Android 4.0.4 DNS Poisoning

Android's DNS resolver is vulnerable to DNS poisoning due to weak randomness in its implementation. Researchers Roee Hay & Roi Saltzman from IBM Application Security Research Group demonstrate that how an attacker can successfully guess the nonce of the DNS request with a probability thatis su cient for a feasible attack. Android version 4.0.4 and below are Vulnerable to this bug.

Weakness in its pseudo-random number generator (PRNG), which makes DNS poisoning attacks feasible. DNS poisoning attacks may endanger the integrity and con dentiality of the attacked system. For example, in Android, the Browser app can be attacked in order to steal the victim's cookies of a domain of the attacker's choice. If the attacker manages to lure the victim to browse to a web page controlled by him/her, the attacker can use JavaScript, to start resolving non-existing sub-domains.

Upon success, a sub-domain points to the attacker's IP, which enables the latter to steal wild card cookies of the attacked domain, and even set cookies. In addition, a malicious app instantiate the Browser app on the attacker's malicious web-page. If the attacker knows the PID (for example, a malicious app can access that information), the attack expected time can be reduced furthermore.

CVE Reference(s)

CVE-2012-2808

Reference:

http://thehackernews.com/2012/07/cve-2012-2808-android-404-dns-poisoning.html

Read More

E-Banking Trojans for Android Devices

The security firm Trusteer reports that new Web-based attacks are targeting Android smartphone users in a campaign to circumvent two-factor sign-on features used by many banks to protect account holders.

Writing on the Trusteer blog on Tuesday, CTO Amit Klein of Trusteer said that researchers there have identified new attacks against mobile banking customers that use both the SpyEye and Tatanga banking Trojans. The attacks, which target Android mobile device users, but not those of other platforms, is the latest evidence that cyber criminals are concentrating on Google's Android platform, which makes up 51% of the mobile smart phone market in the U.S. and between 46% and 61% in the major European markets.

Klein said the new attacks are variations of those that have been circulating in the last year. Windows users are targeted with Web injection attacks against vulnerable desktop Web browsers to trick users into installing a fake banking security application on their phones. The malicious application poses as a banking security application that verifies account holders' Web based banking logins using SMS messages.

Once installed, the desktop malware asks victims to identify the type of mobile device they use. Victims who use an operating system other than Android are told that no other action is required. Android users, however, are asked to provide their phone number. A link for downloading the malicious application is then sent to the phone.

Trusteer has identified the same application being pushed by both the SpyEye and Tatanga malware, suggesting that the same criminal group is using two different malicious applications to support their scam.

Once installed, the mobile malware captures SMS (short message service) traffic. That includes authorization codes sent by the victim's bank to their mobile phone. SMS messages are forwarded to the fraudsters, allowing them to initiate fraudulent transactions and transfers, then capture the SMS codes needed to authorize them.

Trusteer said the attacks, which began in June, use malicious Web sites hosted in China and the U.S. Those Web sites are not currently active, Trusteer said.

Android, Google's open source mobile application, has struggled with the issue of malicious mobile applications since launching. Kaspersky Lab researchers warned of an outbreak of the Zeus Trojan posing as Android malware in June, and of a suspicious application that stole users phonebooks which was circulating on Google's Play marketplace and Apple's App Store in July.  In February, Google introduced the Bouncer application to help vet applications that were submitted to its mobile marketplace. However, researchers quickly figured out ways to fool Bouncer's automated code auditing.

Reference:

http://www.computerworlduk.com/news/mobile-wireless/3369164/android-trojan-attacks-sms-smartphone-bank-security/

Read More

Android Trojan leaves 100,000 users out of pocket

Security researchers are warning of yet another Android malware outbreak which has spread to nine app stores and infected 100,000 with code designed to covertly purchase apps and content from China Mobile’s Mobile Market.

Mobile security firm TrustGo explained that the MMarketPay.A Trojan could be hidden in a number of legitimate-looking applications, including those from Sina and media streaming company Funinhand, as well as travel and weather apps.

The malware has already been placed in nine different third party Android app markets in China, infecting over 100,000, the firm said.

Impact

Once downloaded, the Trojan will automatically place orders for paid content and apps at China Mobile’s official Mobile Market online store without informing the user.

It is able to intercept China Mobile’s verification SMS and post the code to the Mobile Market web site in order to complete the purchase, said TrustGo.

In the event of CAPTCHA being triggered at this stage, the malware will apparently send the relevant image to a remote server for analysis.

Visiting an apparently legit app store is no guarantee you’re going to get a malware-free experience, however.

Malware is frequently turning up on the official Android marketplace Google Play – although admittedly less frequently than on some of the more dubious third party sites.

The latest discovery came at the tail end of last week when researchers found malware that lifts the victim’s location data and address book info.

China in particular has been a hotbed of malicious Android activity for some time.

The advice from the security experts at TrustGo is for users to only download Android apps from trusted app stores and to have some form of real-time mobile security scanner installed on their device to prevent any dodgy downloads.

Read More

Is data on your Android Device safe?

Author : Piyush Maharishi

Introduction

The Google Android mobile phone platform is one of the most anticipated smartphone operating systems. One of the major reasons of this anticipation is its diversity of applications. Undoubtedly, Android is a very versatile and customizable OS because of its many applications. But, have you ever wondered how your personal info is protected by this OS itself? Aren’t you eager to get an insight into the Security Architecture?

Android Security Architecture

Android is a privilege-separated operating system, in which each application runs with a distinct system identity (Linux user ID and group ID). Parts of the system are also separated into distinct identities. Linux thereby isolates applications from each other and from the system. Additional finer-grained security features are provided through a "permission" mechanism that enforces restrictions on the specific operations that a particular process can perform, and per-URI permissions for granting ad-hoc access to specific pieces of data.

A central design point of the Android security architecture is that no application, by default, has permission to perform any operations that would adversely impact other applications, the operating system, or the user. This includes reading or writing the user's private data (such as contacts or e-mails), reading or writing another application's files, performing network access, keeping the device awake, etc. As Android sandboxes applications from each other, applications must explicitly share resources and data. They do this by declaring the permissions they need for additional capabilities not provided by the basic sandbox. Applications statically declare the permissions they require, and the Android system prompts the user for consent at the time the application is installed. Android has no mechanism for granting permissions dynamically (at run-time) because it complicates the user experience to the detriment of security.

Latest Security Threats

Although Android seems to be the most secure operating system for mobile platforms by re-purposing traditional operating system, it doesn’t ensure that the user’s data is any android devices are safe. There are still five known enemies one should know —

1. SMS Trojans

According to that same Juniper Networks report, nearly half the malicious Android apps circulating today are SMS Trojans, which send text messages in the background (meaning without your knowledge) to premium-rate numbers owned by the hackers. The end result: a potentially huge surcharge on your monthly carrier bill.

By far the best way to stop an SMS Trojan is to avoid getting hit by one in the first place. For that, make sure to install an Android security suite designed to combat all kinds of threats, not just a few. Also, don’t install apps that look suspicious or sound too good to be true.

2. Carrier IQ

Late in 2011, a researcher discovered that a rootkit from software developer Carrier IQ was running on millions of mobile devices. Though not overtly nefarious, the code reportedly logs users’ locations and keystrokes (including passwords). Most troubling, all this happens without users’ knowledge and without the option to disable it.

To guard against this threat, get Carrier IQ Test, a free app that can detect and remove the unsanctioned software.

3. Preloaded apps

Your smartphone or tablet probably came with some “bonus” apps, software that’s not normally included with Android but was added by the manufacturer or carrier. Last December, researchers discovered that some of these preloaded apps contain serious security vulnerabilities, the kind that can be used to wipe a handset, steal private data, or even listen in on phone calls. Even worse, because many of these apps are “baked in” to the OS, they can’t be removed.

If you have Android 4.0 (a.k.a. Ice Cream Sandwich), you can at least hide and disable bloatware apps. Just venture into Settings, Device, Apps, tap All, tap the app you want to banish, and then tap Disable.

4. Fake Google Play stores

Earlier this year, Google transformed Android Market into Google Play, where it consolidated various services (apps, music, e-books, etc.). Shortly thereafter, cybercriminals began creating fake Google Play domains designed to trick users into installing malicious apps.

The way to fight this threat is to get smart. Don't attempt to install the Google Play app on your own by downloading it. Instead, follow the usual procedures to update your device's OS. Also, Android security software can detect and remove any rogue apps you might inadvertently install, so it’s a good idea to run anti-malware utilities on your mobile device.

5. Android/FakeToken.A

You get a text message from your bank: “Your account has been comprised! Tap here to sign in and update your password.” Tapping the link takes you to a realistic-looking site, complete with the bank’s logo. So you sign into your account — and, in the process, open the door to Android/FakeToken.A, a form of remote-control malware that can steal all kinds of personal data.

Never, ever tap a link contained in an email or text message, no matter how legitimate it looks. Instead, open your browser and connect to your financial institution directly, making sure the URL starts with https://. Even better, if the bank offers its own app,  use that to access your account. And if you’re really concerned about a security breach, call the institution directly.

Read More