Google Patches Nine Vulnerabilities In Android Patch Round

Last month, Google announced that a monthly patch cycle went input, which it first updates for Stage Fright leak were released. During the round patch of September, the Internet giant nine vulnerabilities fixed, two of which are labeled as critical.

Through Critical vulnerabilities an attacker could execute code remotely on the device, for example by sending an MMS message. One of these critical vulnerabilities had already actively attacked before the update was available. The other critical vulnerability relates to one of the Stage Fright leaks last month not fully been patched. The updates are only for Nexus devices and are over-the-air (OTA) are offered.

Google Update Does Not Protect Against Stage Fright Leak

The update that Google has released the Critical Stage Fright flaw in Android does not work, say researchers from security firm Exodus Intelligence . However, Google will continue to roll out the faulty update, so let them know on their own blog. Through Stage Fright an attacker could install malicious apps on Android phones by just sending an MMS message.

On July 31, Jordan Gruskovnjak researcher claimed that there was a serious problem with the proposed patch of Google.Since the update itself had not yet been rolled out, the investigator could not confirm his suspicions. Last week, Google released the update finally out so Gruskovnjak could test whether the Stage Fright leak was indeed completely solved or not.Eventually he managed to create an MP4 file which the update could circumvent and to crash the device. The researcher warned Google on 7 August, but received no response.

Then Exodus Intelligence decided to publish details about the issue. The company states that they are probably not the only ones who have discovered that the update does not solve the problem entirely. In addition, would Stage Fright Detector app from Zimperium, the company that discovered the vulnerability, incorrectly indicate that users are safe, even if that is not the case. Meanwhile work Exodus Intelligence and Zimperium together to improve the detection of the app. However, Google still has not responded.

Researchers Reveal Solution For Mobile Malware

Researchers from the University of Alabama say they have developed a solution that should reduce the impact of mobile malware. The problem of mobile malware, according to the researchers is mainly caused by users who download applications from untrusted sites that offer infected apps. Once installed on the device has the malware free play.

"The Achilles heel of the security of mobile devices is that security decision depends on the user," says researcher and lecturer Nitesh Saxena. For example, when you install an Android app gets the user's demand that the app will have certain rights. Users can then be distracted or have hurry and so quick to allow these permissions. "Whatever the reason, it is a known problem that people do not look at these warnings and simply" yes "clicks."

Current operating systems provide the researchers not protect against this type of attack. Therefore there was a search for a solution to the important parts of the phone, namely the ability to call the camera and NFC, protect against malware. The result was a security that is based on three hand movements. If a user wants to call that instance must move the device or tap anywhere before the phone rings, while as malware service to telephone calls this movement will fail.

To demonstrate the effectiveness of the approach, the researchers collected data from several phone models and users in real or "almost real" scenarios, where both friendly and hostile scenarios were simulated. It emerged that detect hand movements are very accurate and other benign and malignant activities can be distinguished. "In this way, something as simple as human movement to solve a very complex problem," says Saxena. "It makes the weakest link, the user, the strong defender." The researchers plan to develop security for other smartphone services, such as SMS and email.

Malware Infected Xiaomi Smartphone Appears Counterfeiting

Last week there was a fuss about Chinese smartphone manufacturer Xiaomi standard that malware would be delivered, but now it is confirmed that it is a counterfeit device. Bluebox security company published last Thursday a blog posting about malware that was found on the Xiaomi Mi 4 LTE smartphone. The company had bought the unit in China.

When scanning of the apps on the smartphone was found one suspect app, allowing users of information risk could walk.Initially the Chinese smartphone manufacturer would not have responded to the findings of Bluebox. After publication of the research did however a response, which the company claimed that there was possibly purchased a manipulated device.

Bluebox had purchased over the phone namely a physical supplier, while Xiaomi China does not sell equipment through "third-party" parties. The aircraft would only online and through the shops of telecom providers are offered. Then again Bluebox responded with criticism, because it was apparently possible for stores or anyone in the distribution chain to adjust the devices.

Counterfeit
After an extensive testing on the basis of all kinds of pictures is now been established that it is a counterfeit Mi 4. The unit was so well imitated that it initially also managed to circumvent a special app Xiaomi for detecting counterfeit devices. The latest version of the app can now detect the counterfeit version.

According Bluebox let the incident shows how important it is for companies to take researchers reports seriously and work together. Further notes the security of the supply chain, where it happens that consumers compromised smartphones can purchase. Finally, the tools to identify counterfeit goods must be improved.

Gemalto Denies Scale Theft Encryption Keys

SIM card manufacturer Gemalto denies that the American and British secret services widely encryption keys of SIM cards have been stolen. That leaves the Netherlands-based company after research know.Last week The Intercept came with the message that the US NSA and the British GCHQ in 2010 had obtained access to the network of Gemalto there and had the encryption keys sim captured.

According to the SIM card manufacturer is discovered in 2010 and 2011, two sophisticated attacks against the company that seem to correspond to the attack methods that are defined in the document of The Intercept. In 2010, the company discovered suspicious activity on one of the French sites where a "third party" the office trying to spy.

In July 2010 a second incident was discovered, which were sent phishing e-mails to a telecommunications company seemed from Gemalto and contained an infected attachment. Also, this time it happen several times tried to gain access to the computers of Gemalto staff. The company calls it "likely" that an operation has been carried by the NSA and GCHQ. This would, however, only the office have been compromised.

There has therefore been no large-scale theft of encryption keys. In addition, Gemalto says it had already rolled out a secure exchange system in 2010 for the exchange of these keys with telecom providers, which is the risk of theft would create exceptional. However if keys are captured, they would only intelligence second generation 2G networks can eavesdrop. 3G and 4G networks would not be vulnerable to such attacks.

Research: Weak Encryption In Popular Android Apps

Many of the popular free Android apps in the Google Play store use weak encryption to protect sensitive information. Which claims that the US security firm FireEye 9339 apps with more than 1 million downloads analyzed . Of these, 8261 were found to use a cryptographic functionality of the Android platform. 8261 of these apps again proved 5147 apps (62%) contain one or more cryptographic vulnerabilities.

It involves, for example using static keys for encryption. These keys can be removed from the app and then to decrypt the data. This was 21% of the apps the case. Furthermore, 58% had to use a weak encryption algorithm that the apps are vulnerable to certain attacks. For a handful of apps was also developed an attack. One of these apps accepted all dished SSL certificates, allowing attackers to perform a man-in-the-middle attack.

According to the researchers cryptographic vulnerabilities are a serious threat because they enhance the effectiveness of other attacks. Through the misuse of SSL could intercept an attacker instance sensitive information. "This problem is compounded by root exploits in which an attacker rooting a device can determine which apps are installed to send random data for offline decryption" concludes researcher Adrian Mettler.