Update your iPhone – remote control holes revealed by researchers

Google Project Zero researcher Natalie Silvanovich has just published a fascinating blog articleentitled The Fully Remote Attack Surface of the iPhone.

This work, carried out by Silvanovich and research colleague Samuel Groß, was also the topic of a presentation she gave at this year’s Black Hat conference in Las Vegas.

Silvanovich’s article is technical but not overly so, making it well worth a look even if you don’t have any formal coding experience.

Notably, she reminds us all how easy it is to open up software to remote attacks, even if that software isn’t what you’d conventionally think of as server-side code, and even if it’s running on a device that you wouldn’t think of a server.

By the way, despite the revelatory nature of the article and her talk, there’s no need to panic.

At least, you don’t need to be too worried if you’ve already applied the latest Apple updates, because the holes that Silvanovich is now talking about in detail are already patched.

If you haven’t brought your iPhone up to iOS 12.4 yet, do it now! 
Settings → General → Software Update is the quick way to check.

How to secure workloads in AWS, Azure and GCP

Download Guide

To explain.

An exploit that gives RCE, short for remote code execution, does exactly what its name suggests – by doing something unexceptionable, and without seeing any warnings, even well-informed users can be tricked into giving crooks access to their device.

A fully remotable exploit is even worse, because there’s no need for users to do anything except have their devices turned on and running normally.

LEARN MORE ABOUT VULNERABILITIES

Other ways to listen: download MP3, play directly on Soundcloud, or get it from Apple Podcasts.)

A booby-trapped website that crashes and takes over your browser gives the crooks RCE.

Likewise, before Microsoft turned off AutoRun by default for USB devices, the proverbial USB-stick-in-the-card-park attack was considered a reliable way to achieve RCE because the chosen malware typically launched as soon as someone plugged in the booby-trapped USB key.

There wasn’t any sort of Are you sure? or [Cancel]/[OK] popup to sound a warning and give you a chance to head off the malware.

But even though visiting a web page or plugging in a USB device isn’t a difficult bridge for crooks to talk you into crossing, those attacks aren’t quite the holy grail of RCE, because some user engagement is needed.

A fully remote attack “just happens”, like the infamous Internet Worm of 1988, or the super-widespread SQL Slammer virus of 2003.

Those attacks sent network data that your computer was deliberately listening out for – no trickery required to get a foot in the door – but that your computer mishandled.

This allowed the crooks to package executable code inside their data packets and to achieve RCE in an entirely unattended and automatic way.

One of the Internet Worm’s attack methods, for example, exploited badly-configured email servers on which debugging mode was incorrectly enabled.

If you’d inadvertently left the debug option turned on, emails laid out in a certain way were treated as commands to execute (!), not as messages to be passed on, so the email server ran the malware immediately after accepting it.

The worm’s emails were directly dangerous without any user ever needing to receive them, let alone to open them or extract and run attachments from them.

Phones ≠ Servers

You might imagine that devices such as mobile phones, which generally don’t operate as servers themselves, would largely be immune to this sort of fully remote attack.

After all, you don’t generally run a mail server or a SQL server on your phone, and even if you wanted to, Apple probably wouldn’t let that sort of software into the App Store.

Even if you were to jailbreak your phone to install server software, your ISP might not allow incoming network connections to reach your phone at all, even if you were willing to accept them.

But, as Silvanovich reminds us, phones are all about messaging, and there are many sorts of message that we expect to be told about even before they arrive in full.

(An incoming call is the most obvious example: we expect the phone to ring, and the calling line’s number to be extracted and displayed, not only before we tap any icon to accept the call but also even when our phone is at the lock screen.)

In other words, even though we think of phones as network clients rather than network servers, there are plenty of client-side apps that download, process, act upon and display data that came from an arbitrary outside source.

We’re not just talking about things like automatic software or anti-virus updates that come from a known, trusted and well-regulated service, but also about content such as text messages or emails that were carefully and maliciously crafted by an unknown, untrusted and deliberately malicious creator.

Silvanovich identified five main application areas of interest on the iPhone, covering iOS subsystems that are specifically designed to fetch, process and tell you about incoming content: SMS, MMS, Visual voicemail, email and iMessage.

In the end, the researchers didn’t find any exploitable holes in SMS or MMS, perhaps because these subsystems are rather old-school and therefore have functionality that is both well-understood and somewhat limited.

But the others weren’t so robust.

As you can imagine, the more features, the more message types, the more different options, the more plugins and the more file formats an app suports, the more likely it is for a bug to exist in handling unusual, little-known or malevolently crafted files.

For example, you’d expect image processing software that can only display old-school BMP files (simple structure and plain, uncompressed data) to be less likely to crash on weird files than software that can handle 72 different image files with varying levels of complexity.

The more code you need to write to process incoming data and to handle all the possible variations, the harder it is to get it right; the harder it is test throroughly; the more likely it is to contain subtle bugs; and the longer it will take for every possible path through the maze of code to get tried out when handling real data in the real world.

Simply put, we say that its attack surface area is larger.

More code, more bugs

Although Silvanovich and Groß did find vulnerabilities in Visual voicemail and in the iOS’s email-handling system, these weren’t terribly significant.

But via iMessage they found at least eight security holes, listed by their CVE numbers: CVE-2019-8624, -8663,-8661, -8646, -8647, -8662, -8641 and -8660. (That’s the order in which they are covered in the article, which is why they are not in numeric sequence here.)

Note that even though Apple lists CVE-2019-8661 as patched in its latest iOS security advisory, the Googlers haven’t disclosed details of this one yet because they don’t think Apple’s update has fully fixed the problem yet.

What to do?

• Get the latest iOS update if you haven’t yet. Many or most of the bug numbers listed above become irrelevant once you’ve applied the patches.
• Get the next update as soon as it comes out. It sounds as though Apple is still working on CVE-2019-8661, and that Google is giving the company some more time to knock the bug on the head completely.
• Less is more. If you are a programmer yourself, beware of writing code that does more than it needs to, or that itself depends on so many other modules or plugins that you can’t easily vouch for the whole thing, no matter how confident you are that your code is bug-free.

via Sophos

Read more »

Is Your Router Vulnerable to VPNFilter Malware?

The Justice Department last week urged everyone with a small office home office (SOHO) or NAS device to reboot their gadgets immediately in order to thwart VPNFilter, a new strain of malware that can brick your router.

The FBI seized a domain used to send commands to the infected devices, but it can't hurt to reboot anyway.

As Symantec outlines, VPNFilter is "a multi-staged piece of malware." Stage 1 makes the connection, Stage 2 delivers the goods, and Stage 3 acts as plugins for Stage 2. "These include a packet sniffer for spying on traffic that is routed through the device, including theft of website credentials and monitoring of Modbus SCADA protocols. Another Stage 3 module allows Stage 2 to communicate using Tor."

VPNFilter "is unlike most other IoT threats because it is capable of maintaining a persistent presence on an infected device, even after a reboot," Symantec says.

Still, "rebooting will remove Stage 2 and any Stage 3 elements present on the device, [temporarily removing] the destructive component of VPNFilter. However, if infected, the continuing presence of Stage 1 means that Stages 2 and 3 can be reinstalled by the attackers."

Those who believe they're infected should do a hard reset, which restores factory settings. Look for a small reset button on your device, though this will wipe any credentials you have stored on the device.

Below is a list of routers Symantec identified as vulnerable to VPNFilter. MikroTik tells Symantec that VPNFilter likely proliferated via a bug in MikroTik RouterOS software, which it patched in March 2017. "Upgrading RouterOS software deletes VPNFilter, any other third-party files and patches the vulnerability," Symantec says.

• Linksys E1200
• Linksys E2500
• Linksys WRVS4400N
• Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072
• Netgear DGN2200
• Netgear R6400
• Netgear R7000
• Netgear R8000
• Netgear WNR1000
• Netgear WNR2000
• QNAP TS251
• QNAP TS439 Pro
• Other QNAP NAS devices running QTS software
• TP-Link R600VPN

"No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues," according to Cisco Talos, which first reported the bug.

To date, Cisco Talos estimates that at least 500,000 in at least 54 countries have been hit by VPNFilter.

The feds are pinning this attack on Fancy Bear, a hacking group also known as APT28 and Sofacy Group, among other monikers. The group is notorious for attacking governments across the world and stealing confidential files from the Democratic National Committee during the 2016 election.

via PCMag

Read more »

No Platform Immune from Ransomware, According to SophosLabs 2018 Malware Forecast

• Ransomware ravaged Windows, but attacks on Android, Linux and MacOS systems also increased in 2017
• Just two strains of ransomware were responsible for 89.5 percent of all attacks intercepted on Sophos customer computers worldwide

OXFORD, U.K. – Nov. 2, 2017 – Sophos (LSE: SOPH), a global leader in network and endpoint security, today announced its SophosLabs 2018 Malware Forecast, a report that recaps ransomware and other cybersecurity trends based on data collected from Sophos customer computers worldwide during April 1 to Oct. 3, 2017. One key finding shows that while ransomware predominately attacked Windows systems in the last six months, Android, Linux and MacOS platforms were not immune.

“Ransomware has become platform-agnostic. Ransomware mostly targets Windows computers, but this year, SophosLabs saw an increased amount of crypto-attacks on different devices and operating systems used by our customers worldwide,” said Dorka Palotay, SophosLabs security researcher and contributor to the ransomware analysis in the SophosLabs 2018 Malware Forecast.

The report also tracks ransomware growth patterns, indicating that WannaCry, unleashed in May 2017, was the number one ransomware intercepted from customer computers, dethroning longtime ransomware leader Cerber, which first appeared in early 2016. WannaCry accounted for 45.3 percent of all ransomware tracked through SophosLabs with Cerber accounting for 44.2 percent.

“For the first time we saw ransomware with worm-like characteristics, which contributed to the rapid expansion of WannaCry. This ransomware took advantage of a known Windows vulnerability to infect and spread to computers, making it hard to control,” said Palotay. “Even though our customers are protected against it and WannaCry has tapered off, we still see the threat because of its inherent nature to keep scanning and attacking computers. We’re expecting cyber criminals to build upon this ability to replicate seen in WannaCry and NotPetya, and this is already evident with Bad Rabbit ransomware, which shows many similarities to NotPetya.” 

The SophosLabs 2018 Malware Forecast reports on the acute rise and fall of NotPetya, ransomware that wreaked havoc in June 2017. NotPetya was initially distributed through a Ukranian accounting software package, limiting its geographic impact. It was able to spread via the EternalBlue exploit, just like WannaCry, but because WannaCry had already infected most exposed machines there were few left unpatched and vulnerable. The motive behind NotPetya is still unclear because there were many missteps, cracks and faults with this attack. For instance, the email account that victims needed to contact attackers didn’t work and victims could not decrypt and recover their data, according to Palotay.

“NotPetya spiked fast and furiously, and did hurt businesses because it permanently destroyed data on the computers it hit. Luckily, NotPetya stopped almost as fast as it started,” said Palotay. “We suspect the cyber criminals were experimenting or their goal was not ransomware, but something more destructive like a data wiper. Regardless of intention, Sophos strongly advises against paying for ransomware and recommends best practicesinstead, including backing up data and keeping patches up to date.”

Cerber, sold as a ransomware kit on the Dark Web, remains a dangerous threat. The creators of Cerber continuously update the code and they charge a percentage of the ransom that the “middle-men” attackers receive from victims. Regular new features make Cerber not only an effective attack tool, but perennially available to cyber criminals. “This Dark Web business model is unfortunately working and similar to a legitimate company is likely funding the ongoing development of Cerber. We can assume the profits are motivating the authors to maintain the code,” said Palotay.

Android ransomware is also attracting cyber criminals. According to SophosLabs analysis, the number of attacks on Sophos customers using Android devices increased almost every month in 2017.

“In September alone, 30.4 percent of malicious Android malware processed by SophosLabs was ransomware. We’re expecting this to jump to approximately 45 percent in October,”said Rowland Yu, a SophosLabs security researcher and contributor to the SophosLabs 2018 Malware Forecast. “One reason we believe ransomware on Android is taking off is because it’s an easy way for cyber criminals to make money instead of stealing contacts and SMS, popping ups ads or bank phishing which requires sophisticated hacking techniques. It’s important to note that Android ransomware is mainly discovered in non-Google Play markets – another reason for users to be very cautious about where and what kinds of apps they download.”  

The SophosLabs report further indicates two types of Android attack methods emerged: locking the phone without encrypting data, and locking the phone while encrypting the data. Most ransomware on Android doesn’t encrypt user data, but the sheer act of locking a screen in exchange for money is enough to cause people grief, especially considering how many times in a single day information is accessed on a personal device.“Sophos recommends backing up phones on a regular schedule, similar to a computer, to preserve data and avoid paying ransom just to regain access. We expect ransomware for Android to continue to increase and dominate as the leading type of malware on this mobile platform in the coming year,” said Yu.

For access to the full SophosLabs 2018 Malware Forecast and Ransomware Infographic, go to here.

via comparethecloud

Read more »

Sockbot malware hits Android devices, Google removes 8 infected apps from Play Store

Security researchers at Symantec have discovered a new Android malware, named "Sockbot", which can allow a remote attacker to use an infected device to generate advertising traffic for the purpose of online ad fraud. The discovery has also led Google to remove eight infected apps from the official Play Store.

The removed apps, which posed as player skin apps for the Minecraft Pocket Edition mobile game, had been downloaded from 600,000 to 2.6 million times before they were taken down. All the infected apps were developed by the same developer, going by the name of FunBaster.

While the malware's primary targets were apparently the users in the United States, it also had a presence in other countries like Russia, Ukraine, Brazil and Germany.

Sockbot malware hits Android devices.Creative Commons

"Android.Sockbot is a Trojan horse for Android devices that creates a SOCKS proxy on the compromised device," Symantec said on its website. "Once installed, the application will display an icon depicting a ninja character with a blue background and the title of SKINS."

After being installed on a device, the malware requests permissions to perform the following actions:

• Access location information, such as Cell-ID or Wi-Fi
• Access information about networks
• Access information about the Wi-Fi state
• Open network connections
• Read from external storage devices
• Check the phone's current state
• Start once the device has finished booting
• Display alerts
• Make the phone vibrate
• Write to external storage devices

"The legitimate purpose of the apps is to modify the look of the characters in Minecraft: Pocket Edition (PE). In the background, sophisticated and well-disguised attacking functionality is enabled. We set up network analysis of this malware in action and observed activity apparently aimed at generating illegitimate ad revenue," researchers at Symantec said in a blog post.

Sockbot Android malware.Symantec

According to researchers, the infected devices were found to have received ad data such as the ad type and screen size name, but the malicious apps didn't have the functionality to display those ads.

However, the researchers also said that the attacker behind the malware could turn nastier at any point of time and use Sockbot to inject harmful content, or even carry out DDoS attack.

Sockbot Android malware's discovery came more than a month after security researchers took down the WireX botnet, which infected over 120,000 Android devices. Attackers were also using the botnet to launch DDoS attacks.

Here're a few best practices, recommended by Symantec, to stay protected from malicious software:

• Keep your software up to date.
• Refrain from downloading apps from unfamiliar sites.
• Only install apps from trusted sources.
• Pay close attention to the permissions requested by an app.
• Install a suitable mobile security app in order to protect your device and data.
• Make frequent backups of important data. 

via ibtimes

Read more »

Shadow Brokers Release Windows Malware that can Steal Keystrokes and Record Audio to its Paid Subscriber

Paid subscribers of Shadow Brokers’ monthly subscription can now gain complete access to your PC/laptop and steal your passwords and chats

The hacking group named SHADOW BROKERS, which was responsible for the NSA leaks earlier. is back with another NSA hacker kit. This time however, the leak is only available for the users with its “monthly subscription”.

In their latest release, SHADOW BROKERS have released a malware dubbed UNITEDRAKE. It is a remote access and control tool with “plug-ins” that can target WINDOWS based systems enabling the hacker with full control over their victim's system.

UNITEDRAKE is compatible with systems running on Microsoft Windows XP, Vista, 7, 8 up to Windows Server 2012. It first came to light in 2014 as a part of NSA's classified documents leaked by its former contractor Edward Snowden.

The Snowden documents suggested the agency used the tool alongside other pieces of malware, including GUMFISH, FOGGYBOTTOM, GROK, and SALVAGERABBIT

The malware's modules including FOGGYBOTTOM and GROK can perform tasks including listening in and monitoring communication, capturing keystrokes and both webcam and microphone usage, impersonating users, stealing diagnostics information and self-destructing once tasks are completed.

These tools were allegedly developed and used by the US National Security Agency (NSA) to perform mass surveillance and bulk hacking worldwide.



Ankush Johar, director at HumanFirewall.io, said: "Remote Administration and surveillance tools are not a new thing in the global cyberspace. These have existed since the beginning of the internet. Although, criminal grade pro malware like these are extremely dangerous as, even the inexperienced chaps now can use them to carry out nation-wide cyber crimes.

"It’s not too difficult to avoid the basic malware. Being aware and staying cautious is the key to your security. Consumers are suggested to make sure that the following points are always kept in mind before hovering around the tech."

* Keep a genuine anti-virus installed and updated.
* Do not click on click on unknown links. Verify the links completely before opening them.
* Never download attachments from untrusted sources.
* Never download pirated software/cracks as they contain malware or backdoors that can give complete access of your system to the hacker.
* Install all software and OS updates available on your device whenever prompted to do so.
* Avoid plugging in unknown USB devices, whether at home or office.

via BusinessWorld

Read more »

HOW TO REMOVE ANDROID MALWARE

Is your Android device suddenly slow, using too much data, or showing corrupted data? You could have downloaded an infected app that came along with malware — or the much more obvious ransomware. Suspect apps (often promising free work software, cheat codes, new games, porn, or money) are an increasingly common method of getting viruses onto your mobile devices, where they wreak havoc and steal data.

If you can still access your Android device, your first step should be to get rid of the infected app ASAP, before it tries to infect other devices or does more damage. Here’s how to locate and remove Android malware, along with a few options for security downloads to help protect you in the future. We’re going to speak generally about consumer Android platforms here, but we also have a guide on deleting apps in stock Android which you may find useful.

Step 1: Shut down until you find out the specifics

Once you’re sure your phone is under attack by malware, hold the power button down and turn the phone fully off. It may not stop the malware from causing damage, but it can stop the problem from getting worse, and may halt ongoing malware attempts to access nearby networks.

Shutting down also gives you time to think and research. Do you know the specific infected app that brought malware onto your device? Do you know what other types of software it may have downloaded without your consent? If not, then move to another computer and look up your symptoms (as well as any new apps you tried out) to narrow down the issue. If you can’t find the app at the root of the problem, you can’t remove it!

If your research turns up nothing, you may want to turn your phone back on and skip down briefly down to step 5. Anti-malware apps can help identify what is causing your problems and will even be able to remove the infected software for you. However, it will also give your phone access to the internet again, which involves some risk.

Step 2: Switch to safe/emergency mode while you work

Flickr | Kārlis Dambrāns

When you turn your device back on and plunge back in to isolate the problematic app, switch over to safe mode first. This will help limit the damage the infected app can do.

For most Android devices, you can switch to safe mode by holding down the power button for a couple seconds once your device is on. This should bring up a few power options, including the option to switch to “safe mode,” “emergency mode” or similar wording. Choose this mode and wait for your phone to reboot before you continue.

Note: If you can’t find out what’s causing your malware problem, even after downloading a security app, this is not the time to tinker. Ask a professional for help and if you should wipe your phone. This is a good strategy if increasingly common ransomware takes over your phone and blocks your actions.

Step 3: Head to Settings and find the app

Visit Settings on your Android device. Settings typically has a gear-shaped icon, but that depends on your themes and arrangement: Search for it if you have trouble locating the right spot.

In Settings, scroll until you see the section called Apps, and enter. Look for a list of all your current apps — you may need to choose App Manager to locate the full list. Once there, scroll until you find the infected app at the center of your problems.

Select the app, and this should bring up options to Uninstall or Force close (you cannot uninstall core apps, only disable them, but these apps are unlikely to be the problem).

Step 4: Delete the infected app and anything else suspicious

Simon Hill/Digital Trends

Simply choose Uninstall, and your Android device should remove the app in question. It’s also a good idea to review your app list and uninstall other suspicious downloads — if you haven’t looked at this list before, you may be surprised at some of the odd things your device will automatically download.

Note: In some cases, you can’t uninstall the app, and the option itself will be disabled. Some of the most clever malware/ransomware will visit your administrator settings and give itself special protection to prevent this very thing. Fortunately, it’s often easy to fix. Go back to the original Settings menu and scroll down to Lock Screen and Security (or a similar corresponding section). In the Security menu, look for a section that says “Phone (Device) Administrators.” You may need to visit “Other security settings” first, depending on how your security menu is set up. In Phone Administrators, you should be able to enable the ability to remove Android malware.

Step 5: Download some malware protection

A vulnerable Android device deserves protection. There are a number of security apps you can download to help protect your phone, scan for viruses, and get rid of junk files and any potentially infected software. When you are finished manually deleting the troublesome app, download a security program to help take care of any future issues. There are many choices in this field: Try software like 360 Security, or Avast Security, or AVG Antivirus from the Google store. You can take a look at our other Android security recommendations here.

While it sounds obvious, it’s also a really good idea to keep your Android device constantly updated. Forgetting to update is one of the key risks leaving Android phones open to attack.

via digitaltrend
s

Read more »