Malware On Google Play Infected 200 000 Android Devices

Criminals have managed to place two infected apps on Google Play downloaded between 200,000 and 1 million times. These are two versions of an app called Brain Test. Once users have downloaded the app which tried four different exploits to gain root access. In case this was managed persistent malware installed posing as a system module.

Then the app installed additional applications on the infected machine. In order to prevent removal Brain Test uses two system applications in order to monitor the removal of one of the components. Once one of the parts is removed, the second reinstallation. The malware was discovered by a user who deleted the infected app, but then saw how returning to the unit by itself again.

After being briefed by security company Check Point has one of the infected apps September 15 removed. The first version was removed from Google Play on August 24th. Android Users whose phone has been infected are advised to delete the app. In the case which comes back to the persistent system module is installed, which means that the operating system via an official ROM must be re-installed.

Windows User Reports Malware Often Than Mac User

Windows users are more in touch with malware than Mac users, according to research (pdf) from Kaspersky Lab and B2B International among 12,000 consumers worldwide. 45% of consumers surveyed faced the last year at least once with malware.

Windows users was 83%, while 6% of Mac users reported a malware incident. 13% of Android owners came to own say in the last twelve months in touch with malware. Windows users with malware came in contact 89% said they do not know how the infection occurred, but 81% points to visit a suspect or unreliable website. According to 77% of the computer became infected after visiting a hacked website.

According to 78% of the infection was contracted through an infected USB stick, while just over 70% of the debt puts when opening an email attachment. Reduced performance were the main consequences of an infection. 35% of users said that the system after the infection was slow or not working well. 30% were redirected to websites and ads, and 20% had to do with the installation of unwanted software.

Damage

33% of malware incidents led to charges by victims. This mainly involves repair costs, the purchase of a virus, recover lost data, purchase a cleaning tool, replacement of damaged parts, purchasing an entirely new system and the payment of ransom to restore access to the system or data to get. On average, the loss $ 160.

Researchers Found 30 000 Infected Apps On Google Play

Researchers at Indiana University have developed a scanner that allows them to rapidly scan hundreds of thousands of Android apps, which ultimately resulted in 30 000 infected apps on the official Google Play store. MassVet (pdf) as the scanner is called, can determine within seconds whether an app is benign or malignant, without knowing how the malware looks or behaves.

Instead of analyzing the app MassVet compares it with apps that already exist in the relevant store. Most Android malware is in fact repackaged apps. When cybercriminals repacking apps add malicious components increasing. Therefore differs repackaged app of the original. The malicious components in applications can also be found who seem to have nothing to do with each other.

The researchers decided to test the scanner with 1.2 million apps from 33 different app markets. MassVet proved apps within 10 seconds, assess and outperformed 54 virus scanners on VirusTotal. Of the 1.2 million-controlled apps were found to be more than 127 000 malignant and 34 000 were missed by most malware scanners on VirusTotal. Some of the malware specimens were installed millions of times. It also found that 5000 malicious apps each had more than 10,000 installations.
Google Play

Also analyzed MassVet 400 000 apps on Google Play, of which 30 000 were found to be malignant. This equates to an infected rate of 7.6%. According to the researchers this different from earlier figures of Google. According to Google, was found on Android Users who only install apps from Google Play at less than 0.15% of the devices a "potentially malicious application" (PHA).

However, users of China's market places that are most likely to Android malware. In the market places of Anzhi, Yidong, yy138 and Anfen was 39%, 36%, 28% and 23% of all available apps malware. On the fifth of infected stores SlideMe comes back, 21% of the malware apps proved to be. The overview is also given to the store by Opera. This was 7.8% of the apps labeled as malicious.

Half Of Android Users Would Be Vulnerable To Attack APK

Android Users who install apps outside of Google Play and an old Android version use are vulnerable to a new attack. It was estimated to be half of all Android users, warns security company Palo Alto Networks.The actual number is probably much lower.

Through the vulnerability could allow an attacker to break into the installation of a seemingly safe APK file and replace it with an app of choice, without the user noticing. The security issue is caused by an error in the system service "Package Installer" of Android, allowing attackers unnoticed can get unlimited access rights. During installation let Android Apps see what permissions they need in order to work properly. A Messages app, for example, require access to SMS messages, but not to the GPS location.

The vulnerability gives attackers the ability to deceive users by a false, smaller set to allow access rights to see. In reality, the user, if he chooses to install the app, just give access to all services and data on the device, including personal information and passwords. The problem is present in Android 2.3, 4.0.3-4.0.4, 4.1.x, and 4.2.x and some distributions of 4.3. According to Palo Alto Networks uses about half of Android users one of these versions.

The actual number of users that are at risk is likely to be much lower. The security issue because only occurs at Android apps that are downloaded from third parties and unofficial marketplaces. It does not apply to apps downloaded from Google Play. These files are downloaded namely in a safe environment that can not be modified by an attacker. Owners of Android devices vulnerable therefore be advised to only download apps from Google Play.

Wifi Reveals Where Someone lives, Works And Has Been To Increase

Devices with WiFi can reveal to outsiders where someone lives, works and all was going, warns a security researcher. Almost all devices that support WiFi finding previously used Wi-Fi networks. These "probes" are to absorb and contain, among other things, the name of the previously used Wi-Fi networks.One problem is that many local network names will be relatively unique, says researcher Stanis? aw Pitucha .

This makes it possible to draw up a list of home networks, corporate networks, cafes, fast food chains, hotels and other locations. These names can already give you an idea where someone lives or works, for example, be used if specific network names. However, the probes contain no specific BSSID, location or other data. Yet even to retrieve them. There is a service called Wigle that Wi-Fi networks maps from all over the world. Through the service are now 182 million Wi-Fi networks located.

So you can search for specific Wi-Fi network names. On the basis of the Wigle-Pitucha hits made, with information from intercepted probes, a folder. He was able to determine that someone is working on the US East Coast, for his work to Japan had gone and had been on holiday to Thailand. "This problem makes it much easier to perform social engineering or spear phishing, or even to find someone on a completely unrelated location that works for a particular company," said the researcher.

"Combine this with the fact that the MAC address identifies which phone model used person and you can find the right person in the group." As a solution, users can disable or delete previously saved Wi-Fi networks probing. Another option is for example the adjustment of the own Wi-Fi network name in somewhat generic. For Android Users there are several apps available that protect previously used Wi-Fi networks.