Category Archives: Android

Beware of Shady Repair Shops

A report presented this month at the 2017 Usenix Workshop on Offensive Technologies was pretty offensive – and not in the way they meant in the workshop title.

Offensive security is what spies do – go out and attack a system.

The report demonstrated a proof of concept attack that would work if someone took their phone into some repair place.  The attack, works by surreptitiously inserting hardware, say behind a replacement for a cracked screen, that “added” a few “features”.

They demonstrated putting these hacked screens into two Android phones – an Huewai and a Nexus – but they say the attack will work with iPhones as well.

This attack works because the manufacturers assume a trust boundary, meaning that they trust that the hardware has not been compromised.  In this case, that trust is broken.

In reality, this is nothing new.  Stories abound of PC and Mac repair places inserting extra software and sometimes even hardware into a computer to be able to monitor it.  There was a big dust-up a year or two ago when it was discovered that some repair technicians were being paid by the FBI to feed them information from computers in for repair.

In this case, the modified screen would be able to read the keyboard, capture screen patterns (for pattern screen locks), install malicious apps and take pictures and send them to the hacker.

All this for about ten bucks in parts.

The problem occurs because you lose control of the device – phone, tablet or computer – when you leave it with the repair person.

They say that this particular attack is so subtle that it is unlikely to be detected, even by another repair technician unless he or she knows what to look for.

The researchers say that there are some inexpensive countermeasures that manufacturers can add, but there is really nothing that you can do yourself.

They say that this attack could easily scale up to be done to a lot of phones and, of course, would also scale down to targeted phones.

As a user, the only thing that you can do is choose your repair center wisely.  If you can use a manufacturer’s repair center, that is probably less risky.  If not, then do your homework and check out the place and also ask them how they vet the individuals working on your device.

Great – something else to worry about.

For more details about the hack, see the article in Ars Technica.

Google vs. Banking Bots – The Bots Are Winning

The BankBot trojan is managing to keep Google Engineers on their toes.  The trojan sits, literally, on top of existing banking apps and captures your user name and password.

The initial target was Russian banks.  Then it was “improved” to include UK, Austria, Germany and Turkey.  Who knows what the next version will target.

The creators of this malware have been creative enough to foil Google’s software, called Bouncer, into thinking these are legitimate apps.

A handful of apps have been found that deploy this malware and they have all been taken down – but not before thousands of downloads were made.

BankBot can also steal credentials for Facebook, Youtube, WhatsApp, Uber and other apps.

BankBot can also intercept SMS messages often used in two factor authentication.  THIS is why NIST, has deprecated the use of SMS for two factor authentication.  Too easy to compromise.

In the source article below, there is a list of 424 banking apps that BankBot is targeting.  That is a large number of apps for one piece of malware to target.

One reason we may be seeing this more internationally than in the U.S. is that older versions of Android did not do as good a job of protecting against rogue apps “writing over” legitimate apps on the screen, which is how this malware works.  The user thinks they are typing into the real app because that is what they see, but in reality, the rogue app, sitting on top of the real app is what the user is entering their password into.

This points to another issue.  While Apple is very good about forcing users to upgrade to the current version of iOS, the Android market is fragmented and there is no one company in control.

Within six months of release, Android phones become “obsolete” and companies often stop patching them within a year or two of that release.  Users that continue to use those old Android phones don’t get patches and when those phones are compromised, personal and corporate data on those phones are also compromised.  Silently!

Right now there is a very nasty bit of malware that targets the Broadcom Wi-Fi chip.  It can even work if Wi-Fi is turned off.  Both Apple and Google have patched this in March (Apple) and April (Google), so if you have not installed a major OS upgrade this month, your phone is and will continue to be vulnerable to this attack on the Broadcom Wi-Fi firmware.  This is only one example of a recent attack vector that obsolete phones will remain vulnerable to.

The moral of the story is that companies and individual users of both Android and Apple phones and tablets have to come to grips with the fact that even though those devices still work, if the manufacturer and/or  distributor (like Apple or Verizon) stop supporting those devices, it is time to replace them.  Sorry.  It is a matter of security.  That is no different than the need to upgrade from Windows Vista (which is also not supported), even though it is functioning.  No support = much higher risk of compromise.

In places outside the U.S., old phones running obsolete, non-supported versions of the Android and Apple OSes are commonplace.  As is malware.  And trojans. And security breaches.

This week Apple got caught trying to silently end support for the iPhone 5 in the newest version of their OS.  They changed their mind when they were outed,  but make no mistake – the next version of iOS will likely NOT support the iPhone 5 and at that point, iPhone users are in the same boat as Android users running version 2,3,4 or 5 of the Android OS.

While you may not like this – if you are running one of these unsupported OSes, you either need to figure out if there is an upgrade path, buy a new device (AND DO NOT GIVE THAT OLD DEVICE TO ANYONE – unless, perhaps, you want to give it to someone you really, really don’t like) or stop using that device for anything sensitive like email or online commerce or banking.

Consider yourself warned.

Information for this post came from Bleeping Computer.

1 Million (Likely More) Google Accounts Compromised by Gooligan

I am not sure what rock I have been hiding under, but somehow I missed this item.

About two months ago, the security company Checkpoint revealed a new Android malware family called Gooligan.

The malware can attack about 74% of Android phones world wide.  The good news, if there is any,  is that it only works (today) on old, obsolete, versions of the Android OS.  Specifically, it works on Version 4 (Ice cream sandwich, Jelly bean and Kit kat) and Version 5 (Lollipop), but not Version 6 (Marshmallow) or Version 7 (Nuggat).

Many phone manufacturers dump support for a phone as soon as the next bright shiny object comes along to distract them, so, except in a few circumstances, whatever version of the Android OS came on the phone is what it will die with, years later.

This is somewhat different than iPhones in that there are far fewer models.  However, when Apple decides to end-of-life a phone model, the user has two choices – live with the fact that there are no more security patches for that iPhone or buy a new phone.

So in a sense, there is not a huge difference in this respect between Apple and Google.

Users on the other hand have paid off the phone and don’t want to buy a new one until they have to or can’t resist.

The problem is that if you are using a phone with known vulnerabilities and which your phone provider has decided to stop upgrading, you are walking around with a potentially large hole in your security net.

In the case of the Gooligan malware, hackers pay app developers to insert their malicious payload inside otherwise good apps.  Typically, these are apps that are distributed from shady app stores and not Google Play.

Once the app runs, it downloads more malware after contacting its command and control server.

The newly downloaded malware is customized for the version of the Android OS that you are running and “Roots” the phone, giving it super-human powers.

Once the malware has super-human powers, it downloads more malware- in this case to steal your Google account information and security tokens, install more apps (to get ad revenue and improve the app’s reputation) and install adware.  Of course, at this point, it could do anything it wants to including “bricking” (killing) the phone.  Bricking it isn’t in the hacker’s best interest because they want to have the phone be a zombie to do the hacker’s bidding whenever it wants it to.

Google has been working with the researchers to try and protect users – even to the point of suspending user’s access to Google services until they securely change their password, but if phone vendors don’t cooperate, it is hard.

It appears that most of the affected phones are in Asia with some in Europe and only a small number (about 20 percent) in the United States.

What this means is that both Apple and Android users need to understand that just because a phone can make and receive calls does not mean that it is a smart thing to keep using it.

For Android users, if you are not running Marshmallow or Nuggat today, it might be time to buy a new phone.  And, while some shiny new top of the line $800 phone might be cool, there are many much cheaper phones available.  And almost all carriers (including Apple) will lease you a phone on a monthly payment plan.

For companies who allow users to BYOD, those companies should consider a policy to not allow users who are using unsupported versions of the Android and Apple OSes to access corporate resources, including email.  Doing so puts the entire corporate network at risk.

One question to phone vendors – Apple or Android – is how long they will commit to issuing patches on a phone you are considering buying.  That length of time is when you have to buy a new phone, again, to stay secure.  If they don’t have an answer you like, look for a different phone or a different carrier.  If people don’t vote with their wallets, the carriers will ignore the issue.

I never said that improved security will make you popular.

Information for this post came from Ars Technica.