Android user check if your device vendor has a fix for bug StrandHogg 2.0 (CVE-2020-0096)- Similar to previously discovered StrandHogg but more dangerous and more difficult to detect. Attackers can access SMS messages and photos, swipe login credentials, track GPS movements, record phone conversations, access the camera and microphone, and review contact lists and phone logs.

https://www.scmagazine.com/home/security-news/vulnerabilities/strandhogg-2-0-bug-enables-android-app-hijacking-poses-patching-challenge/

Attention Samsung fans - Vendor has released a security update for its smartphones. It includes a critical fix for a vulnerability that affects all devices sold by the manufacturer since 2014 (yes, the vulnerability existed for last 6 years)

https://www.tripwire.com/state-of-security/security-data-protection/six-years-samsung-smartphone-users-risk-critical-security-bug-patch-now/

Exciting(/scary) feature(/bug) in Android - Secretly take pictures or record video -- even if your device is locked.

Google is strict when it comes to mobile applications obtaining access to sensitive information from camera, microphone, or location services. As a result, users must accept permission requests, but in Checkmarx's attack scenario, these requirements are bypassed.


https://www.zdnet.com/article/android-vulnerability-lets-rogue-apps-take-photos-record-video-even-if-your-phone-is-locked/

Spearphone Attack - New Attack Lets Android Apps Capture Loudspeaker Data Without Any Permission

A separate team of cybersecurity researchers has successfully demonstrated a new side-channel attack that could allow malicious apps to eavesdrop on the voice coming out of your smartphone's loudspeakers without requiring any device permission.

Dubbed Spearphone, the newly demonstrated attack takes advantage of a hardware-based motion sensor, called an accelerometer, which comes built into most Android devices and can be unrestrictedly accessed by any app installed on a device even with zero permissions.


https://thehackernews.com/2019/07/android-side-channel-attacks.html

Attention please !! - Hackers Can Manipulate Media Files You Receive Via WhatsApp and Telegram

Dubbed "Media File Jacking," the attack leverages an already known fact that any app installed on a device can access and rewrite files saved in the external storage, including files saved by other apps installed on the same device.

Security researchers at Symantec yesterday demonstrated multiple interesting attack scenarios against WhatsApp and Telegram Android apps, which could allow malicious actors to spread fake news or scam users into sending payments to wrong accounts.

https://thehackernews.com/2019/07/media-files-whatsapp-telegram.html

Why is it that bad guy seem to be more innovative in the Security Space - New technique to detect Sandbox

 malicious Android apps in the official Google Play Store are using the motion-sensors of infected devices. If the apps fail to detect any movement (which is - of course - unlikely in a sandbox environment in a research lab!), they refuse to activate their malicious payload.
If, however, there has been movement, the apps display a fake system update dialog which attempts to trick the poor user into installing a piece of banking malware called Anubis

https://www.grahamcluley.com/android-malware-motion-sensor/

Are you sure that the app on your Android device is not a Trojan? - "Triout" spyware when repackaged with a valid version of the Android app keeps the appearance and feel of the original app and function exactly like it.

According to the researcher, Triout can perform many spying operations once it compromises a system, including:

• Recording every phone call, saving it in the form of a media file, and then sending it together with the caller id to a remote C&C server.
• Logging every incoming SMS message to the remote C&C server.
• Sending all call logs (with name, number, date, type, and duration) to the C&C server.
• Sending every picture and video to the attackers whenever the user snaps a photo or record video, either with the front or rear camera.
• Capability to hide itself on the infected device.

https://thehackernews.com/2018/08/android-malware-spyware.html

Even Google’s own developers don’t necessarily follow Android Security guidelines.” So, we have a new "Man in the Disk" Attack - Which allows a bad actor to hijack the communications between privileged apps and the device disk, bypassing sandbox protections to gain access to app functions and potentially wreak havoc

“Some of the apps in question are made by Google themselves,” said Gan. “So even Google’s own developers don’t necessarily follow Android guidelines.”

Android’s OS makes use of two types of storage – internal storage which provides every app with its own sandbox; and an external storage mechanism that uses a removable SD card. This latter storage is shared across the OS, because it’s designed to enable apps to transfer data from one app to another. So, if a user takes a picture and then wants to send it to someone using a messaging app, the external storage is the platform that allows this to happen.


Google provides developer guidelines meant to provide a road map for security best practices. These include advice such as never writing critical data files to the external storage, and not using it to store executables or files that impact the way apps operate. Also, external storage files should be signed and cryptographically verified prior to dynamic loading,

In fact, roughly half of the Android apps in Google Play that Check Point examined did not comply with the guidelines. The firm examined Google Translate, Yandex Translate, Google Voice Typing, Google Text-to-Speech and Xiaomi Browser, among others.



https://threatpost.com/def-con-2018-man-in-the-disk-attack-surface-affects-all-android-phones/134993/

Some Android apps share image and video data with other parties in unexpected ways, without user knowledge or consent

Example: GoPuff records the screen and sends a video of the interaction to a domain owned by the third-party analytics company, Appsee, as soon as the app starts.

Another app used the camera-taking abilities of a mobile beta-testing platform found on Google Play, TestFairy, to record users interactions through screenshots.

“Screen recording, if adopted at scale and/or in apps that handle sensitive data, could expose substantial amounts of users’ PII, especially when the full burden of securing private information is placed on developers,” the researchers said. “Further, we argue that the recording of interactions with an app (without user knowledge) is itself a privacy violation akin to recording audio or video of the user.”

https://threatpost.com/android-app-are-sharing-screenshots-video-recordings-to-third-parties-report-finds/133686/

Samsung phone users reported that their devices are randomly sending camera roll photos to their contacts without permission. (maybe , it is "machine learning" combined with a feature called "machine sending")

One user on Reddit claimed that their Samsung Galaxy S9 Plus sent an entire photo gallery but there was no record of it, and was only able to see a record of it on T-Mobile logs. Meanwhile, another user took to Samsung’s forum to allege “premature sending” on their Galaxy S9 smartphone.

https://threatpost.com/samsung-investigates-claims-of-spontaneous-texting-of-images-to-contacts/133675/

In the computer world the word "Debug" generally means, it is "temporary" and meant for troubleshooting Unfortunately, Countless Android devices including DVRs, mobile telephones, Android smart TVs, and even tankers are are open to attack after being shipped with a debug port (TCP 5555) left unsecured

In the computer world the word "Debug" generally means, it is "temporary" and meant for troubleshooting Unfortunately, Countless Android devices including DVRs, mobile telephones, Android smart TVs, and even tankers are are open to attack after being shipped with a debug port (TCP 5555) left unsecureds, silently install software, and execute malicious code, without any need for a password.

Android Debug Bridge (ADB) is a feature that allows developers to communicate with an Android device remotely, executing commands, and – if necessary – taking full remote control.

A network worm called ADB.Miner has been seen scanning across the internet to see where TCP port 5555 used by ADB has been left open, in an attempt to create a cryptomining botnet.

https://hotforsecurity.bitdefender.com/blog/tens-of-thousands-of-android-devices-are-leaving-their-debug-port-exposed-20012.html

Why go through all the trouble to download Malware, why not just get it pre-installed. More than 100 different low-cost Android models from manufacturers such as ZTE, Archos, and myPhone ship with malware pre-installed.

Avast has found that many low-cost, non-Google-certifed Android  phones shipped with a strain of malware built in that could send users to download apps they didn’t intend to access. The malware, called called Cosiloon, overlays advertisements over the operating system in order to promote apps or even trick users into downloading apps

The app consists of a dropper and a payload. “The dropper is a small application with no obfuscation, located on the /system partition of affected devices. The app is completely passive, only visible to the user in the list of system applications under ‘settings.’ We have seen the dropper with two different names, ‘CrashService’ and ‘ImeMess,'” wrote Avast. The dropper then connects with a website to grab the payloads that the hackers wish to install on the phone.


https://techcrunch.com/2018/05/24/some-low-cost-android-phones-shipped-with-malware-built-in/

Message bomb for Android Phones

 Involves sending and receiving a specially crafted (whatsapp) message with hidden symbols in-between spaces. Tapping on a portion of the text will basically make the app 'expand' the hidden symbols, potentially overloading the app and even the OS

A bug is being forwarded via WhatsApp messages which when tapped, could send not just the Android app crashing but possibly even the entire Android device as well



Another "message bomb" which is causing the messaging platform to crash is more "nefarious, looks too innocent" and does not come with a warning. The message includes special characters followed by an emoji that do not display visibly but are used to change text behaviour. The message, containing the text "This is very interesting!" is followed by a crying laughing emoji at the end. As per a Reddit user, the message is so heavy that it is crashing the smartphone upon copying and pasting on another chat box. The string of characters, leading to the enormous size of the message is what is expected to be crashing the app.


http://www.ehackingnews.com/2018/05/new-whatsapp-message-can-crash-your-app.html

On your smartphone, Is it possible to deliver Malware via your browser without downloading an app? - Yes using an old technique called "row hammering" ,the researchers call it "Glitch" attack.

Greatly simplified, row hammering means reading the same DRAM memory addresses over and over again

Aim: pull off a row hammering attack in the browser, using nothing more than JavaScript served up in a web page.

They figured out how to align their “hammerable row” with a JavaScript array in such a way that random bit flips in the array might, with a bit of luck, give them read and write access to memory in ways that JavaScript is supposed to prevent.

That means not only data leakage by reading from memory that’s supposed to be private, but also the possibility of remote code execution (RCE) by poking machine code into protected memory and then running it. 


https://nakedsecurity.sophos.com/2018/05/05/serious-security-the-glitch-row-hammering-attack/

New jargon "Patch Gap", "SnoopSnitch" - Clue - they are related to Android phones. Example -Samsung's 2016 J3 claimed to have every Android patch issued in 2017 but lacked 12 of them—two considered as "critical" for the phone's security.

Patch Gap - Gap between patching claims and the actual patches installed on a device.

SnoopSnitch  - App that will let users check their phone's code for the actual state of its security updates.

Researchers found  what they call a "patch gap": In many cases, certain vendors' phones would tell users that they had all of Android's security patches up to a certain date, while in reality missing as many as a dozen patches from that period—leaving phones vulnerable to a broad collection of known hacking techniques.


Researcher found Android phone vendors tell users their Device's firmware is fully up to date, even while they've secretly skipped patches.Sometimes these guys just change the date without installing any patches

Here is some good news - Hacking Android phones by exploiting their missing patches is far harder than it sounds. Even Android phones that don't have solid patching records still benefit from Android's broader security measures



https://www.wired.com/story/android-phones-hide-missed-security-updates-from-you/

Android Users - Don't fall prey to the new malware shows up as QR reading Utility in App Store

.
This malware not only pops up advertising web pages, but can also send Android notifications, including clickable links, to lure you into generating ad revenue for the criminals.

First, the apps were, at least on the surface, what they claimed: six were QR code reading apps; one was a so-called “smart compass”.

Second, the crooks didn’t fire up the adware part of their apps right away, lurking innocently for a few hours before unleashing a barrage of ads.

Third, the adware part of each app was embedded in what looks at first sight like a standard Android programming library that was itself embedded in the app.



https://nakedsecurity.sophos.com/2018/03/23/crooks-infiltrate-google-play-with-malware-lurking-in-qr-reading-utilities/

Google - We don't need your permission to collect your location information

Google has been caught collecting location data on every Android device owner since the beginning of this year (that's for the past 11 months)—even when location services are entirely disabled.

All it wants is to have your Android device to be connected to the Internet.

Each time your Android device comes within the range of a new cell tower, it gathers the cell tower address and sends this data back to Google when the device is connected to a WiFi network or has a cellular data enabled

For More:
https://thehackernews.com/2017/11/android-location-tracking.html

Do you have Lolipop, Nougat or Marshmallow (I meant Android OS, NOT those tasty eatables) then you should read this. it seems 77.5% of Android systems at risk.

Since a majority of Android devices nowadays have these three versions of the OS, therefore, around 77.5% of the Android devices are at risk.

The MediaProjection service can be exploited due to a critical flaw. The service is designed to capture user’s screen and record system audio.


Android’s MediaProjection service has existed since long, but apps needed root access and signed up with the release keys of the device in order to use the service
But when Android Lolipop 5.0 was released, Google made this service open to everyone but did not secure it with the requirement of permission from the users

For More
https://www.hackread.com/android-flaw-lets-attacker-capture-screen-record-audio/

Android Phone users watchout for DoubleLocker - As you guessed it locks (after encrypting your Android phone) and demands Ransom

The ransomware has been named DoubleLocker because it performs a two-way action to lock the phone, that is, it encrypts all the files and changes the PIN as well so that victims run out of options and give in to the ransom demands of hackers. The ransomware is being distributed as a fake update of Adobe Flash while compromised websites are being used to spread it.

The fake Adobe Flash app requests for Google Play Services activation because it needs to exploit the phone’s accessibility services

It then starts exploiting the permissions by retrieving Windows content, enabling advanced web accessibility for installation of scripts and monitoring the text that the victim types. When permissions are granted, the ransomware is installed as the default Home app. This means when the user will visit Home screen the next time the ransom note will be there.

For more info:
https://www.hackread.com/new-android-ransomware-permanently-changes-pin-demand-ransom/

Interesting (and a bit scary) - Red Alert 2.0 (Trojan) can block incoming calls (from my Bank?)

How come the people who make products can't be this smart



Red Alert 2.0 (Trojan) continues to be updated with functionality recently added to block incoming calls from banks, including those which may be from financial fraud departments investigating potential malicious activity.


More here:
https://www.tripwire.com/state-of-security/featured/red-alert-android-banking-trojan/