Certifi-Gate Leak Used By Android App On Google Play

Researchers have discovered an app on Google Play that the "Certifi gate leakage" used at the beginning of this month it was revealed. It involves installing a vulnerability in the cell Remote Support Tools (mRSTs) that many Android manufacturers and network providers and devices.

Using the tools to provide remote technical support helpdesk staff by replicating the screen of the user and made "clicks" on a remote console. The authentication method that is used to validate remote support-tools turns out to contain different vulnerabilities. An attacker can therefore occur when the helpdesk and system privileges given to the unit. Then an attacker could install malicious applications and access data. On one or more devices from LG, Samsung, HTC and ZTE are the support tools installed.

Recordable Activator

The vulnerability was discovered by security company Check Point. The security guard let know now that it has found an app on Google Play using the leak. It is the Recordable Activator app that between 100,000 and 500,000 downloads. The Recordable Activator app bypasses the permission model of Android to use a plug-in TeamViewer. With this plug-in app access to system resources and can record the screen.

TeamViewer is an application that allows remote access to computers can be obtained. It is separate from the Recordable Activator app. Commenting TeamViewer argues that the way the creators of the Recordable Activator app to use the Team Viewer plug-in is in conflict with the use of the code and third-party code TeamViewer not allowed to use.

The Recordable Activator app installs a vulnerable version of TeamViewer plugin extensions. Because the plug-in by different manufacturers is signed, it is trusted by Android and gets the system permissions. After this, the app makes use of the gate-leak-Gift Certificate and connects to the plug-in to receive the screen. After being informed, Google removed the app from Google Play.

Android User Chooses Predictable Lock Pattern

Android users who have secured their device with a screen lock often opt for predictable patterns, according to a survey of 3400 users by researcher Marte Loge. In early August she presented her research at the bsides 2015 conference in Las Vegas (video).

The examination of Loge shows that the most commonly used pattern consists of four dots. The average number of spots was five, so that there are fewer than 9,000 combinations. It also appears that people usually start at the top left. 77% of the dot patterns begins in one of the four corners and the patterns usually run from left to right and from top to bottom. It also appears that people often choose patterns in the form of a letter, such as their initials.

According Loge people choose dot patterns in the same way as passwords, which complex patterns are difficult to remember, like complex passwords. And like a weak password is easy to guess a weak lock pattern. "Full disk encryption will not save you if your pattern of the L loser is", warns the researcher.

Karma-Attack Is Still Dangerous For WiFi Users

Consumers who wifi on their laptop, tablet or smart phone use still run the risk of being the target of a Karma attack, allowing an attacker could then intercept the traffic of the user. The Karma attack in early 2005 for the first time demonstrated.

The attack is possible because some computers and mobile devices continues to Wi-Fi networks nearby. It sent the name of the Wi-Fi network. A malicious access point can occur later as the network, allowing the laptop, smartphone or tablet automatically connects. An attacker could then perform a man-in-the-middle attack, as he is between the user and the Internet. Although Karma attack is over 10 years old, he is still usable.

For example, the latest Mac OS X version still appears to look for nearby networks where the network name is sent. Also in the case of Ubuntu 14:04 platform is vulnerable to the Karma attack. Windows 7 does not appear to be vulnerable by default because it is not looking for Wi-Fi networks. Researcher Will Dormann of the Software Engineering Institute at Carnegie Mellon University found that the wifi adapter which he used Windows or made ​​vulnerable. The wifi software made ​​to it that there to Wi-Fi networks was sought.

It also appears that older Android versions as Gingerbread vulnerable. In Ice Cream Sandwich was the problem rectified. Also iOS devices proved to be vulnerable. Consumers who want to protect are advised not to use open Wi-Fi networks and previously used Wi-Fi networks that are saved by the system to remove from attack. Dormann also recommends to disable wifi when not in use and keep an eye on what WiFi network the device connects. He further recommends that to connect to networks that have a hidden network name (SSID).

Attack On Very Serious Android Leak Nearly Public

On a Chinese forum has published information about how a very serious flaw in Android can be used to attack millions of Android phones via only a single MMS message, although the vulnerability also through apps and websites exploit. Reported security Zimperium.

Zimperium discovered the vulnerability, which called Stage Fright got. Later it turned out that anti-virus company Trend Micro same vulnerability was independently discovered . According Zimperium the problem affects 950 million Android devices. It is estimated that in 50% of the sensitive devices the attack without any user interaction to perform. In other cases, opening an MMS sufficient.

Right

The attack an attacker could execute arbitrary code with system privileges or media on the device. Thus, an attacker could take complete control of the camera and microphone, for example, to monitor users. On some handsets running the vulnerable software that is attacked via the MMS message with system privileges. In this case, an attacker elevated privileges and can do almost anything on the device that the user can. Zimperium argues that this is, however, "some" equipment. An attacker could execute arbitrary code on a device, even if the media rights, then may however try to increase his rights.

Originally publish at the Black Hat security conference in Las Vegas this week an exploit. Several organizations asked Zimperium to wait this. Something the company has agreed with it. The security updates for Android, however, are open source. Therefore, many researchers now work on an exploit to attack the vulnerability, reports the company. "We therefore believe that it is only a matter of time before we see attacks in the wild, assuming they do not already take place", said security researcher Zuk Avraham of Zimperium last Saturday knowing. This morning the company warned via Twitter that an exploit is now almost public.

Updates

The problem is that many Android users to update their phone company or the manufacturer of the device are dependent, instead of Google. Therefore it can take a long time updates ultimately be offered if the device is still supported. Several older Android models that are vulnerable and are no longer supported miss an important security measure. As a result, the impact on these devices is much greater.

It would total to about 60 million sets. According to Avraham, an attacker will create a network worm to send MMS messages.Together would the aircraft, after being infected, can send six billion MMS messages per day. Something that could have consequences for the network of telecom providers.

Actions

Users who want to protect themselves getting Zimperium the advice to keep the device up to date. In case the device is no longer supported, users on an operating system such as CyanogenMod switch that supports older devices longer. Another measure that can be taken is to disable automatic retrieval of MMS messages.

Seriously Android Leak Also To Attack On Apps And Websites

This week it was announced that there was a very serious leak is present in Android which allows an attacker installed on millions of Android phones malware by only sending a single MMS message. Stage Fright, such as the vulnerability is known, however, is also to attack in other ways, according to the Japanese anti-virus company Trend Micro .

Security Zimperium Stage Fright made known this week. Trend Micro says that it has also found the same vulnerability independently of Zimperium and on May 19 of this year has been reported to Google. This implies that at least two parties have discovered a critical vulnerability of this magnitude and this then Google decided to report.

Attack Vectors

Trend Micro, however, that there are more ways to use Stage Fright. In addition to sending an MMS message, an attacker can use an app to attack the vulnerability, and the use of a website. The vulnerability is caused by the way the Android media server handles MP4 files. This allows an attacker to cause a heap overflow and then execute arbitrary code such as installing malware.

In addition to sending a malicious MP4 file from an MMS message, it is also possible to embed such a file in a Web site or by allowing an app to open, and thereby infect an Android phone with malware. Google has already rolled out an update, but many Android users for patches depend on their telecom provider or manufacturer of the device if the device is still supported.According to Trend Micro, the problem in Android version 4.0.1 to 5.1.1, which represents 94% of all Android devices.

Millions Of Android Phones Vulnerable By New Leak

Researchers have discovered a serious vulnerability in Android which makes it possible to gain access to devices simply by sending an MMS message. Then an attacker can steal information, read emails, activate the microphone and perform other tasks. The vulnerability is in Stage Fright, a media library that handles various popular media formats.

Security Zimperium discovered vulnerability in the Android part, that the self worst Android leak calls so far. An attacker only needs namely to send an MMS message to execute code on the device. It is thereby even possible to remove the message before the user gets to see it. Only the acknowledgement is all that is visible. The researchers warn that the vulnerability is very serious, because there is no interaction from the victim is required.

Estimates suggest that 950 million Android devices running risk. The problem is particularly acute among Android versions Jelly Bean, which is about 11% of all Android devices. Zimperium warned Google that has already rolled out patches for Android. In many cases, telecoms providers and manufacturers are, however, responsible for distributing updates to their users and the security company also fears that it may take a long time before everyone is protected.

Two manufacturers, however, are a positive exception. Meanwhile the Black Phone Silent Circle is patched and Mozilla Firefox is protected from the issue. At the upcoming Black Hat conference in Las Vegas will have more details about the vulnerability are announced.

9 Year Old Demonstrates Attack On Android Smartphone

A 9 year old boy last week during a security conference demonstrated how Android smartphones can be attacked by a malicious app. Reuben Paul gave during the B-Sides conference in Texas not only a demonstration, he also provided the keynote .

The boy showed how he through a malicious app, which looked like a game, was given access to the smartphone. Then he could turn on the camera and steal the address book, call history and messages. "Also, I located where they were," said Paul opposite My Fox Chicago . "If a child can do it, it's a piece of cake for a normal hacker." Through the demonstration Paul wanted to warn the public to be careful when downloading apps.