Mobile ransomware still active, still polymorphic, and still the same.

A post a Trend Micro shows a new variation of the same old mobile ransomware that has thwarted AV engines for over 2 years. This Android ransomware is server-side polymorphic and will most likely give a different variation over time and different downloads so any hash based detentions of this will be ineffective.

There are some simple common sense steps to avoid this type of malware:

• Don't give any app admin access
• Don't install any app from a porn site that requires you to install before viewing a video.
• Android devices will be able to play videos without the need to install a specific app,
• Always check the download in VirusTotal before installing or at least google any link that seems a bit "fishy"
• Try to stick to office app-stores such as google and amazon.

A sample of malware can be found at:
hxxp://pulporn[dot]ru/porn54545/load.php



or on Virus Total:
https://www.virustotal.com/en/file/441ba1d1d914e67ecd0c92ccebc7957da97f13692f466ba501a892f2f7c44671/analysis/1460542841/

As always be careful with live malware,

Stay safe out there
-Ryan

Fake Flappy Birds on Android

An article at Naked Security mentions that fake versions of the popular Android game "Flappy Birds" are hiding premium SMS Trojans. A couple of examples of this can be found at the links below. Be careful as these are current live links to Android Trojans and can be harmful to your device. Always be mindful of any software coming from secondary markets.

• hxxp://mfile[dot]me/upload/bookmark/2014/0208/choingaygame/1391825505/flappy-bird[dot]apk
• Virus Total Analysis
• hxxp://mfile[dot]me/upload/apk/zenthang/20140206/com.dotgears.flappybird[dot]apk
• Virus Total Analysis

Stay safe out there
-R`/4N

Using Google and Scumware for samples

Here's a quick tutorial on  good sources for Android malware. The site scumware.org is a great source for finding the latest threats.  Use Google and put in the search box android site:scumware.org. You will get results to downloads of all kinds of Android malware.

Remember to use safe downloading techniques as links on scumware are not limited to Android and could really hose your Windows machine.



As always; stay safe out there
-R`/4N

"Remember the 13th" Scam.

    While this one is a bit off topic it still pertains to basic security principles. The website promoting a huge NASA discovery that will "change the world." www.rememberthe13th.com is making its rounds on Facebook.
     
      To catch the victims attention the site claims huge things: "SO WHATS THAT ALL ABOUT? NASA has made a historic discovery that will shake the entire planet. This announcement will be released to the media on November 13th, 2013. It will be a day to remember and One for the history books. Spread the word to your family & friends and sign up to stay updated!" 
    
    This site is fake. Anyone who has registered or sent an Email has fallen for this phishing campaign.  It's only goal is to get Social Media likes and shares and harvest Email addresses for sending more spam. Always be skeptical of sites like this and never fall for the hype. It is easy to prove that this is fake.

     First thing is to check the site's registration info:

Registration Service Provided By: Namecheap.com 
Contact: support@namecheap.com

Registered through: eNom, Inc. 
Domain name: rememberthe13th.com 
Registrant Contact: WhoisGuard, Inc. WhoisGuard Protected () 
Fax: P.O. Box 0823-03411 Panama, Panama NA PA 

Creation date: 01 Oct 2013 16:16:00 
Expiration date: 01 Oct 2014 16:16:00

     This is highly suspicious: A NASA Government website would not be registered anonymously in Panama. On top of that it was registered October 1st.  The first day of the US Government's shut-down. Since 90% of NASA employees are currently out of work, there should be no one left to substantiate any of this.

Next, we check out the sites IP (192.111.149.82) on Virus Total:
https://www.virustotal.com/en/ip-address/192.111.149.82/information

2013-09-19: www.mileytape.com
2013-09-11: www.opblackout.com
2013-10-04: www.rememberthe13th.com
2013-09-17: www.rockstarannouncement.com

     You can now see that this isn't the first time they tried to pull this.  In the past they have used a fake Miley Sirus sex tape stolen from her phone and an announcement for Grand Theft Auto V on the PC to get sign-ups.  This is just a scam set-up by adixy.com, a site that allows you to purchase social media likes and shares. These harvested emails and account info will then go into a pool for future spamming.

     Lastly, you can email a representative of NASA if you have any doubts. Unfortunately, as of now do to the lack of US Government funding, you will only get this response:
"NASA is currently closed due to a lapse in government funding. I am in furlough status; therefore, I am unable to respond to your message at this time."

Stay safe out there
-R`/4N

Shop Amazon Gold Box - New Deals. Everyday

These "Royal Apps" create a Royal Pain

       Google Play still allows the most annoying of ad-ware to be distributed to Android devices.  Airpush and Leadbolt are still very popular and are becoming even more aggressive then ever before in pushing ads for money.  Examples like these "Royal Apps" from small unknown developers with no websites show up everyday.  These apps and ones like it are extremely flawed and most don't even have content other then the ads. Of the few that actually have content, it is even more rare to get one that gives the end user value.

Luckily for us though it isn't hard to spot an abusive Leadbolt or Airpush app. The ones on Google play will display a warning like the one to the left with an opt-out method.  Do not try to hit cancel then use the app it will still display the ads.  The Terms of Service (ToS) agreement has in the small print that activating that just starting the app is an agreement to display ads. Using the "opt-out" link will not help either as the push ads will start again after the app updates.  Please note that not all of the Leadbolt and Airpush apps follow the prescribed practice of using this ToS agreement and display ads anyway. It is ALWAYS a good idea to check app permissions and other user reviews BEFORE installing.  Upon reading the reviews below (and 100 more like them), it should be clear not to install this app.

If installed, prepare to be bombarded with thousands of these little icons that will appear every time the app starts and every time the device is reset. They will fill up the screens until there is no room left for more and keep coming back, even after deletion.

Clicking on any of them will bring up a webpage with even more advertising apps to download that will run even more apps for more ads.  Also be prepared to have random pop-ups for even more "shady" aps.  Like the one to the left for "Armour or Android", which purposely advertises on apps that it detects to make it look like the device is infected with something more threatening then just annoying ad-ware.

Examples of more pop-up ads below:

Stay safe out there
-R`/4N

NoCom malware is still spreading.

     A recent blog posting from Virus Bulletin has given updated information for an Android Trojan called NotCompatible that was first noticed by Lookout in May. Not much has changed since the original samples which can currently be found on Contagio Mobile. I got a chance to take a quick look at this new version, which can be downloaded here (Password = infected) after receiving some spam from a friend in my contact list with a Yahoo account.

   A quick overview shows that the link on the hacked site (this one is already inactive as these change about every 24 hours) when click on with anything other then an Android device will redirect to a scam designed to get the user to purchase a fake product. The link (hxxp://eefxxs[dot]com/) is a fake Fox News report on a "miracle" diet supplement.  I have informed Fox of the copyright infringement and will update the post if the fake Fox News Report has been removed.


  When clicked with an android device it will redirect and download the "Android Security Update".  Of-course never install anything that downloads seemingly out of no where and especially from a link in an email.
However, with the guises of an official security update and lack of permissions (The only permission it requires is use of the internet) a user may be tricked into installing this.

     Info for the sites this redirects to can be found on Virus Total's reverse IP lookup feature using the IPs:

• 46.19.139.21 (link to Virus Total)
• 46.19.139.22 (link to Virus Total)

    Once installed it runs in the background with no icon. It also takes up very little processing power and battery. How this app works is anytime the Android device connects to the internet the app will then announce itself to the Command and Control server and allow the device to be used as a TCP relay. The Android device can then be used as a Proxy to hide more criminal activity. It can potentially cause problems with devices on limited data plans or be used to steal unencrypted internet traffic through the device.

The current C&C server in this variation is:

hxxp://45362545233224[dot]ru/

Originally it used hxxp://notcompatible[dot]eu/, hence the name NotCompatible.

Stay safe out there
-R`/4N

Skip the Android malware & get a safe Trojan free factory unlocked iPhone! 

Shop Amazon - Unlocked iPhones

Android Ikangoo "Porn" Trojan

      Another variant of  Android trojan SmsReg has been spotted in the wild, This one called Ikangoo, and is named after the website it downloads from.

      "Dial/SmsReg!Android" is an application for mobile phones running Android which silently registers the victim to non-free services. It usually comes as a sexy or dating application, and silently sends SMS messages to particular short numbers that subscribe the victim to the corresponding service. The subscription is not free. Its costs depends on the victim's country and the service he/she subscribes to. For instance, it can go up to 10 dollars per month."

(http://www.fortiguard.com/search.php?action=detail_by_virus_name&data=Dial/SmsReg!Android)


      Like versions in the past this one uses adult porno videos that are actually hosted online for free.  It signs you up to a monthly fee on your phone bill silently.  If you don't have service you receive a pop-up telling you that you can't activate these in your area.

      The downloads of the different versions for language and "featured girl" can be found:


hxxp://android.ikangoo.es/apps/xvideoz/apks/COOL3/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/COOL4/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/JUANCA3/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/JUANCA4/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/JUANCA5/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/KAB/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/PUBLIC/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/REPOR2/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/TEST/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/XVIDEOZ/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks/XVIDEOZ/xvideoz2.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks3/XVIDEOZ/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks3/REPOR2/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks3/PUBLIC/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks3/JUANCA5/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks3/JUANCA4/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks3/JUANCA3/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks3/COOL4/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks3/COOL3/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks2/XVIDEOZ/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks2/TEST/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks2/REPOR2/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks2/PUBLIC/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks2/JUANCA5/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks2/JUANCA4/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks2/JUANCA3/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks2/COOL4/xvideoz.apk
hxxp://android.ikangoo.es/apps/xvideoz/apks2/COOL3/xvideoz.apk


      I would recommend to not download adult content on to your phone as it is not regulated by anyone.  However, the adult industry is huge and it is making its way into the Android markets There are safe "18+" apps out there if one is to look for them. With that said though be mindful of any app that claims to be free porn...  Google Play doesn't allow for nudity so any adult app must be downloaded in an alternate market.  These alternate markets are dangerous and full of the kind of malware that security experts warn about all the time, so at the very least download a mobile Antivirus and keep you device "STD" free. You can get them free right off the Amazon market worldwide.


Stay safe out there
-R`/4N

Android.RoidSec

There is a  new security blog post from WebRoot about an Android malware called RoidSec. I took a quick look at this APK which can be found at:
hxxp://pan.baidu{dot}com/share/link?shareid=175821&uk=3106407483
or you can download the APK here (pasword = infected).

A quick analysis finds that while it does send data to the C&C server below, it is currently ineffective as this site has gone down a while ago. Still it can be classified as malware as it does not give the specified benefit while hiding itself in the background and potentially leaking data to a domain that could become active or be updated in the future.

C&C Server: hxxp://roidsec{dot}com/


Stay safe out there
-R`/4N

Fake Google Market Forces Premium Sign-Up

     A blog post by ThreatTrack Security showed an example of another fake Google market.  This has been done so much in the past that it's easy to look past these threats.  I posted about fake markets in the past here and here. However, the apps located on this one has changed up the rules a tiny bit.  Instead of just sending a few premium SMS texts and being done with it, these sign you up to a daily service fee of 9.99 rubles a day. That's about 32 cents a day in U.S.dollar.  Over the course of a month or a year this will add up, especially if going unnoticed.

   As always the end user only receives apps that he or she would have received for free on the real Play Market or the Amazon App Market. Of course even Google can't keep all malware of it's market.  With the recent release of the BadNews Trojan on Google Play, even after all of the safeguards where put into place,  it shows that it is good practice to keep an updated Anti-Virus app installed.

The Fake Google Market can be found at: hxxp://play-android-markt.com/. (Live Link to Malware)

A bad app download Example (Live Malware):  hxxp://app.play-android-markt.com/files/get?filename=it.android.demi.elettronica&scheme=app&projectId=5585&namespace=wapcash&applicationName=ElectroDroid&url=http://androsportal.com&image=http://play-android-markt.com/play-android-markt.com/0/ru/images/icon_9010550421218012627_2.png&icon=http://play-android-markt.com/play-android-markt.com/0/ru/images/icon_9010550421218012627_1.png&size=509&theme=

The VirusTotal of the example can be found: here.

Stay safe out there
 -R`/4N

Android BadNews

      After checking out an Android malware sample listed by Lookout as Trojan:Android/BadNews, I found a lot of contention in the security community as to whether this is a Trojan or just adware gone bad.  The supposed command and control server at hxxp://androways.com is linked to the Russian Android adware company hxxp://mobidisplay.net. It looks like this ad company sends downloads to the installed Android device and one of them happened to be linked to some Android spyware. Check out the Virus Total link below to see that some Anti Virus list this as adware while others list this as a Trojan.  Either way these where on the Google Play store and could have been downloaded without the need to go to alternate markets.  The sample I studied specifically can be found here: hxxp://files2.freesoft.ru/rep/711324/live.photo.sharonstone.apk.

This is a good example for why it is necessary to have some sort of Anti Virus or analysis software on your Android device.

The original Post by Lookout here:
https://blog.lookout.com/blog/2013/04/19/the-bearer-of-badnews-malware-google-play/

Two Samples can be found here:
http://contagiominidump.blogspot.com/2013/04/badnews-android-adwaremalware-network.html

More samples can still be found in the wild here:
hxxp://freesoft.ru/?author=18604  (Russian Alternate market -- Malware Links)

Virus Total:
https://www.virustotal.com/en/file/9134ba9ce3e2a343de5abb986f04fa925a7032b5a842757d562afe3de0644a40/analysis/1366644359/


Stay safe out there
-R`/4N

Shop Amazon Software - New Norton 2013 - Get the Latest Protection 

Shop Amazon Gold Box - New Deals. Everyday 

Shop Amazon - Best Selling Products - Updated Every Hour

NVISO ApkScan

A new free APK analyzer entered the market in the last few weeks. http://apkscan.nviso.be/ does an epic job of dynamically analyzing an Android app and returning useful information for determining whether an app is safe or not.

I submitted a sample called Tank.apk (a known malware) and it came back with this:
http://apkscan.nviso.be/report/show/a7f9f6ec9edb19ae708369ec24e26d94
As you can see it came back with useful results including a list of websites it hits. This is still just in beta version and promises more dynamic analysis in the future. I would recommend using this over other free competitors on the market just for it's speed and ease of use alone.


Stay safe out there
-R`/4N

New Fake Gaming Apps.

   
     A new fake gaming site, hxxp://htc-play[dot]ru, that as of this time not a single Anti-Virus has blocked or even noticed, carries premium SMS sending apps. This brand new variant of Android Malware is simple yet effective. It poses as one of the top 25 paid games on the Android Market that you can get for free then sends three premium SMS texts in the background.  All the end-user will see is a small repeating animation stating that the game is loading.  The game will never load and it will send those three SMS texts every time the app is restarted.

      The download links below will download the fake games straight from the source.  USE CAUTION as these are unprotected live links to the APK Files.  I will do my best to monitor this in the future but be careful as live links can and do change.  Most new malware is polymorphic and adaptive so a different app may be received each time.  Please see my post here on methods to take precaution while downloading malware.

FEAR - hxxp://data-htc-play.ru/uploads/FEAR.apk
STALKER - hxxp://data-htc-play.ru/uploads/STALKER.apk
Postal 2 - hxxp://data-htc-play.ru/uploads/Postal_2.apk
Aliens vs Predator -http://data-htc-play.ru/uploads/AVP.apk
Doom 3 - hxxp://data-htc-play.ru/uploads/Doom3.apk
Real Racing 3 - hxxp://data-htc-play.ru/uploads/Real_Racing.apk
Asphalt Heat 7 - hxxp://data-htc-play.ru/uploads/Asphalt_7.apk
Bit Trip Beat - hxxp://data-htc-play.ru/uploads/Bit_Trip_Beat.apk
Max Payne - hxxp://data-htc-play.ru/uploads/Max_Payne.apk
Nova 3 - hxxp://data-htc-play.ru/uploads/Nova_3.apk
Bad Piggies - hxxp://data-htc-play.ru/uploads/Bad_Piggies.apk
Wild Blood - hxxp://data-htc-play.ru/uploads/Wild_Blood.apk
GTA 3 - hxxp://data-htc-play.ru/uploads/GTA_3.apk
Portal - hxxp://data-htc-play.ru/uploads/Portal.apk
Asphalt 8 Infinity - hxxp://data-htc-play.ru/uploads/Asphalt_8.apk
Shadowgun 2 - hxxp://data-htc-play.ru/uploads/Shadowgun_2.apk
FIFA 2013 - hxxp://data-htc-play.ru/uploads/FIFA_13.apk
NOVA 4 - hxxp://data-htc-play.ru/uploads/Nova4.apk
Lost Planet 2 - hxxp://data-htc-play.ru/uploads/Lost_Planet_2.apk
Kill Zone - hxxp://data-htc-play.ru/uploads/Kinllzone.apk
NFS Most Wanted 2 - hxxp://data-htc-play.ru/uploads/NFS_MW2.apk
Grand Theft Auto Vice City - hxxp://data-htc-play.ru/uploads/Gta_Vice_City.apk
Modern Combat 4 - http://data-htc-play.ru/uploads/Modern_Combat_4.apk
Angry Birds Space Premium -hxxp://data-htc-play.ru/uploads/Angry_Birds_Space.apk
Angry Birds Star Wars - hxxp://data-htc-play.ru/uploads/Angry_Birds_star_wars.apk

      Each one of these are customized with the game's in-game icons to look like a valid copy of the game being downloaded and only have one permission:

       To minimize chances of getting Android malware it is best practice to install a security or anti virus app and only download apps from valid markets, such as Google play or Amazon.

Stay safe out there
-R`/4N

Fake Job Offer

    A post from McAfee (http://blogs.mcafee.com/mcafee-labs/android-malware-goes-bollywood) about fake job offers on Android devices got my attention. The article was short, sweet and to the point but it lacked a few points about scams like this.  Scams like this have been around forever and they always involve asking you to send a little money for something of greater value.

    This one is no different and after doing a quick Google search I found that this version has been in inbox's since 2010. Take a look here at some complaints dating back three years.  As mobile becomes the more popular way to communicate, so will these types of scams. Just like the survey scams posted about here a few months ago, if current trends continue these types of phone scams will become more complex and real looking.

    Here is a link to the paper this scam goes to after the button that pops up is clicked when the Android device is restarted. Take precautions though, this is an uncensored link that could change to something more nefarious over time.

hxxp://ge{dot}tt/api/1/files/4TcQx7Z/0/blob/x675

For More information on this threat please visit it's Virus Total Report and samples can be downloaded from this Contagio Mobile post.

Stay safe out there
-R`/4N

0day Two Part Android OpFake Variant.

     The other day I ran into a fake Android store through a poisoned Yandex search engine link. The fake Android market at hxxp://www.android-appss[dot]ru/ is pushing never before seen downloader apps for a newer variation of OpFake.

     A downloaded APK of the popular Android game, Mass Effect: Infiltrator, and installed it.  The icon (displayed to the left)  was good and it even only asked for minimal permissions. However, directly after the install it loads an app that was downloaded in the background. This one however has a much more sinister motive. OpFake sends premium SMS and installs a backdoor on your Android device. Some more info about this version of Opfake can be found in a past blog posting here.

     The Virus Total results below for the downloader app show that not a singe Anti-Virus company pick this one up and the OpFake sample itself has a very minimal detection rate. This means that even with the best of Anti-Virus software you can still pick up a Trojan from these alternate markets.  It's best to stick to Google Play and not to download supposed free versions of games.

Virus Total results on the downloader
Virus Total results on the OpFake Sample
Captured samples


Stay safe out there
-R`/4N

Check out Valid Mass Effect Apps and Programs on Amazon.

GTA: Vice City Free Download Scam

   Another new Grand Theft Auto: Vice City app on the Google Play Store was removed last week after complaints. For the scammers and spammers Grand Theft Auto has always been a big target to push malware. Just recently a fake version of GTA 3 was pushing Adware for a quick buck. This one however, while is not as mischievous, still doesn't produce the goods it promises and will send you on a wild goose chase.

    While no longer on the Google Play Store, you can still download this sample from alternate Android markets, including 1mobile.  The description, icon, and screenshots are all valid, directly copied from the version that cost money on Google Play.  However, just from this market view you already get red flags.  There are over 19 thousand downloads but only 53 likes.  A valid free version of GTA would receive a lot more likes and shares then that.  Also the file size is way to small for a full game.  The biggest red flag is the company that posted it, Open Concept Inc,  is not a valid publisher of any GTA games.

    After downloading and running it, the chase to see if I can actually get a valid version of the game begins, and then ends pretty quickly. On the very first screen all you see is a note on how to unlock the full version of the game. The app sends you through a link: hxxp://btinc.info/t122. Which then redirects you to either: hxxp://bigbrandrewards.com/ggc/index.php or any one of "bigbrandrewards" other pages.  These are all just survey scams.  You can enter all the information you want and you will never get the full version of GTA for free.  The one it referred me to promises a 50 inch HDTV.

     Of course as with all survey scams the requirements to get these will cost much more then the value of anything received. This is not the first time and wont be the last that survey scams have been caught plagiarizing games on the Android markets. You can download some more samples of Android apps redirecting to survey scams here.
--------------------------------------
Direct link to the sample (Warning: This is an uncensored direct link and could harm your Android device):
http://f2.1mobile.com/
--------------------------------------
Stay safe out there
-R`/4N

Talking Tom Talks You Into SMS Fraud

The Russian market is now over-run with fake Android Apps. You can search the Russian search engine Yandex for just about any Android app you can think of and put the term "apk ru" (without the quotes) at the end of the app name and you are bound to get bad search results. They will scam you with every ploy in the book to get you to download and install. Promise you free versions of paid software, better versions of free software, security updates, software updates or even offer extra benefits with download.

This example a site claims to host a Russian language version of Talking Tom Cat.
The site can be found at:
hxxp://tom-talking-cat[dot]ru/.
The download at:  
hxxp://filegx.com/load/8924/Talking-Cat[dot]apk.
You may need to download on a mobile device or in Malzilla with a Android user agent. Check here for a how-to.

Instead of a talking Russian cat, you get the same old SMS scam that has been re-hashed for over a year now. The Virus Total results confirm that this is just garbage and the screenshot to the right shows that you aren't getting a talking cat. It's worth a note that this is the same fake opera scam that first started it all.

To stay protected make sure to download good antivirus software for your phone.

Stay safe out there
-R`/4N

Shop Amazon Gold Box - New Deals. Everyday

Leadbolt Adware in Fraudulent "Cracked" apps.

A good article from GFI Labs shows the danger in downloading Android apps that advertise as being Cracked. Another review by Threatpost gives more information as well. The samples that can be found at getwapi[dot]com is just one of many apps that advertise cracks for paid software. You have to be very careful downloading stuff off alternate markets as  lot of "cracked" software can lead to stuff much more dangerous then just adware.  PJAPPS, which are valid software with malicious code added, can cost money and cause significant data loss.




After searching the site myself for a sample of the "cracked" software, I found that they where hosting apps on 4shared and it looks like they removed all of the fraudulent apps from the above GFI article.

"'MB Notifications for Facebook.apk' is unavailable. This file is no longer available because it's identical to file banned because of claim."

Luckily for me I managed to snag a copy before they where all removed. You can download the copy here. If you take a look at its Virus Total results you can see that it is LeadBolt adware. Leadbot, like most adware programs leaks data and can cause a massive drain on the battery of a device at the same time as hijacking ads and pushing new ads. Getting multiple copies of these apps running at the same time can cause a lot of confusion and be very annoying. Too many copies of this type of advertising and the android device will crash or become corrupt.

 I don't think that we will see the last of apps like this as already a sister site called runamux[dot]net has already been created and is hosting similar apps.  The best way is to not become infected with malware is to refrain from downloading potentially stolen apps from alternate sources. However, if you are going to "play" outside the confines of official markets like Google Play or Amazon, remember to download and protect your device with an antivirus mobile suite. Check out my blog post here for a few ideas or scroll to the bottom of the site for a list of free ones from Amazon.


Stay safe out there
-R`/4N

Android.Troj.mdk AKA Android.ksapp

There's a lot press and scare tactics that originated from an article at threatpost today.  After reading the article and the translated article straight from China, I decided to take a look for some samples myself.  After scouring the internet, I got a few samples to check out, and I found that this is nothing more then a new variation of Ksapp. Ksapp is a bot-net that can be used to download new programs or launch a DDOS attack from Android devices and is bundled with hacked legitimate applications and spammed out to the alternate Chinese markets.

This new one is not that much different, except the C&C servers have changed and it downloads a secondary hidden program in-case you delete the first one.

The new C&C servers can be found at:
hxxp://wap.juliu[dot]net/control.html?
hxxp://app.looking3g[dot]com:30125/serv?

Also, you can download the secondary APK at:

hxxp://app.looking3g[dot]com:30211/t/dha.so

(please note these are live UNCENSORED links and may not be active forever.)

So, remember to always use known safe markets and download and install a mobile Antivirus.  It looks like for this one ESET is the only one detecting it as of now.

Stay safe out there -R`/4N

Sorta Fake Anti Virus "Android Armour"

A post Today on Sophos Caught my attention and I decided to take a look at this myself. So, I went to the website, http://androidarmour.com/, to invastigate further. This is one big scam and I don't think it will take too long for most to catch on. As it stands now it looks like only Sophos and Eset detect these, but I doubt it wont be long before they all do. Just like the article said it deep scans every file on your device by sending each one over to Virus Total, a FREE scanning site by the way, then it charges you 99 cents a week for a service which you could do for free.  While this could be beneficial it sets your phone up to all kind of weird things like deletion of false positives by any of the numerous scanners on Virus Total, some of which are specialized to the needs of a few corporations.  But what the Sophos article didn't explain in-depth is that it also sets you up to have your private info leaked all over the internet.
 
What Virus Total does, which by the way is owned by Google, is publicly scan a file against all active virus scanners in it's database.  It also saves all files submitted in a massive "malware" database for "private" use by security professionals. So, you just got those naked pics for your boyfriend or girlfriend and saved them on your phone with "Android Armour" installed, or even worse (yes worse then that!!!) you saved an earnings report to work on at lunch or you used your phone with a credit card machine to pay your bills. So, now all of those files are now owned by Virus Total, Google, and every other security company or professional that pays Virus Total for access to downloads.  I hope you don't mind a bunch of geeks in an office somewhere goggling over your girls naked chest while your leaked earnings report causes stocks to plummet and your credit card info is being used to make a purchase at Macy's. While that's an extreme example, any company that claims to be a security company and an anti-malware company needs to tell you what they do with your data if they take it all.

So... they are just sending data to another security company, one owned by Google, non the less and this still could be beneficial and very time saving to have my files scanned against every major AV company there is, right? No, what Sophos either field to mention or didn't notice is that your personal information is also being tracked and sent to an advertiser at https://mixpanel.com/.  Check out what mixpanel does in this mashable article.

To check out this APK yourself, you can download it from here.  This is an uncensored link diretly to the malware page, so don't actually install it on your device. It can be a real pain to uninstall as it requires admin privileges. Don't worry about the animation, it's all for show, and whatever you do, don't pay for the service. The service is an "opt-out" where you get billed then have to reduce to the free one within a certain amount of time and the only way to stop billing is...

“Your AndroidArmour.com Premium Account will continue in effect unless and until you cancel your premium Account or we terminate it. You must cancel your Premium Account before it renews each month, as applicable, in order to avoid billing of the next month’s to your credit card. If you wish to cancel your Premium Account you may do so by calling Customer Support: 1-800-910-6786.”

Stay safe out there
-R`/4N

Remember to stay safe and stay protected out there.
You can get all the best security software for your Android, PC, or anything else at Amazon for cheap.

The Jellybean Security Failure

Google's app scanner built into it's new Android Jellybean operating system has recently failed miserably during independent security testing. You can read the whole article at www.csoonline.com and see the whole independent study By Xuxian Jiang, Associate Professor, Department of Computer Science at NC State University. Remember to keep yourself safe by installing independent Antivirus software. You can check out my review of the top mobile antivirus solutions here or scroll to the buttom of the page and check out the free ones hosted by Amazon.



 Stay safe out there
-R`/4N