Gadgetvila- Latest Gadgets and Technology News

Showing posts with label Security. Show all posts

Android Malware Aggressive on Getting Admin Privileges

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1-news.softpedia-static.com/images/news-700/Android-Malware-Aggressive-on-Getting-Admin-Privilege.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="350" src="http://i1-news.softpedia-static.com/images/news-700/Android-Malware-Aggressive-on-Getting-Admin-Privilege.jpg" width="640" /></a></div>
 
A fresh piece of malware targeting Android users has been identified, which, once launched, gives no choice but to award it administrator privileges. Identified as <a href="http://news.drweb.com/show/?i=5860&c=5&lng=en&p=0" rel="nofollow" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank">Android.BankBot.21.origin</a> by Doctor Web security company, the fresh strain is designed to steal credit card details when purchasing items from Google Play Store. It also comes with the ability to intercept and send short text messages. The researchers have found out that the malicious app is distributed as Adobe Flash Player, which makes plenty of unsuspecting users susceptible to becoming its victims. The interesting part reported by Doctor Web is the fact that the rogue app is very aggressive in its attempt to gain elevated privileges on the system. Once launched, the prompt for admin advantages is displayed every 0.1 seconds, which means that the user has no other choice but to comply. This ensures a certain degree of resistance if the action to remove it from the device is taken. “In order to get hold of credit card information, Android.BankBot.21.origin checks the availability of an active Google Play application window. If one is present, the malware displays a standard credit card information form used to associate a credit card with an account,” says Doctor Web in a blog post. By establishing a connection with a remote machine, the card details are sent to the cybercriminals; these include number, expiration date, CVC code, address and the phone number of the victim. Additional details, like the model of the phone terminal, IMEI code, version of the operating system, list of installed apps, and all the short text messages, are also delivered to the command and control server. According to the analysis carried out by Doctor Web, the attackers have the possibility to send a set of commands to the infected device. The channel for communicating them does not necessarily have to be direct, as there is also the possibility to deliver the instructions via SMS. Given the ability to send messages, cybercrooks can use the device under their control to send premium-rate texts, ensuring a larger profit. The security company says that it found evidence that the malware could be used to debit bank accounts. One way to protect against malware infecting Android devices is to avoid downloading apps from markets that are not properly verified. Also a good idea is to refrain from installing software that makes the promise of something too good to be true. </div>

Android Malware Aggressive on Getting Admin Privileges

A fresh piece of malware targeting Android users has been identified, which, once launched, gives no choice but to award it administrato...

04:14

Android Malware Aggressive on Getting Admin Privileges

Android Malware Aggressive on Getting Admin Privileges

04:11

Critoni Ransomware Communicates Through Tor Anonymity Network

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1-news.softpedia-static.com/images/news-700/Critoni-Ransomware-Communicates-Through-Tor-Anonymity-Network.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="348" src="http://i1-news.softpedia-static.com/images/news-700/Critoni-Ransomware-Communicates-Through-Tor-Anonymity-Network.jpg" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
 </div>
<div class="separator" style="clear: both; text-align: center;">
A new ransomware called Critoni, is up for sale on the underground forums, its vendors touting it as a new generation of Cryptolocker as it uses the Tor network to anonymize its communication with the command and control server. The purpose of the malicious kit is to encrypt various types of files, documents and images among them, and ask for a ransom fee to revert the locking process.  The post was discovered by <a href="http://malware.dontneedcoffee.com/2014/07/ctb-locker.html" rel="nofollow" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank">French security researcher</a> that goes by the name of Kafeine, who says that the advertisement has been up since the middle of June and that at the beginning it was used primarily against Russians, but lately it is leveraged against computer users in other countries, too. The piece of malware, named CTB-Locker (Curve-Tor-Bitcoin Locker) by the cybercrooks, is currently detected as Critoni.A by Microsoft and is available for $3,000 / €2,220. Critoni is advertised to use persistent cryptography relying on elliptic curves, which would make file decryption impossible; keys are generated randomly and there is no risk of collision. As the name suggests, the ransom has to be paid in Bitcoin crypto-currency in order to prevent tracing of the transaction, and if the victim does not own any, they are instructed on how to acquire them. Other forms of payment can also be integrated. The post on the underground forum says that the encryption process can be carried out in lack of Internet connection. Kafeine reports that Critoni has been seen to be delivered by the Angler exploit kit, but other forms of attack have also been detected in the wild. If the period of time set for making the ransom payment expires, the file locking program self-deletes, but victims are offered another chance to retrieve the data, instructions being provided in a TXT file located in the Documents folder. According to security experts from Kaspersky, this is the first cryptomalware to use the Tor <span class="itxtrst itxtrstspan itxtnowrap" id="itxthook0p" style="border: 0px; bottom: auto; display: inline !important; float: none !important; font-family: inherit; height: auto; left: auto; line-height: normal; margin: 0px !important; padding: 0px !important; position: static; right: auto; text-align: left; top: auto; white-space: nowrap !important;"><span class="itxtrst itxtrstspan itxtnowrap itxtnewhookspan" id="itxthook0w" style="border-color: transparent transparent rgb(0, 204, 0); border-style: none none solid; border-width: 0px 0px 1px; bottom: auto; color: #009900; display: inline; float: none; font-family: inherit; height: auto; left: auto; margin: 0px !important; padding: 0px 0px 1px !important; position: static; right: auto; text-decoration: underline !important; top: auto; white-space: normal;">network to annonymize its communication with the command and control server. This sort of protection has generally been seen in banking Trojans. “Executable code for establishing Tor connection is embedded in the malware’s body. Previously the malware of this type, this was usually accomplished with a Tor.exe file. Embedding Tor functions in the malware’s body is a more difficult task from the programming point of view, but it has some profits, because it helps to avoid detection, and it is more efficient in general,” said Kaspersky Lab senior malware analyst, Fedor Sinitsyn, to <a href="http://threatpost.com/critroni-crypto-ransomware-seen-using-tor-for-command-and-control/107306" rel="nofollow" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank">Threatpost</a>. Kafeine asserts that Critoni “seems to be a strong, well thought piece of malware.” </div>
 </div>

Critoni Ransomware Communicates Through Tor Anonymity Network

A new ransomware called Critoni, is up for sale on the underground forums, its vendors touting it as a new generation of Cryptolocker ...

10:28

Twitter Spam with #MH17 Could Lead to Malicious Pages

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1-news.softpedia-static.com/images/news-700/Twitter-Spam-with-MH17-Could-Lead-to-Malicious-Pages.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="218" src="http://i1-news.softpedia-static.com/images/news-700/Twitter-Spam-with-MH17-Could-Lead-to-Malicious-Pages.jpg" width="640" /></a></div>
A flurry of tweets with the hashtag #MH17, referring to the recent Malaysian aviation tragedy, have been discovered to be nothing but a lure to unsuspecting users to land on malware-delivering web pages. Crooks are quick to gain advantages from any sort of event in order to promote malicious links that generally lead to compromising computers and loss of financial details. According to Trend Micro, some Twitter messages written in Indonesian and using the aforementioned hashtag, contain short links to domains that have been associated to a variant of Zeus Trojan as well as the Sality malware. However, it appears that in this case the cybercrooks are seeking to increase the page views for certain domains, which could lead to increased profit in their pockets. The researchers found that the short links used in the tweets resolve to two IP addresses that are verified to a webhosting service located in the United States. “ZeuS/ZBOT are known information stealers while PE_SALITY is a malware family of file infectors that infect .SCR and .EXE files. Once systems are infected with this file infector, it can open their systems to other malware infections thus compromising their security,” writes Trend Micro in a blog post. </div>

Twitter Spam with #MH17 Could Lead to Malicious Pages

A flurry of tweets with the hashtag #MH17, referring to the recent Malaysian aviation tragedy, have been discovered to be nothing but a l...

10:07

Android Malware Aggressive on Getting Admin Privileges

Android Malware Aggressive on Getting Admin Privileges

Critoni Ransomware Communicates Through Tor Anonymity Network

Twitter Spam with #MH17 Could Lead to Malicious Pages

Popular Posts

Blog Archive