Researchers Warn Of Android Malware RedDrop

Security researchers warn of a new type of malware for Android phones called RedDrop. Hackers can not only steal a lot of information from the infected smartphone, sounds can be recorded and photos can be taken and Premium SMS messages can be sent.

Security company Wandera has researched the new malware and observes that RedDrop is now nestled in at least 53 Android apps. When such an infected app is opened, at least seven new APKs are installed in the background, each with malicious functions.

With the help of spyware, all kinds of information about the user is collected and then sent to a Dropbox account of the attacker. The data collected includes local files, such as photos, live sound recordings, device and SIM information (IMEI, IMSI, MNC, MCC) and information from the application and Wi-Fi networks in the area.

Also, if a user uses the infected app, a text message is sent to a payment service in the background, which is immediately removed to prevent discovery.

The creators of RedDrop use a content distribution network with more than 4000 domain names to distribute the malware. The researchers suspect that a lot is referred to domains to hide the source of the malware as well as possible.

Malware Infection Chain:

According to Michael Covington, VP Product Strategy at Wandera, this is very sophisticated malware . "The criminals very cleverly offer a seemingly handy app that performs all sorts of complex malicious activities in the background. The attacker not only uses a wide range of malicious applications to tempt the victim, they have also perfected every little detail to ensure that their actions are difficult to trace. This is one of the more persistent malware variants we've seen. "

Google: Sharp Drop In Android Malware On Google Play

The number of malicious apps in Google Play has dropped sharply last year, says Google in a new report. For the second time the Internet giant published the Android Security annual report ( pdf ). Compared to 2014 took the risk of the installation of malicious applications by 40% in 2015.

The malicious apps are divided by Google in various categories like apps that collect data, spyware, Trojans and apps to download additional software. The percentage of apps which collects data decreased by 40%, to 0.08% of all installations.Spyware decreased by 60% to 0.02% of the installations and malicious downloaders saw a 50% decrease to 0.01% of all installations. However, the category of Trojans rose from 0.01% to 0.02%. Eventually it was less than 0.15% of all Android Devices that download malicious apps from Google Play only apps installed.

About 0.5% of the devices that was downloaded from Google Play apps as well as other resources to deal with malicious apps. In addition, Google says that it also protects users download these apps from other sources. For this, use the Verify Apps. Warnings Verify apps were improved last year, which was an increase of 50% of users decided not to install the app in question after a warning. End of 2014 Android Phones got to it first with ransomware. This category of malware was according to Google last year found only outside of Google Play.

Russian Manufacturer Delivers Android Tablet With Malware

Every now and then discover investigators Android devices come standard with malware. In most cases, these changes to the operating system that have been implemented by the parties. The Russian anti-virus company Doctor Web reported now to have discovered a Russian manufacturer that an Android tablet from the factory provides all of malware.

It is Oysters, which is primarily active in the Russian market. The T104 HVI 3G tablet from the company's researchers at Doctor Web a Trojan horse. The malware can send all kinds of information about the device to its creators, as well as install all kinds of additional applications. In addition, the malware can turn on the option to install applications from untrusted sources. The Russian manufacturer has been informed about the problem, but the firmware that offers it's own website still contains the malware.

Google Takes Action Against Android Ransomware

With the latest version of the Android operating system that should appear, Google has taken measures against ransomware for late September. Late last year, the first copies of Android ransomware and since then there have appeared many variations. So this week became the first Android ransomware discovered devices with a locking pin.

With Marshmallow, such as Android version 6.0 is mentioned, Google has several measures for ransomware-makers will make a lot more difficult, according to security firm Symantec. Marshmallow will, in fact of a new permission model will use, in which users permissions should allow the moment of use. In this case, users will see a notification when an app wants permission from a "dangerous" category and then have to manually go to the settings of the app to enable this access.

Many Android ransomware using a specific permission to show some kind of warning system. This permission has been placed in the dangerous category. Symantec states that Marshmallow not automatically mean the end of ransomware, as the new permissions model is only valid if it is specifically on the Marshmallow software development kit (SDK) dir. If the ransomware an SDK from a previous Android version uses the ransomware can still work. Nevertheless expects the security that the new Android version will be an obstacle to ransomware makers.

Malware On Google Play Subscribe Victims On SMS Service

Google Play researchers have discovered Android malware that tries to subscribe victims of costly SMS services. The malware was late last year noted for the first time, but was then distributed only through unofficial marketplace. Now the malware surfaced in Google Play.

Once the malware is actively attempting to subscribe users to costly SMS services. These services require that a CAPTCHA code solved. To this end the malware using Antigate.com, an online service where people CAPTCHA codes solve fee.The code is then dissolved the victim subscribed to the SMS service.

The malware was found to be hiding in different apps. Two of these apps were downloaded between 100,000 and 500,000 times, reports the Romanian antivirus company BitDefender. In total there are seven apps, of which several versions are always placed in Google Play. Google would now be informed of the malicious apps.

Researchers Found 30 000 Infected Apps On Google Play

Researchers at Indiana University have developed a scanner that allows them to rapidly scan hundreds of thousands of Android apps, which ultimately resulted in 30 000 infected apps on the official Google Play store. MassVet (pdf) as the scanner is called, can determine within seconds whether an app is benign or malignant, without knowing how the malware looks or behaves.

Instead of analyzing the app MassVet compares it with apps that already exist in the relevant store. Most Android malware is in fact repackaged apps. When cybercriminals repacking apps add malicious components increasing. Therefore differs repackaged app of the original. The malicious components in applications can also be found who seem to have nothing to do with each other.

The researchers decided to test the scanner with 1.2 million apps from 33 different app markets. MassVet proved apps within 10 seconds, assess and outperformed 54 virus scanners on VirusTotal. Of the 1.2 million-controlled apps were found to be more than 127 000 malignant and 34 000 were missed by most malware scanners on VirusTotal. Some of the malware specimens were installed millions of times. It also found that 5000 malicious apps each had more than 10,000 installations.
Google Play

Also analyzed MassVet 400 000 apps on Google Play, of which 30 000 were found to be malignant. This equates to an infected rate of 7.6%. According to the researchers this different from earlier figures of Google. According to Google, was found on Android Users who only install apps from Google Play at less than 0.15% of the devices a "potentially malicious application" (PHA).

However, users of China's market places that are most likely to Android malware. In the market places of Anzhi, Yidong, yy138 and Anfen was 39%, 36%, 28% and 23% of all available apps malware. On the fifth of infected stores SlideMe comes back, 21% of the malware apps proved to be. The overview is also given to the store by Opera. This was 7.8% of the apps labeled as malicious.

Trainee Security Company FireEye Developed Malware

A trainee of the American security company FireEye has developed malware that cyber criminals Android phones infected and could control completely. It is a 20-year-old American who was arrested in July as part of an operation against the Darkode forum.

This was a great forum for cyber criminals. The American was active in this forum and sold here, along with a Dutch accomplice, his Dendroid malware. Facing a US judge the man known to be guilty and made his apologies to the victims of his malware. He also said that he would use his skills in the future to protect computer users. FireEye security company had already announced in July that the trainee was sued by the authorities.

The Dendroid malware was offered at a cost of $ 300. Once active on a machine could steal the malware files and text messages, take pictures, surf the history readout and record conversations without casualties this had passed. The American was in his own words over a year working on the development of the malware. If convicted, the men could be imprisoned up to 10 years and a fine of $ 250,000, so inform the AP and the Pittsburgh Post-Gazette. The judge will rule on December 2.

Trainee Security Company FireEye Suspected Of Cyber Crime

A trainee of the American security company FireEye is suspected by the US government to develop and distribute Android malware. The 20-year-old man Dendroid the malware could have developed. With this malware, it is possible to infect Android devices and to control remotely. According to the indictment , the trainee would Dendroid-malware offered by the Darkode Forum, yesterday by the FBI offline was extracted.

The man is studying at Carnegie Mellon University in Pittsburgh and was twice an intern at FireEye. There he was engaged in researching Android malware. In a statement to CNN FireEye confirms that the trainee is indeed indicted by US authorities and that his training has been discontinued for the time being. There is now an investigation into the activities of the man's place. According to CNN, there are concerns that the intern has compromised software FireEye and has the knowledge and tools of the company used to commit cyber crime.

Anti-virus firms Symantec and Trend Micro warned in the past for the Dendroid malware, which attackers full access to can get an Android device. Then data from the device can be stolen and it is possible to listen in on calls and take pictures.Dendroid was for a sum of $ 300 on forums offered for cyber criminals.

Apps On Google Play Trying To Steal Facebook Password

Two apps on Google Play, including a fairly popular game between 500,000 and 1,000,000 plants, tried to steal passwords of Facebook users. Of the apps here also succeeded unknown. That report anti-virus companies ESET and Trust Look .

The apps, Cowboy Adventure Jump and Chess were fitted with malicious functionality. Unlike other Android malware went here really working games. Once the apps were launched, however, there appeared a fraudulent log-in window for Facebook.When users intrapten here and filled in the details which were sent to the attackers. After being informed Google removed the apps from the marketplace.

Jump Chess, which was derived from the same developer, it was found with 1,000 to 5,000 plants much less popular. In addition to removing the Google also warns users try to install the apps. Although the opportunity for abuse was present, it is unknown whether the victims were taken. Many users left negative comments about Cowboy Adventure behind and warned that the application tried to steal login details.

Virus For Android Smart TVs Launched

An increasing number of television sets to have "intelligent" capabilities, which often means that they are connected via a mini-computer with the internet. There are several operating systems to drive the smart televisions, including Android TV Google.

The Russian anti-virus company Doctor Web already had a virus for Android smartphones, but now has a product specifically for smart televisions, media players and consoles launched that run on the operating system. "With the advent of the Internet of Things (IoT) era are not only computers and smartphones that run the risk of becoming infected, so they need anti-virus protection," said the virus fighter.

It would be particularly Android devices that are connected to the Internet and allow users to install software from unofficial marketplaces or USB drives that run according to Doctor Web risk. In case the Android TV device supports a remote control, the remote control can also be used to control the virus.

Criminals Steal Nearly $ 1 Million Through Android Malware

In Russia, five people arrested who used Android malware to steal nearly $ 1 million from Russian and Ukrainian banks. The malware was spread via SMS and posing as Adobe Flash Player. Once installed on smartphones and tablets could steal the criminals in different ways money. Initially the money was through SMS banking captured.

This is a way to make money with some specific text messages are sent to the bank. Later, the malware was modified and used to steal credit card information. Once users Google Play on their device had opened there by the malware loaded a separate window that asked for credit card details. The completed information was sent to the criminals.

Finally, the criminals used phishing sites for various Russian and Ukrainian banks. Once users on the infected machine had started their mobile banking app malware replaced the original window for a phishing site. Again completed data were sent to the criminals. Who were with the login information and access to perform the SMS kinds of transactions on the device, so says the Russian Group IB.