StageFright 2.0: Android Phones Vulnerable To New Stage Fright Leak

Millions of devices with Android are vulnerable because of a new vulnerability in the Stage Fright-media library and a security update from Google is not yet available. Reported security Zimperium. Stage Fright is a library that handles a variety of media formats.

A problem in the handling of MP3 or MP4 files ensures that an attacker could execute arbitrary code in the worst case to the unit. In late July, investigators were already several vulnerabilities in the Stage Fright library known. These include leak made ​​it possible to attack Android devices via MMS messages. The two now discovered vulnerabilities as "Stage Fright 2.0 identified". The first vulnerability is present in every Android device since version 1.0 was launched in 2008.

The researchers discovered a second leak making them the first leak on devices with Android 5.0 and newer can attack if a specially crafted MP3 or MP4 file is processed. Older phones may be at risk if the vulnerable component is invoked via third party apps or placed by the operator on the phone.

The primary attack vector for the first Stage Fright-leakage was via MMS, but this is in new versions of the Google Hangouts, and Messenger apps no longer possible. The researchers therefore see the browser as the main attack vector. An attacker could entice a user for example to a website or may execute the exploit via a man-in-the-middle. Google was informed on August 15 about the problems, but a patch is not yet available.

US Bank Introduces Pins Via Smartphone

A US bank has 750 ATMs adapted so customers money using their smartphone instead of a debit card can record. To pin must BMO Harris Bank customers install an app on your smartphone. The app can record it indicated amount.

Then the smartphone to scan a QR code on the screen of the selected ATM, after which the money is spent. The QR code would expire after 45 seconds. "When you walk away from an ATM with a QR code on the screen, there's no risk. The QR code contains no personal information about you or your accounts. It only identifies the ATM you use for the transaction," the explanation of the bank.

The entire process of pins would take fifteen seconds mobile, while a normal transaction with a debit card would take 45 seconds. The bank notes that the map data of the customer are not stored on the smartphone or app. In case customers lose their smartphone, they should be immediately reported this to the bank, so that mobile banking can be disabled.

"Smartphones are increasingly becoming the only device that people use to manage their lives," says Connie Stefankiewicz of BMO Harris Bank. "Consumers have growing expectations when it comes to digital tools and services they offer. When it comes to personal finances, we know that our customers want their financial needs through their smartphone." The bank is planning to prepare in June another 150 ATMs for mobile pins.

IOS Spyware Used For Cyber-Espionage

Researchers from the Japanese anti-virus company Trend Micro have discovered spyware that is designed specifically for iOS devices and is used in cyber espionage. How the spyware is distributed is unknown, but the researchers believe that used previously infected computers. Once an iPhone or iPad is connected to the infected computer, the spyware is installed.

It involves two malicious iOS applications called XAgent and Madcap, the latter is the name of a legitimate application. The XAgent app hides the icon and runs in the background. Once the process is stopped will restart the malware itself almost immediately. Once active attempts spyware text messages, address books, photos, geo-location data, processes, collect installed apps and WiFi status. Audio recordings are made as well.

It seems that the malware for iOS 7 is designed as XAgent operates here fully. In the case of iOS 8 of the spyware the icon is not hidden and the app itself does not automatically restart. If known, the spyware are used against a variety of purposes, including governments, the military, the defense industry and the media.

"The exact method of installation of this malware is unknown. We know that an iOS device jailbroken not necessarily have to be," said the researchers. XAgent example uses Apple's ad hoc provisioning, which is the default distribution method for iOS app developers. Through ad hoc provisioning malware can be installed simply by clicking on a link. The malware was found with an iOS Developer Enterprise to be signed certificate. Another possible method of infection is to connect an iPhone or iPad via USB to an infected Windows computer.

The hashes of the related files are:

05298a48e4ca6d9778b32259c8ae74527be33815
176e92e7cfc0e57be83e901c36ba17b255ba0b1b
30e4decd68808cb607c2aba4aa69fb5fdb598c64

Durka Malicious App: Apps On Google Play Store Infect Millions With Adware

Researchers have found several apps on Google Play that occur as games, but found to contain a million times and downloaded in reality adware. Some of the apps, including the card game Durka, activate the existing adware only after 30 days.

The adware ensures that when users unlock their device, they get a warning that their device is infected or outdated or full porn state. Then you will be asked to take action. If users are being redirected to come dubious apps and app stores herein secretly send text messages or collect all sorts of personal information. In some cases, users refer to security apps on Google Play.

Anti-virus company Avast thinks the adware distributors get paid for generating traffic to the apps and app stores. "Most people will not find out the cause of the problem and will have to deal with every time ads as they unlock their device," says analyst Filip Chytry. He thinks that most people end up trusting the solution offered, which can lead to more unwanted apps or costs. Besides Durka also involves an IQ test app and an app on the history of Russia. The apps are downloaded together between 5 million and 10 million times.

Hashes:

BDFBF9DE49E71331FFDFD04839B2B0810802F8C8BB9BE93B5A7E370958762836 

9502DFC2D14C962CF1A1A9CDF01BD56416E60DAFC088BC54C177096D033410ED 

FCF88C8268A7AC97BF10C323EB2828E2025FEEA13CDC6554770E7591CDED462D