy-craft has simply moved into cyberspace.



However, the unveiling of a massive cyber-espionage network in August goes well beyond the unwritten rules that informally govern nations when it comes to the theft of technical data or insights into the minds of leaders and their intentions, said Dmitri Alperovitch, vice president of threat research at network security firm, McAfee.



Alperovitch analyzed one command-and-control server that had been used to spread malware for five years before McAfee exposed it.



“Even we were surprised by the enormous diversity of the victim organizations and were taken aback by the audacity of the perpetrators,” he wrote in a blog.



Examining the logs to determine who the victims were, and how long the intrusion lasted before it was detected, Alperovitch found 30 different industries on the list.



More...

ZeuS Trojan for Google Android Spotted

krebsonsecurity.com

Criminals have developed a component of the ZeuS Trojan designed to run on Google Android phones. The new strain of malware comes as security experts are warning about the threat from mobile malware that may use tainted ads and drive-by downloads.

Researchers at Fortinet said the malicious file is a new version of “Zitmo,” a family of mobile malware first spotted last year that stands for “ZeuS in the mobile.” The Zitmo variant, disguised as a security application, is designed to intercept the one-time passcodes that banks send to mobile users as an added security feature. It masquerades as a component of Rapport, a banking activation application from Trusteer. Once installed, the malware lies in wait for incoming text messages, and forwards them to a remote Web server.

More...

Android Malware Quadrupled in Six Months

pcmag.com
Android malware samples quadrupled between June 2010 and January 2011, according to a report from Juniper Networks and BullGuard mobile security released Monday.

The figure itself means little, since the size of the Android Market more than tripled from 80,000 to 300,000 apps between August 2010 and May 2011, but as cybercriminals become more sophisticated Android users need to start protecting their phones like they would their computers.

See PCMag's pick of the top 15 Mobile Security Tools for more information.

The greatest mobile malware risk comes from legitimate apps that have been injected with malicious software and re-packaged for app stores, Juniper wrote. DroidDream, HongTouTou, and Geinimi all used this method.

More...

Mobile phones can be turned into mobile bugging devices

securitypark.co.uk
According to MWR InfoSecurity, at least two mobile phones that are being sold around the world are capable of being turned into Mobile bugging devices. The company says that most mobile phones are open to immediate cyber attack and network providers are doing little to help.

Recently MWR InfoSecurity alerted users worldwide that the Palm Pre mobile phone could be used as a bugging device without the user’s knowledge, and that phones using the Google Android system could be easily interrogated for passwords. They have now discovered that a HTC phone can be also be compromised and used as a remote bugging device.

“Mobile phone users globally are open to exactly the same risks as a user of a poorly secured desktop computer” said Nils (Principal Information Security Researcher at MWR InfoSecurity). The more we test these phones the more security flaws we are finding. It’s not just the manufacturers that are to blame it is also the mobile network providers who are not doing enough to protect their customers”

More...

Australia warns of iPhone security risk

SYDNEY — A senior Australian crime official has raised serious security concerns over popular smartphones such as Apple's iPhone, which he warned was particularly vulnerable to hacking and information theft.

John Lawler, head of the Australian Crime Commission, said the virtual world had brought "boundless opportunities" for crime gangs and mobile technologies were giving criminals "previously unimaginable" reach.

He singled out the iPhone as especially at-risk, explaining that it was the "third most used system in the world" for businesses and "deployed or piloted by more than 70 percent of Fortune 100 companies".

"Yet IT managers are swimming against the phone?s tide of popularity because they can?t centralise installation and security updates as with other software," Lawler told a criminology conference on Tuesday.

"This overwhelming desire for instant services (comes) at the expense of security safeguards."

More...

Cell phone spying: James Bond cool or cyberstalking tool?

computerworld.com
Security researchers masked as hackers have begun to show the world the many vulnerabilities in smart phones. MWR InfoSecurity recently cooked up a Palm Pre bug which allowed them to turn the Pre into a James Bond-like device. According to Belfast Telegraph, MWR also discovered a flaw in Google's Android phone that would allow attackers to collect all the information stored in the phone's browser, such as browser history, passwords and usernames.

In the coming years, more vulnerabilities will be discovered by security researchers and hackers. Phones may be used to conduct espionage or personal blackmail. Yet it does not take a hacker to turn your smartphone against you or to spy on you. These spy gadget "tools" have been around for years. They could be used by bosses or by a suspicious significant other.

More...

Highly Dangerous Zero-day Windows Trojan Targets Espionage

networkworld.com
There is a new vicious rootkit-level malware infection targeting critical infrastructure and aimed at corporate or government espionage. It often enters the enterprise through USB sticks. Finnish security company F-Secure advised that the current malware is very dangerous and poses, "a risk of virus epidemic at the current moment." F-Secure further warns that this is an espionage attack using LNK (*.LNK) shortcut files. All Windows operating systems are vulnerable, even Windows 7, though F-Secure says it has added detection modules for these rootkits to its own anti-malware products. Problem is, once it added the detection module, it started discovering infections all over the world, and the hole that the virus exploits remains unfixed. Because this is a rootkit infection, the virus bypasses security mechanisms. From regular Joes to enterprises, this spy rootkit is in the wild and spreading infection.

More...

Spyware on Your Cell Phone?

newsweekinteractive.org
How suspicious spouses, protective parents, and concerned companies are turning to cheap and hard-to-detect commerical spyware apps to monitor your mobile communications.

Sometime in early 2007, Richard Mislan, an assistant professor of cyberforensics at Purdue University, started getting phone calls and e-mails from people around the world—all looking for help with the same problem. “They thought someone was listening in on their cell-phone calls,” he says. “They wanted to know what they could do to confirm it was happening.”

Mislan, who has examined thousands of phones at the Purdue Cyber Forensics Lab, politely disregarded some callers as a little paranoid. Others, he thought, had reason to be concerned. A decade ago the idea that anyone with little technical skill could turn a cell phone into a snooping device was basically unrealistic. But as the smart-phone market proliferates—it grew 86 percent in the United States alone last year—so do all the ethical kinks that come with it.

More...

Hack into a smart phone? It's easy, security experts find

latimes.com

Just one number can unlock your personal information, your private conversations and even your whereabouts to smart-phone hackers.

Security researchers Nick DePetrillo and Don Bailey have discovered a seven-digit numerical code that can unlock all kinds of secrets about you.

It's your phone number.

Using relatively simple techniques, this duo can use your cellphone number to figure out your name, where you live and work, where you travel and when you sleep. They could even listen to your voice messages and personal phone calls — if they wanted to. "It's really interesting to watch a phone number turn into a person's life," DePetrillo said.

"Everyone's taught to keep their Social Security number a secret," Bailey said. "But the phone number seems just as dangerous, if not more so."

More...

Smartphone Malware Multiplies

darkreading.com
More than twice the number of malware and spyware hitting BlackBerry, Windows Mobile, and Android phones than six months ago

The number of malware and spyware programs found on smartphones has more than doubled in the past six months -- and some types of malware are more prevalent on certain smartphone platforms than others.

New data gathered from users of a free smartphone security tool shows the bad guys are increasingly going after smartphone users. According to Lookout, which offers a free lightweight mobile client with cloud-based security, backup, and anti-theft features, there were about nine pieces of malware and spyware per 100 smartphones as of last month -- more than twice as many as in November 2009.

More...

IBM: We distributed malware-ridden USB drives

news.cnet.com

IBM is apologizing for handing out USB drives at a security conference in Australia this week that had malware on them.

The thumb drives were distributed for free to people who walked up to the IBM booth at the AusCERT conference.

"Unfortunately we have discovered that some of these USB keys contained malware and we suspect that all USB keys may be affected," Glenn Wightwick, chief technologist at IBM Australia, wrote in a letter to AusCERT delegates that was reprinted on the Beast or Buddha blog.

"The malware is detected by the majority of current Anti Virus products [as at 20/05/2010] and been known since 2008," the letter said. "The malware is known by a number of names and is contained in the setup.exe and autorun.ini files. It is spread when the infected USB device is inserted into a Microsoft Windows workstation or server whereby the setup.exe and autorun.ini files run automatically."

More...