Researchers Find Big Leaks In Pre-installed Android Apps

 

An anonymous reader sends this quote from an article at Ars Technica: "Researchers at North Carolina State University have uncovered a variety of vulnerabilities in the standard configurations of popular Android smartphones from Motorola, HTC, and Samsung, finding that they don't properly protect privileged permissions from untrusted applications (PDF). In a paper just published by researchers Michael Grace, Yajin Zhou, Zhi Wang, and Xuxian Jiang, the four outlined how the vulnerabilities could be used by an untrusted application to send SMS messages, record conversations, or even wipe all user data from the handset without needing the user's permission. The researchers evaluated the security of eight phones: the HTC Legend, EVO 4G, and Wildfire S; the Motorola Droid and Droid X; the Samsung Epic 4G; and the Google Nexus One and Nexus S. While the reference implementations of Android used on Google's handsets had relatively minor security issues, the researchers were 'surprised to find out these stock phone images [on the devices tested] do not properly enforce [Android's] permission-based security model.' The team shared the results with Google and handset vendors, and have received confirmation of the vulnerabilities from Google and Motorola. However, the researchers have 'experienced major difficulties' in trying to report issues to HTC and Samsung."

 Read more of this story at Slashdot.

 

Researchers Find Big Leaks In Pre-installed Android Apps
Soulskill
Fri, 02 Dec 2011 18:00:00 GMT

Sprint admits receiving CarrierIQ data but says its not spying

 

CarrierIQ supplies Sprint generalized data about how its customers’ smartphones perform on its network, but Sprint does not snoop into the private contents of those phones, Sprint said on Tuesday. While Sprint is primarily using that information to optimize both its network and how phones behave on it, the operator isn’t – and technically incapable of — tracking or viewing the contents of any message or media in the device, Sprint spokeswoman Stephanie Vinge said in an email. Here’s her full statement:

“Carrier IQ provides information that allows Sprint, and other carriers that use it, to analyze our network performance and identify where we should be improving service.  We also use the data to understand device performance so we can figure out when issues are occurring. We collect enough information to understand the customer experience with devices on our network and how to address any connection problems, but we do not and cannot look at the contents of messages, photos, videos, etc., using this tool. The information collected is not sold and we don’t provide a direct feed of this data to anyone outside of Sprint.

“Sprint is well known for our serious commitment to respecting and protecting the privacy and security of each customer’s personally identifiable information and other customer data. A key element of this involves communicating with our customers about our information privacy practices. The Sprint privacy policy makes it clear we collect information that includes how a device is functioning and how it is being used. Carrier IQ is an integral part of the Sprint service.  Sprint uses Carrier IQ to help maintain our network performance.”

Sprint, like many of its operator brethren, is in the firing line as a new research from Android developer Trevor Eckhart discovered what he termed a “rootkit” buried in the guts of many Android phones. The CarrierIQ software tracks every keystroke in on the phones it is installed on, recording that information for CarrierIQ’s analytics purposes. It’s not clear if the information collected goes directly to the operators, handset makers or to CarrierIQ. But the applications cannot be disabled or uninstalled, and there’s no way opt out of its recording activities. (Kevin Tofel wrote earlier about how to detect CarrierIQ in your phone).

Verizon Wireless emphatically stated that it does not use CarrierIQ data and that the application is not installed in any of its smartphones. Other carriers and both Google and Nokia have made similar statements about not using CarrierIQ data, though it’s still unclear if the root app still resides in their customers’ devices. We’re still waiting to hear from the rest of the U.S. operators.

---

 

Sprint admits receiving CarrierIQ data but says its not spying
Kevin Fitchard
Thu, 01 Dec 2011 18:55:50 GMT

Carrier IQ: What it is, what it isn't, and what you need to know

 

Carrier IQ has recently found itself swimming in controversy. The analytics company and its eponymous software have come under fire from security researchers, privacy advocates and legal critics not only for the data it gathers, but also for its lack of transparency regarding the use of said information. Carrier IQ claims its software is installed on over 140 million devices with partners including Sprint, HTC and allegedly, Apple and Samsung. Nokia, RIM and Verizon Wireless have been alleged as a partners, too, although each company denies such claims. Ostensibly, the software's meant to improve the customer experience, though in nearly every case, Carrier IQ users are unaware of the software's existence, as it runs hidden in the background and doesn't require authorized consent to function. From a permissions standpoint -- with respect to Android -- the software is capable of logging user keystrokes, recording telephone calls, storing text messages, tracking location and more. It is often difficult or impossible to disable.
How Carrier IQ uses your behavior data remains unclear, and its lack of transparency brings us to where we are today. Like you, we want to know more. We'll certainly continue to pursue this story, but until further developments are uncovered, here's what you need to know.

Continue reading Carrier IQ: What it is, what it isn't, and what you need to know

Carrier IQ: What it is, what it isn't, and what you need to know originally appeared on Engadget on Thu, 01 Dec 2011 13:54:00 EDT. Please see our terms for use of feeds.

Permalink 

Carrier IQ: What it is, what it isn't, and what you need to know
Zachary Lutz
Thu, 01 Dec 2011 17:54:00 GMT

More Carrier IQ Detail: Nokia, Google, O2, Verizon, Vodafone UK Say No Dice (Ingrid Lunden/mocoNews)

 

Ingrid Lunden / mocoNews:
More Carrier IQ Detail: Nokia, Google, O2, Verizon, Vodafone UK Say No Dice  —  Several days into the Carrier IQ story—which raised privacy concerns around software that claims to be an innocent diagnostics tool—and some handset makers and at least a few carriers are scrambling to clear …

More Carrier IQ Detail: Nokia, Google, O2, Verizon, Vodafone UK Say No Dice (Ingrid Lunden/mocoNews)
Thu, 01 Dec 2011 14:25:00 GMT

Carrier IQ Is Tracking Your iPhone Too, But It's Easy to Turn Off [Security]

 

Carrier IQ has made quite a stir with its ability to track everything you do on your Android phone, and it turns out that it comes preinstalled on the iPhone as well—albeit a less dastardly version. Here's what it can do and how to turn it off. More »

Carrier IQ Is Tracking Your iPhone Too, But It's Easy to Turn Off [Security]
Whitson Gordon
Thu, 01 Dec 2011 16:30:00 GMT

Danger worm hijacks Facebook accounts to inject banking Trojan

 

Beware of poisoned photo links

A dangerous worm is using Facebook to spread itself by posting malicious links on the social networking website that point to malware-tainted sites loaded with a variant of the Zeus banking Trojan as well as other nasties.…

Danger worm hijacks Facebook accounts to inject banking Trojan
Tue, 29 Nov 2011 15:02:09 GMT

RIM to offer its mobile device management software on Andriod, iOS

 

Research In Motion's executives have apparently decided that if they can't beat Apple and Google, they'll join them. The company announced today that it will offer its mobile device management and security software for iOS and Android devices, allowing enterprise customers to manage them alongside BlackBerry phones.

The new software, BlackBerry Mobile Fusion, will provide many of the same central administration features now offered on RIM's own phone OS—including remote locking of devices and remote erasing of their storage, application and software management, security policy enforcement, and management of WiFi and VPN connections among them. The software will be available in the first quarter of 2012, according to a company statement.

The move is an acknowledgement of the growing trend of companies adopting "bring your own device" policies to accommodate employees' desire to use their own smartphones and tablet devices in the enterprise, and of the iPad's dominance in the tablet space.

By integrating with iOS and Android, RIM vice president of enterprise product management Alan Panezic told Reuters, RIM is shooting to "become the de facto platform" for managing mobile devices in the enterprise. "We will take full advantage of whatever security capabilities are provided by the core operating system—we're not going to hold back in any way, shape or form."

The problem RIM faces is that the mobile device management market is already crowded. The BlackBerry still remains a favorite of large companies and the government (though that favor may have diminished after the worldwide RIM e-mail outage in October), and that's largely been because of the platform's management features. It's possible that Mobile Fusion could give BlackBerry the opportunity to hang on to its mobile device management customer base (which the company claims includes 90 percent of the Fortune 500), or at least delay their decisions to move to multiple platform mobile device management tools from companies such as Good Technology (which is making inroads with RIM's government customers) and MobileIron. On the other hand, it could shoot RIM's handset business in the foot, as large companies dump the BlackBerry en masse and move to iOS and Android.

Read the comments on this post

 

RIM to offer its mobile device management software on Andriod, iOS
sean.gallagher@arstechnica.com (Sean Gallagher)
Tue, 29 Nov 2011 15:28:00 GMT

Twitter Acquires Mobile Security Firm Whisper Systems

 

Twitter has acquired mobile security company Whisper Systems for an undisclosed amount, both companies have confirmed.

Whisper Systems’ portfolio includes services such as Flashback, which offers encrypted backups for Android devices, and RedPhone, which provides end-to-end encryption for calls made on Android devices.

“We’re looking forward to bringing our technology and our expertise into Twitter’s products and services,” says Whisper Systems’ dev team in a blog post, adding that some services will be interrupted as the company transitions into a part of Twitter.

Whisper Systems is a small company, consisting only of two employees: security experts Moxie Marlinspike and Stuart Anderson. Marlinspike is the author of several well-known cyber security tools, including SSLstrip and wpacracker.

It’s unclear what, exactly, Twitter plans to do with Whisper Systems, but it’s not too far-fetched to imagine Twitter offering a service with an added layer of security to enterprise users.

In any case, having a top-notch security expert such as Marlinspike will surely benefit Twitter, which has had its share of security issues in the past.

Twitter Acquires Mobile Security Firm Whisper Systems
Stan Schroeder
Tue, 29 Nov 2011 13:17:57 GMT

Security Researcher Demos Windows 8 Bootkit

 

Windows 8 Bootkit Demo from Peter Kleissner on Vimeo.

Few men can lay claim to being ahead of their time like Peter Kleissner. While most of us were busy playing around with the Windows 8 Developer Preview, this Austrian security researcher was vetting it for possible vulnerabilities. Whatever he was up to seems to have worked. Kleissner has successfully identified a vulnerability in this early version of the upcoming operating system and even posted a video of his proof-of-concept “Stoned Lite” bootkit successfully exploiting this flaw. Hit the jump for the video.

Here is a video of his 14KB bootkit called Stoned Lite successfully bypassing Windows 8 User Account Control. “This shows how to use Stoned Lite to get SYSTEM rights on Windows 8 through the cmd privilege escalation (done by a driver loaded by the bootkit). The infector is just 14 KB of size and bypasses the UAC,” reads the video’s description on Vimeo.

Upon being asked on Twitter if the exploit in any way circumvented UEFI, Kleissner clarified: “No it's not attacking UEFI or secure boot, right now working with the legacy BIOS only (details will be in the paper).”

With the release of Windows 8 still a fair way away, Microsoft has plenty of time to fix this bug discovered by Kleissner, who is a bootkit junkie of sorts having previously developed a bootkit called Stoned as a proof-of-concept for a vulnerability in Windows XP, Windows Vista, Windows 7 and Windows Server 2003.

Security Researcher Demos Windows 8 Bootkit
Pulkit Chandna
Sat, 26 Nov 2011 14:08:40 GMT

Microsoft Announces Security Essentials Beta Program

 

Launched over two years back, Microsoft Security Essentials has established itself as one of the best free security apps out there. In this time, two versions of the free anti-virus have been released to mostly positive reviews. Our own reviews of MSE are a point in case. Now Microsoft is laying the groundwork for the release of the tool’s next version.

The company has announced that the beta of the next version of MSE is now open for registration. If you wish to participate please hurry as Microsoft will only be accepting a limited number of applications for the beta.

"The number of users than can participate in the Beta is limited, so sign up today and we will notify you once the Beta is available for download," announced the Security Essentials team Friday. "We anticipate the Microsoft Security Essentials beta to be available to the general public by the end of the year."

The enhancements that will be part of the beta version are:

• Enhanced protection through automatic malware remediation - The Beta will clean high-impact malware infections automatically, with no required user interaction.
• Enhanced performance - The Beta includes many performance improvements to make sure your PC performance isn’t negatively impacted.
• Simplified UI - Simplified UI makes Microsoft Security Essentials Beta easier to use.
• New and improved protection engine - The updated engine offers enhanced detection and cleanup capabilities.

Microsoft Announces Security Essentials Beta Program
Pulkit Chandna
Sat, 19 Nov 2011 23:11:02 GMT

Windows 8 Secure Boot Defeated

 

jhigh writes "An Austrian security researcher is scheduled to release the first 'bootkit' for Windows 8 at the upcoming MalCon in Mumbai. This exploit loads in the MBR and stays memory resident until Windows loads, resulting in root access to the system. This allegedly defeats the new secure boot features in Windows 8's bootloader."

 Read more of this story at Slashdot.

 

Windows 8 Secure Boot Defeated
samzenpus
Thu, 17 Nov 2011 20:45:00 GMT

25 Worst Passwords of 2011 [STUDY]

 

Pro tip: choosing “password” as your online password is not a good idea. In fact, unless you’re hoping to be an easy target for hackers, it’s the worst password you can possibly choose.

“Password” ranks first on password management application provider SplashData’s annual list of worst internet passwords, which are ordered by how common they are. (“Passw0rd,” with a numeral zero, isn’t much smarter, ranking 18th on the list.)

The list is somewhat predictable: Sequences of adjacent numbers or letters on the keyboard, such as “qwerty” and “123456,” and popular names, such as “ashley” and “michael,” all are common choices. Other common choices, such as “monkey” and “shadow,” are harder to explain.

SEE ALSO: HOW TO: Protect Your Company’s Passwords

As some websites have begun to require passwords to include both numbers and letters, it makes sense varied choices, such as “abc123″ and “trustno1,” are popular choices.

SplashData created the rankings based on millions of stolen passwords posted online by hackers. Here is the complete list:

• 1. password
• 2. 123456
• 3.12345678
• 4. qwerty
• 5. abc123
• 6. monkey
• 7. 1234567
• 8. letmein
• 9. trustno1
• 10. dragon
• 11. baseball
• 12. 111111
• 13. iloveyou
• 14. master
• 15. sunshine
• 16. ashley
• 17. bailey
• 18. passw0rd
• 19. shadow
• 20. 123123
• 21. 654321
• 22. superman
• 23. qazwsx
• 24. michael
• 25. football

SplashData CEO Morgan Slain urges businesses and consumers using any password on the list to change them immediately.

“Hackers can easily break into many accounts just by repeatedly trying common passwords,” Slain says. “Even though people are encouraged to select secure, strong passwords, many people continue to choose weak, easy-to-guess ones, placing themselves at risk from fraud and identity theft.”

SEE ALSO: 5 Tools for Keeping Track of Your Passwords

The company provided some tips for choosing secure passwords in a statement:

• 1. Vary different types of characters in your passwords; include numbers, letters and special characters when possible.
• 2. Choose passwords of eight characters or more. Separate short words with spaces or underscores.
• 3. Don’t use the same password and username combination for multiple websites. Use an online password manager to keep track of your different accounts.

Image courtesy of iStockphoto, peepo

25 Worst Passwords of 2011 [STUDY]
Zoe Fox
Fri, 18 Nov 2011 03:34:30 GMT

Google Chrome update addresses high-severity flaw

 

Google has released an update for Chrome 15 which addresses a high-risk vulnerability. The security issue is the result of an out-of-bounds memory write in the browser's JavaScript engine. Under normal circumstances such a vulnerability would allow remote code execution and would be considered critical. However, because Google Chrome uses a native sandbox that prevents attackers from executing malicious code, the severity of the bug was downgraded.

Google Chrome update addresses high-severity flaw
Fri, 18 Nov 2011 12:50:31 GMT

Facebook Users Hit by Nasty Porn Storm

 

Facebook users have been bombarded with explicit and violent images in the latest malware campaign aimed at the giant social networking site, a security researcher said Tuesday.

 

Facebook Users Hit by Nasty Porn Storm
Wed, 16 Nov 2011 09:33:47 GMT

10 iOS Security Apps to Protect Your iPhone, iPad from Hackers - eWeek

 

eWeek

 

10 iOS Security Apps to Protect Your iPhone, iPad from Hackers
eWeek
The low volume of serious malware for the iOS platform makes iOS users complacent about the kinds of security risks they are facing. But the truth is that iPhone users still face a variety of security threats. ...
and more »

10 iOS Security Apps to Protect Your iPhone, iPad from Hackers - eWeek
Tue, 15 Nov 2011 19:55:38 GMT

Malicious Hackers Target Twilight Fans

 

As the next movie in the Twilight Saga film series nears its premiere, malicious hackers are taking advantage of Twilight fans by poisoning links in Twilight-related searches with malware, Norton’s experts warn.

Some of the search terms which will return results infected with malware are “Nude pictures of Taylor Lautner,” “Robert and Kristin kissing” and “Twilight true love.”

Clicking on some of the links resulting from these searches might get your PC, tablet or smartphone infected with viruses or keyloggers, so be extra careful when searching for Twilight-related material.

Twilight Saga fans are a common target for malicious hackers. In April 2011, we’ve seen a Twilight game scam spread virally on Facebook, and similar scams have accompanied every movie in the series.

The next movie in the series, The Twilight Saga: Breaking Dawn (Part 1) should hit cinemas on November 18, 2011. Norton‘s experts expect to see even more Twilight-related malware, scams and spam as the excitement around the movie grows.

 

Malicious Hackers Target Twilight Fans
Stan Schroeder
Tue, 15 Nov 2011 09:48:00 GMT

Android Security Threats Surge With Infected 'Angry Birds': Tech - BusinessWeek

 

Bloomberg

Android Security Threats Surge With Infected 'Angry Birds': Tech
BusinessWeek
15 (Bloomberg) -- In the era of the personal computer, Apple Inc.'s machines were often less vulnerable to security threats than the alternatives. That may also be the case with the rise of smartphones. Google Inc.'s Android operating system for mobile ...
Android Threats Surge With Third-Party AppsBloomberg
Apple, Google need to improve smartphone security: Blue CoatAustralian Techworld
Free Android antivirus apps fail to cut itCNET
CRN
all 98 news articles »

Android Security Threats Surge With Infected 'Angry Birds': Tech - BusinessWeek
Tue, 15 Nov 2011 16:31:12 GMT

Freebie Android anti-malware scanners flunk tests

 

Worse than useless

Many free-of-charge antivirus products fail to protect Android smartphone against malware effectively, leaving users with a false sense of security as a result.…

Freebie Android anti-malware scanners flunk tests
Mon, 14 Nov 2011 13:29:05 GMT

Mac OS X Sandbox Security Hole Uncovered

 

Gunkerty Jeb writes "Researchers at Core Security Technologies have uncovered a security hole that could allow someone to circumvent the application sandbox restrictions of Mac OS X. The report of the vulnerability, which affects Mac OS X 10.7x, 10.6x and 10.5x, follows Apple's announcement earlier this month that all applications submitted to the Mac App store must implement sandboxing as of March 1, 2012. Sandboxing, Apple has argued, limits the resources applications can access and makes it more difficult for malware to compromise systems. Researchers at Core however revealed Nov. 10 that they had warned Apple in September about a vulnerability in their sandboxing approach. According to Core's advisory, several of the default predefined sandbox profiles fail to 'properly limit all the available mechanisms.' As a result, the sandboxing restrictions can be circumvented through the use of Apple events."

Read more of this story at Slashdot.

 

Mac OS X Sandbox Security Hole Uncovered
samzenpus
Sun, 13 Nov 2011 23:30:00 GMT

Scam watch: Social Security, malware, investments - Los Angeles Times

 

AARP News

 

Scam watch: Social Security, malware, investments
Los Angeles Times
Social Security -- Thieves have been impersonating Social Security Administration employees in an attempt to steal seniors' personal information, AARP said in a recent bulletin. The con artists call seniors, claim to be updating their records and ask ...
Retirees need to fight for Social Security, MedicareBradenton Herald
US deficit panel focuses on cuts to Medicare, Social SecurityWorld Socialist Web Site
Republican Voters Say Close Tax Loopholes, but Don't Cut EntitlementsInternational Business Times
AARP News
all 12 news articles »

Scam watch: Social Security, malware, investments - Los Angeles Times
Sun, 13 Nov 2011 12:03:11 GMT