One Billion Android Devices Vulnerable to Privilege Escalation

3/20/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCiKD_FEhu-RQVAa_lJ175vL01h9hBVKcmksZDJLCNNost1SUk2Mb4fOMJXs7a5tTxpzmB8x46z9taLlE9PjL1holFpeN3qdVlDF5z2Du49R-I_DiGlo_8J20Wi4vHFhnpZw0lswFNmGVU/s1600/android+vulnerability.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="One Billion Android Devices Vulnerable to Privilege Escalation" border="0" height="235" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCiKD_FEhu-RQVAa_lJ175vL01h9hBVKcmksZDJLCNNost1SUk2Mb4fOMJXs7a5tTxpzmB8x46z9taLlE9PjL1holFpeN3qdVlDF5z2Du49R-I_DiGlo_8J20Wi4vHFhnpZw0lswFNmGVU/s1600/android+vulnerability.png" title="One Billion Android Devices Vulnerable to Privilege Escalation" width="400" /></a></div>
<br />
The first deep look into the security of the <a href="http://www.hackerschronicle.com/search/label/Android">Android</a> patch installation process, specifically its Package Management Service (PMS), has revealed a weakness that puts potentially every Android device at risk for <a href="http://www.hackerschronicle.com/search/label/Privilege%20Escalation">privilege escalation attacks</a>.<br />
<br />
 Researchers from Indiana University and <a href="http://www.hackerschronicle.com/search/label/Microsoft">Microsoft</a> published a paper that describes a new set of Android vulnerabilities they call Pileup flaws, and also introduces a new scanner called SecUP that detects <a href="http://www.hackerschronicle.com/search/label/Malwares">malicious</a> apps already on a device lying in wait for elevated privileges.<br />
<br />
 The vulnerability occurs in the way PMS handles updates to the myriad flavors of Android in circulation today. The researchers say PMS improperly vets apps on lower versions of Android that request OS or app privileges that may not exist on the older Android version, but are granted automatically once the system is updated.<br />
<br />
 The researchers said they found a half-dozen different Pileup flaws within Android’s Package Management Service, and confirmed those vulnerabilities are present in all Android <a href="http://www.hackerschronicle.com/search/label/Open%20Source">Open Source</a> Project versions and more than <span class="highlight pop">3,500</span> customized versions of Android developed by handset makers and carriers; more than one billion Android devices are likely impacted, they said.<br />
<br />
 An attacker could use a malicious application to <a href="http://www.hackerschronicle.com/search/label/Exploit">exploit</a> this situation to access data on the device such as user credentials, activity logs, SMS data. The researchers also said a successful attack could also give a hacker control of new signature and system permission, leading to a deeper level of trouble.<br />
<br />
 The paper, “<a href="http://www.informatics.indiana.edu/xw7/papers/privilegescalationthroughandroidupdating.pdf" target="_blank">Upgrading Your Android, Elevating My Malware: Privilege Escalation Through Mobile OS Updating</a>,” was written by Luyi Xing, Xiaorui Pan, Kan Yuan and XiaoFeng Wang of Indiana University Bloomington and Rui Wang of Microsoft. The frequency of Android updates—estimated to be on average of every 3½ months— and the fragmentation of the Android market make it close to impossible to adequately secure devices, the researchers said.  “Every few months, an update is released, which causes replacement and addition of tens of thousands of files on a live system. Each of the new apps being installed needs to be carefully configured to set its attributes within its own sandboxes and its privileges in the system, without accidentally damaging existing apps and the user data they keep,” the researchers wrote. “This complicates the program logic for installing such mobile updates, making it susceptible to security-critical flaws.”<br />
<br />
 Pileup flaws, short for privilege escalation through updating, ramp up the permissions given to malicious apps once Android is updated without raising an alarm to the user. “Through the app running on a lower version of Android, the adversary can strategically claim a set of carefully selected privileges or attributes only available on the higher OS version,” the researchers wrote.<br />
<br />
 The paper said customized versions of Android, such as those developed by device makers and carriers, are especially vulnerable to Pileup attacks. The researchers said manufacturers are purposely conservative with regard to updates so as not to interfere with the user experience. Users who have apps currently installed, for example, expect them to work seamlessly after OS updates and upgrades; that means data and features must transfer. An attacker can get a seemingly benign app on a device that requests privileges not present on the lower OS version. Generally, the Package Management Service must compare the privileges present between updates and will generally grandfather in existing permission requests so as not to interfere with functionality.<br />
<br />
 “A third-party package attribute or property, which bears the name of its system counterpart, can be elevated to a system one during the updating shuffle-up where all apps are installed or reinstalled, and all system configurations are reset,” the paper said. “Also, when two apps from old and new systems are merged as described above, security risks can also be brought in when the one on the original system turns out to be malicious.”<br />
<br />
 Upon an <a href="http://www.hackerschronicle.com/search/label/OS">OS</a> upgrade, the PMS will install new and existing system apps, including third-party apps, and will register the permissions they declare. That means for a malicious app, the PMS recognizes all the permissions it requests and those are silently granted because it supposes that permissions with an existing app have already been approved by the user.<br />
<br />
 All of the issues have been reported to <a href="http://www.hackerschronicle.com/search/label/Google">Google</a>, the researchers said; Google has already patched one of the six vulnerabilities.<br />
<br />
 As for the team’s SecUP scanner, it inspects Android APKs already installed on a device, identifying those that are likely to cause privilege escalations during an update, the paper said. SecUP is made up of a number of components, including a vulnerability detector, exploit opportunity analyzer and a risk database, in addition to the scanner app, the paper said.<br />
<br />
 “The detector verifies the source code of PMS (from different Android versions) to identify any violation of a set of security constraints, in which we expect that the attributes, properties (name, permission, UID, etc.) and data of a third-party app will not affect the installation and configurations of system apps during an update,” the researchers wrote. “A Pileup flaw is detected once any of those constraints are breached.”<br />
<br />
 The analyzer then kicks in and searches Android factory images for places where privilege escalation could happen; that information is stored in the risk database. The scanner app uses that database to check third-party apps and alerts the user to any potential risks. </div>

The first deep look into the security of the Android patch installation process, specifically its Package Management Service (PMS), h...

Beware of fake TOR Browser

3/20/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiBt1QSL4HNFa20maeD7wyQDw2r2V4OHLUj5f8HZFqobA9UOzm1cs5sK2XQY5LjYLr0yRTjR3rmAHmXEZgZC4M374lwKSPLPDWMAeYjI3MKtAZdb9EtYBhMOkviwmdrVFwVTWCKM5OFj-k/s1600/fake+tor+browser.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="207" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiBt1QSL4HNFa20maeD7wyQDw2r2V4OHLUj5f8HZFqobA9UOzm1cs5sK2XQY5LjYLr0yRTjR3rmAHmXEZgZC4M374lwKSPLPDWMAeYjI3MKtAZdb9EtYBhMOkviwmdrVFwVTWCKM5OFj-k/s1600/fake+tor+browser.png" width="320" /></a></div>
Members of the Tor anonymity service are warning that a <a href="http://www.hackerschronicle.com/search/label/Tor">Tor</a> iOS app available in Apple's highly curated App Store since November is a fake that is laced with adware and spyware.<br />
<br />
"Tor Browser in the <a href="http://www.hackerschronicle.com/search/label/Apple">Apple</a> App Store is fake," a <a href="https://trac.torproject.org/projects/tor/ticket/10549">report ticket published two months ago</a> on the Tor website by high-ranking volunteer Phobos stated. "It's full of adware and spyware. Two users have called to complain. We should have it removed."<br />
<br />
The ticket went on to say that Tor officials notified Apple of the <a href="https://itunes.apple.com/us/app/tor-browser/id712805884?mt=8">fake Tor Browser app</a> in December. In the intervening time, the app has remained available, touching off a series of exchanges among Tor members about how to respond. Ars was unable to confirm the claims of <a href="http://www.hackerschronicle.com/search/label/Malware">adware</a> or spyware. Still, the incident highlights the lack of transparency in the way that Apple vets the reliability of security apps and responds to complaints of rogue titles.<br />
<br />
"Apple responded today with chance for author to defend their app," one volunteer wrote shortly after the ticket was opened. "Sent another email to appstorenotices@," Phobos replied a few weeks later.<br />
Early Wednesday, some two months later, yet another Tor member wrote: "I think naming and shaming is now in order. Apple has been putting users at risk for months now." Another member quickly replied: "I mailed Window Snyder and Jon Callas to see if they can get us past the bureaucracy. Otherwise I guess plan C is to get high-profile people on Twitter to ask Apple why it likes harming people who care about privacy. (I hope plan B works.)"<br />
<br />
(Window Snyder and Jon Callas are both highly respected security researchers who have worked for Apple in the past. Callas has since left the company and is an executive with Silent Circle. <strong>Update:</strong> Snyder still works for the Cupertino company. In the past, she has worked for both <a href="http://www.hackerschronicle.com/search/label/Microsoft" target="_blank">Microsoft</a> and <a href="http://www.hackerschronicle.com/search/label/Mozilla" target="_blank">Mozilla</a>.)<br />
<h3>
Secret garden</h3>
Apple's App Store has long been referred to by critics and fans alike as a walled garden. The metaphor is used to describe the highly controlled environment of the official iOS app bazaar. Presumably, apps submitted by third-party developers are carefully scrutinized before they become available. That's in sharp contrast to the official Google Play store for Android, which is much less selective and where rogue or malicious apps regularly slip through the vetting process.<br />
<br />
Apple has never described exactly what its process is for ensuring the titles in its App Store are safe. Although the comparatively fewer reports of rogue apps for iOS suggest that the review process is more stringent than Google's, the report ticket from Tor's high-ranking members suggests that Apple may not be doing everything it can or should do to protect iPhone and iPad users.<br />
<br />
Fortunately, the <a href="http://www.hackerschronicle.com/search/label/Tor%20Browser">Tor Browser</a> app at issue has been downloaded a relatively small number of times, and so far there are no reports one way or the other that its behavior represents a serious threat to the people who have installed it. Still, its availability raises questions about exactly what Apple does to ensure the security and authenticity of other apps it hosts on its own servers. This article will be updated if Apple officials, who are routinely silent on such matters, respond to our request for comment.</div>

Fake Tools Tor Tor Browser Beware of fake TOR Browser

Members of the Tor anonymity service are warning that a Tor iOS app available in Apple's highly curated App Store since November is ...

Remote Code Execution vulnerability in Yahoo

3/19/2014 The Hackers Chronicle 0

Remote Code Execution Vulnerability XSS Yahoo Remote Code Execution vulnerability in Yahoo

Security researcher Behrouz Sadeghipour has identified a number of vulnerabilities on a Hong Kong subdomain of Yahoo ( hk.yahoo.net )....

Now Test your eyesight with your smatphone

3/19/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBpZPEs_4lySm95h_0ctfxcFyp0sypCOg5m8ZKYau_UDhgAvyXKuVmOZM1h3KXZ4tsOChZRMWRJk2si7O38spTIa08M6OKiWXZJuWSRHq4EpD2-wJrLGFdZ73y0iaZcIrc7s8GkZXS0IeT/s1600/smartphone+eye+testing.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBpZPEs_4lySm95h_0ctfxcFyp0sypCOg5m8ZKYau_UDhgAvyXKuVmOZM1h3KXZ4tsOChZRMWRJk2si7O38spTIa08M6OKiWXZJuWSRHq4EpD2-wJrLGFdZ73y0iaZcIrc7s8GkZXS0IeT/s1600/smartphone+eye+testing.jpg" width="252" /></a></div>
Apps and downloads are old hat. The <a href="http://www.hackerschronicle.com/search/label/Mobile">smartphone</a> can now be adapted to test a person's eyes, and is claimed to be India's first mobile phone <a href="http://en.wikipedia.org/wiki/Ophthalmoscopy">ophthalmoscope</a>.<br />
<br />
The phone-cum-scope can capture high-quality photographs of the retina in the eye to detect defects. Converting the smartphone to an ophthalmoscope is quick and easy: fix an LED bulb near the camera of the mobile, a connecting wire and battery. It costs not more than Rs 35-50. The device was invented by ophthalmologists of <a href="http://www.sankaraeye.com/">Sankara Eye Hospital</a>. These pictures can then be sent to doctors for diagnosis.<br />
<br />
"We aren't sure if patients can use it themselves. But it helps eye specialists in rural areas who probably don't have high-end ophthalmoscopes. We are networking with doctors in rural areas who can send us photographs of patients' eyes taken through a mobile phone, that can help evaluate the disorder. We've had cases of eye tumours, glaucoma and other disorders related to the optic nerve, detected through photos taken from mobile phones with a minimum 5-mega pixel camera," said <span class="highlight pop">Dr Divyansh K Mishra</span>, retina fellow, Sankara Eye Hospital, who was one among the doctors who invented the new technique.<br />
<br />
A team of ophthalmologists consisting of <span class="highlight pop">Dr Mishra</span>, <span class="highlight pop">Dr Madhu Kumar</span>, <span class="highlight pop">Dr Rajesh R</span> , <span class="highlight pop">Dr Srinivasulu Reddy</span> and <span class="highlight pop">Dr Gladys Rodregues</span>, led by <span class="highlight pop">Dr Mahesh P Shanmugam</span>, is the think-tank behind this innovation.<br />
<br />
Back in 2002, <span class="highlight pop">Dr Shanmugam</span> had tried taking pictures of eyes through a handycam. "Technology is now advanced and some cell phones have 21 pixels. We won't stop using ophthalmoscopes but this is an added advantage. Eye care field technicians can now immediately diagnose a serious eye condition as they're able to instantly send images of the patient's retina to doctors in the city, via social networking sites," said Dr Mishra.<br />
<h3>
MIT's mobile gadget</h3>
In 2010, a team of students from <a href="http://web.mit.edu/" target="_blank">Massachusetts Institute of Technology</a> came up with a device to be attached to a mobile phone that can test the visibility of eyes and find out the refractive errors. It was called <a href="http://en.wikipedia.org/wiki/DRDO_Netra" target="_blank">NETRA</a> (Near-Eye Tool for Refractive Assessment). The user has to place the device in front of the eye and look into the lens attached to the phone. While pressing the arrow keys, the user can see green and red lines which overlap. The same process is repeated eight times, with the formation of green and red lines on the screen at different angles. The assessment of the eyes is done based on the visual index and prescriptions are made based on the same.
<br />
Source: <a href="http://timesofindia.indiatimes.com/" rel="nofollow" target="_blank">TOI</a></div>

Gadgets Mobile NETRA ophthalmoscope Technology Now Test your eyesight with your smatphone

Apps and downloads are old hat. The smartphone can now be adapted to test a person's eyes, and is claimed to be India's first mo...

Toyota, Renault and Chevrolet Hacked by Pakistani Hackers

3/19/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLm9kPncC30uf-n5pYPDb6Ub7tND2BmIeLKF9N69iYIY1FpKrSdsx76uKYg-dPLG1lwaf1Nf3XbG4yWyS3FdmMyLnRHS9_CwOy524PJ7hSUi-5uUOj6bC_eZYwJkFu2-NXuug907s7Gxmr/s1600/Toyota+hacked.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="131" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLm9kPncC30uf-n5pYPDb6Ub7tND2BmIeLKF9N69iYIY1FpKrSdsx76uKYg-dPLG1lwaf1Nf3XbG4yWyS3FdmMyLnRHS9_CwOy524PJ7hSUi-5uUOj6bC_eZYwJkFu2-NXuug907s7Gxmr/s1600/Toyota+hacked.PNG" width="320" /></a></div>
<em><a href="http://zone-h.com/archive/notifier=Algeriano" target="_blank">Algeriano</a></em> a hacker from Team Cyber Criminals a group of <a href="http://www.hackerschronicle.com/search/label/Pakistani%20Hackers" target="_blank">Pakistani hackers</a> hacked worlds leading automobile companies domains reserved for Guatemala including <a href="http://www.toyota.com.gt/" target="_blank">Toyota</a> , <a href="http://www.renault.com.gt/" target="_blank">Renault</a> and <a href="http://www.chevrolet.com.gt/" target="_blank">Chevrolet</a> , Attacker didn't mention any reason to deface websites. <br />
<br />
“Hacked by Algeriano. TOYOTA & RENAULT & CHEVROLET Guatemala hacked. Cyber Criminals Was Here,” the attacker wrote on the defaced websites.<br />
<br />
This message indicates that the hacker simply wanted to show off. The sites don’t appear to be storing any sensitive customer information. However, such an attack can still impact a company’s image.<br />
<br />
At the time of writing, all of the websites have been restored. They appear to have been restored within 24 hours after the breach took place. <a href="http://zone-h.com/mirror/id/22028173" target="_blank">Mirrors of the defacements</a> are available on Algeriano’s zone-h.org page. <br />
In this case, all of the three websites appear to have been developed by the same company for a car distributor. The most likely scenario is that the sites have been plagued by the same <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerability</a>, which the hacker easily exploited to deface them. <br />
<br />
Hopefully, the company that manages the sites has addressed the security holes, but it’s unlikely. The <a href="http://zone-h.com/archive/domain=www.toyota.com.gt" target="_blank">Toyota Guatemala website was previously defaced</a> back in 2009, 2011 and 2013 by various hackers.
</div>

Defacement Hacking News News Pakistani Hackers Toyota, Renault and Chevrolet Hacked by Pakistani Hackers

Algeriano a hacker from Team Cyber Criminals a group of Pakistani hackers hacked worlds leading automobile companies domains reserved f...

Anti-Virus Killer Android Virus, Detected

3/18/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
A new variation of mobile <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a> that affects <a href="http://www.hackerschronicle.com/search/label/Android">Android</a> based devices has been detected by the <a href="http://quickheal.com/">Quick Heal Labs</a>. An innovative feature of this malware is that it detects certain mobile security applications on the device and modifies their databases in order to avoid detection.
<br />
<h3>
Quick Heal Detection: Android.AVPasser.A</h3>
As all other forms of Android malware, this variant too has the capability to modify certain system files and steal private data and information, and then broadcast the same to remote servers.
<br />
<h3>
Dynamic Analysis of the Malware</h3>
Once the <b>Android.AVPasser.A</b> malware enters an Android device, it creates multiple icons in the Application Tray of the device. The screenshots below show the icons that are created by the malware.<br />
<br />
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitXv_WA-ZpYVSC7JfArb2scRnmIIUX9EnPZ4o4z2JK8czLJmHTXUJNKjc28rbOZVABW0UDRZGJ4e_4vip3xp5EnoGGlQtBUVuyo244kUupKIwtccDsqvIrGgYyu8xj_foTzqkSKHfKUM9y/s1600/001.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitXv_WA-ZpYVSC7JfArb2scRnmIIUX9EnPZ4o4z2JK8czLJmHTXUJNKjc28rbOZVABW0UDRZGJ4e_4vip3xp5EnoGGlQtBUVuyo244kUupKIwtccDsqvIrGgYyu8xj_foTzqkSKHfKUM9y/s1600/001.png" width="240" /></a></div>
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBjit_c2yjLQx_9UlvppANvdN6OA_n4fcCI9x3VJJdz8n91RMlHbKH_5L4fXI9iwxSNRg49j_G87lL_nRL2MPKq4CtBhjL8v3bP102Et-i3uVpKbg883z3M35AzjTHGPWC7P9LRgZ7gZUs/s1600/002.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBjit_c2yjLQx_9UlvppANvdN6OA_n4fcCI9x3VJJdz8n91RMlHbKH_5L4fXI9iwxSNRg49j_G87lL_nRL2MPKq4CtBhjL8v3bP102Et-i3uVpKbg883z3M35AzjTHGPWC7P9LRgZ7gZUs/s1600/002.png" width="242" /></a></div>
<br />
<div dir="ltr" style="text-align: left;" trbidi="on">
If the user clicks on any of these icon shortcuts, the icons vanish from the Application Tray. However, upon viewing the Active Applications window one can still see the <i>SystemService.class</i> running in the background. This can be viewed in the screenshot below.<br />
<br />
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOIHsstwP4PYwGdOYFAqdW_3nPDyvoIFBdEpDOKwgbsNvE2YAZlsNglJ6SH82MYObs8PJDa0hKsP__TXSvDX7tdtKy_brrN-LqFObP-GvEs9ZtnmP6rKpR-ncJTwyp9XgGpBFb8UwysOPu/s1600/003.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOIHsstwP4PYwGdOYFAqdW_3nPDyvoIFBdEpDOKwgbsNvE2YAZlsNglJ6SH82MYObs8PJDa0hKsP__TXSvDX7tdtKy_brrN-LqFObP-GvEs9ZtnmP6rKpR-ncJTwyp9XgGpBFb8UwysOPu/s1600/003.png" width="192" /></a></div>
<br />
<h3>
What this Malware Does</h3>
Upon installation, this malware has the capability of stealing the following data from the compromised device:

<br />
<ul>
<li>Photos</li>
<li>SMS messages</li>
<li>Contacts</li>
<li>Call history</li>
<li>Videos recorded by the front and rear cameras</li>
<li>GPS location and history of the device</li>
<li>Device specific data such as:</li>
<ul>
<li>Build version</li>
<li>Device ID</li>
<li>IMEI (International Mobile Station Equipment Identity)</li>
<li>IMSI (International Mobile Subscriber Identity)</li>
<li>MDN (Mobile Directory Number)</li>
</ul>
<li>Additionally, the application also gains control over the network activity and visits a malicious URL as shown below:</li>
</ul>
<br />
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeAH-7znkJo7Dvd-by4_C1NthxOpoiW0b34uiTs9FVKohtntU1bFoWsT8YVDAgIS6sDKXe1gIFABdzGyGBExv-8h2THYaaudS1BBIbRtScqoAuz0l0YUhIbmwxX7Z_y9bqGbhrO-BsRKYj/s1600/004.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="20" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeAH-7znkJo7Dvd-by4_C1NthxOpoiW0b34uiTs9FVKohtntU1bFoWsT8YVDAgIS6sDKXe1gIFABdzGyGBExv-8h2THYaaudS1BBIbRtScqoAuz0l0YUhIbmwxX7Z_y9bqGbhrO-BsRKYj/s1600/004.png" width="400" /></a></div>
<br />
<h3>
Other Activities by the Malware:</h3>
<b>#1</b> Once it enters an Android device, the malware checks for the existence of a config.txt file at a preset location on the device. If found, the malware deletes the file and creates a malicious file of its own.</div>
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQf1PqtGZloPUMHrwrDS5I9tgE9H4P2nmS4exr8cuQ80ZsXFHGyd_oTCIQdgL_BDNPlGFs9mf-4BBV6LtGpjJneUChsRRraszzi1Zq57N6MtoOEn2prc0PSg8aZhahsXCV_WgNz2DeZ3PO/s1600/005.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="78" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQf1PqtGZloPUMHrwrDS5I9tgE9H4P2nmS4exr8cuQ80ZsXFHGyd_oTCIQdgL_BDNPlGFs9mf-4BBV6LtGpjJneUChsRRraszzi1Zq57N6MtoOEn2prc0PSg8aZhahsXCV_WgNz2DeZ3PO/s1600/005.png" width="200" /></a></div>
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguPNcdqpGfFgSpBIiSZyzZaQdgNuLhWGSmtmQpmSGfEu8BTdRDfO9RSZIfp3WY1oNzv6aTLjw-PcYKbrkgDDIOwOF6c7gqFCWVUwbRkVEDFpxnn69byfUJ3W-qhjiIiZkow61Xq8Qu7FZm/s1600/006.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="239" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguPNcdqpGfFgSpBIiSZyzZaQdgNuLhWGSmtmQpmSGfEu8BTdRDfO9RSZIfp3WY1oNzv6aTLjw-PcYKbrkgDDIOwOF6c7gqFCWVUwbRkVEDFpxnn69byfUJ3W-qhjiIiZkow61Xq8Qu7FZm/s1600/006.png" width="320" /></a></div>
<div dir="ltr" style="text-align: left;" trbidi="on">
<b>#2</b> The malware broadcasts the information that it collects in the following conditions:

<br />
<ul>
<li>When any SMS is received by the device</li>
<li>When any media connection is mounted or unmounted</li>
<li>When the device screen goes ON or OFF</li>
</ul>
<b>#3</b> The malware calls CameraPicService from the SystemService.class and then runs a thread at an interval of 2 minutes to check the number of cameras connected to the device.<br />
<br />
<b>#4</b> Lastly, the malware collects and analyzes all the packages that are installed on the compromised device and matches them to see if any of them is a mobile security application. Once an application is confirmed to be a mobile security application, the malware modifies the database of the security application in order to to avoid detection.<br />
Source: <a href="http://quickheal.com/" target="_blank">Quickheal</a> </div>
</div>

Android Malwares Anti-Virus Killer Android Virus, Detected

A new variation of mobile malware that affects Android based devices has been detected by the Quick Heal Labs . An innovative feature of ...

Russian Intelligence and Spy Company SearchInform Hacked, Data Leaked

3/13/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSc38Udf3xr3eXGsPIfcHYsnwXkWGpSjIKk7zEtBgsPUMf0OYq9HBSke737pUoIo_O1FCoIvO6rrmjxw7uwvGyFmNvLnK6MYLt0noFVK_XHTvr3zzfARvFo7560r1kTZiNPcYqNUhBaaxi/s1600/russian+intel+&+spy+hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Russian Intelligence and Spy Company SearchInform Hacked, Data Leaked" border="0" height="228" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSc38Udf3xr3eXGsPIfcHYsnwXkWGpSjIKk7zEtBgsPUMf0OYq9HBSke737pUoIo_O1FCoIvO6rrmjxw7uwvGyFmNvLnK6MYLt0noFVK_XHTvr3zzfARvFo7560r1kTZiNPcYqNUhBaaxi/s1600/russian+intel+&+spy+hacked.png" title="Russian Intelligence and Spy Company SearchInform Hacked, Data Leaked" width="320" /></a></div>
<br />
Today Russian hacktivist <a href="https://twitter.com/Rucyborg" target="_blank">@Rucyborg</a> has announced a leak of data from Searchinform and sent a message out to its director.<br />
The leak was <a href="https://twitter.com/Rucyborg/status/443468396068610050" target="_blank">announced</a> a couple of hours ago via twitter and posted to <a href="http://cyberguerrilla.org/" target="_blank">cyberguerrilla.org</a> with a message which states that the hackers have had access to <a href="http://searchinform.ru/" target="_blank">searchinform.ru</a> since as far back as 2012 and that they have infected  download links. The leak was uploaded to <a href="http://bayfiles.net/file/18L8Z/dICvHg/sinformru.rar" target="_blank">bayfiles</a> and is part 2 of an <a href="http://www.hackerschronicle.com/2014/03/cyber-attacks-on-ukraine.html" target="_blank">on going assault on Russia</a> in relation to the recent drama that putin has been creating.<br />
<a href="http://searchinform.com/about/full-text-search-company.html" target="_blank">Searchinform</a> is one of them sneaky company’s with an even more sneaky product which allows snooping on others, while in this day and age is not so surprising but the extent which they do go to is pretty extensive and really does pose a huge security risk to one if the wrong person was to be using it. They offer work time monitors, full-on network sniffers designed at modern day communications over social medias, microphone sniffers for recording employees and a <a href="http://searchinform.com/main/full-text-search-information-security-product.html" target="_blank">whole range of other products</a>.<br />
Data leaked is in a 382MB compressed file that contains well over 3000 files which include instructions and usage information, also it appears to have copies of searchinform for clients and basic new client setup information. In normal fashion there has been a <a href="http://searchinform.com/main/full-text-search-information-security-product.html" target="_blank">imgur gallery</a> created with a preview of the contents of this leak which can be found below, i have also added a couple of screen shots of the contents of the uncompressed leak data.<br />
The message on  <a href="http://cyberguerrilla.org/" target="_blank">cyberguerrilla.org</a> also has a direct message for the CEO of SearchInform.<br />
<div class="content shadow-radial">
Our message to SearchInform.ru – director Ozhegov – you are a bunch of FSB bastadz – leaking information to all the counterparts and outsiders – you provide so called CONTUR of Security to main russian corps – and keep control of all the clients for the SORM needs – nonight – the stars – revolt- and this is your downfall.<br />
<br /></div>
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEierGuWF0ZT_jlPTTeEtxfBHmbTDCQ30xJ1_shNlryML2vBgzJcTvAg11PWsRaNSim_o8sOvfMad2HYnMYDyUqfo-_9gVEtv5RD_7aZw4FS5N71u6N5x3aZmGt0fXSAEGrWYhsBE8oEWmy2/s1600/russian+intel+hacked.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEierGuWF0ZT_jlPTTeEtxfBHmbTDCQ30xJ1_shNlryML2vBgzJcTvAg11PWsRaNSim_o8sOvfMad2HYnMYDyUqfo-_9gVEtv5RD_7aZw4FS5N71u6N5x3aZmGt0fXSAEGrWYhsBE8oEWmy2/s320/russian+intel+hacked.jpg" width="131" /></a><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEpVyw59Ltm0ePqb65Zo4axd_qtlVrhoDMo58LX6pKo3Ba3qUuvggz4hxocgD42AuCPFSWgbB-5fztsvwXksPJp0nulc-1z4hrc9jq3KC1jaLd4SUWhqrL9SWgEVMmiZZNkc-tSCPuQIQb/s1600/russian+spy+hacked.jpg" imageanchor="1" style="clear: right; display: inline !important; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="183" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEpVyw59Ltm0ePqb65Zo4axd_qtlVrhoDMo58LX6pKo3Ba3qUuvggz4hxocgD42AuCPFSWgbB-5fztsvwXksPJp0nulc-1z4hrc9jq3KC1jaLd4SUWhqrL9SWgEVMmiZZNkc-tSCPuQIQb/s320/russian+spy+hacked.jpg" width="400" /></a></div>
</div>

Data Leak Hacking News News Rucyborg Russian Hackers Russian Intelligence and Spy Company SearchInform Hacked, Data Leaked

Today Russian hacktivist @Rucyborg has announced a leak of data from Searchinform and sent a message out to its director. The leak wa...

One Billion Android Devices Vulnerable to Privilege Escalation

Beware of fake TOR Browser

Remote Code Execution vulnerability in Yahoo

Now Test your eyesight with your smatphone

Toyota, Renault and Chevrolet Hacked by Pakistani Hackers

Anti-Virus Killer Android Virus, Detected

Russian Intelligence and Spy Company SearchInform Hacked, Data Leaked

Popular

Comments

Archive