Protecting over 200 million PCs, Macs, & Mobiles – more than any other antivirus

Archive

Posts Tagged ‘android’
May 8th, 2014

Six reasons to download avast! Mobile Security on mom’s smartphone this Mother’s day!

AVAST protects your mom's cell phone

Protect mom’s precious memories with avast! Mobile Security

Today almost everyone and their mother has a smartphone, even your mom’s mom probably has a smartphone! Smartphones help us connect with people near or far, whether it be through traditional phone calls, text messages, photo and video sharing via apps or messaging services, smartphones have made keeping in touch routine, easy and instant. We share personal moments, large or small, with the people we love the most: our moms. All these personal moments are then stored on our smartphones, so it is imperative to protect them, which is why we think avast! Mobile Security is the perfect Mother’s Day gift.

Here are 6 reasons reasons to back that up:

1. Antivirus: Mom has always protected you, whether it be checking for monsters under your bed or making sure you put on a jacket before you leave the house. Now its your turn to protect your mom from mobile malware monsters from getting to her data. Our anti-virus scans apps, files and SMS for malicious malware and includes spyware.

2. Anti-theft: We all know moms are superheroes that don’t wear capes, always on the go, making sure everyone is taken care of and where they are supposed to be. We also know that mom-purses are like Mary Poppin’s never-ending bag, so it wouldn’t be surprising if mom lost her phone running between work and soccer practice drop-off or if she were to “lose” her phone in her ginormous wonder bag. avast! Anti-Theft helps locate, control and lock lost or stolen phones remotely, GPS track and sound a siren alarm, making it simple to retrieve missing devices.

Read more…

May 7th, 2014

Fake government ransomware holding Android devices hostage

Ransomware, which has already made its rounds on Windows, is now increasingly targeting the Android operating system. A new piece of mobile malware claiming to be the government under the name Android: Koler-A is now targeting users.

We have full control of your phone – give us $300 and we’ll give it back

Obrázek 1-1

The ransomware is pushed automatically from fake porn sites visited by Android users via a malicious .apk file that appears in the form of an app. The innocent appearance of the app deceives users and is a powerful social engineering tactic used by malware developers to trick people into installing malicious apps. The form of delivery is not the only thing that makes the app suspicious and potentially dangerous, but the access it seeks are highly unusual and alarming. The ransomware requests full network access, permission to run at startup and permission to prevent the phone from sleeping. Once installed the granted access allows the ransomware to take control of the device. The full network access allows the malicious app to communicate over the web and download the ransom message that is shown on the captive device. The permission to run at startup and prevent the phone from sleeping fully lockdown the phone, preventing victims from escaping the ransom message.

The ransomware localizes fake government messages, depending on the users GPS location, accusing them of having viewed and downloaded inappropriate and illegal content. What does the ransomware do next? Demands ransom of course! The ransom to regain access to the device including all of its apps, which it claims are all encrypted, is set at around $300 and is to be paid through untraceable forms of payment such as MoneyPak.

avast! Mobile Security safeguards against ransomware

Both AVAST’s free and premium mobile security apps, avast! Mobile Security and avast! Mobile Premium, protect customers from falling for the devious apps containing ransomware. AVAST detects this ransomware under the name Android: Koler-A and blocks its execution.

We recommend that everyone be cautious when downloading apps, especially from unofficial app markets. We also urge users to not open any files that have been downloaded to their device without their consent. Always check what apps want to access and in addition to being cautious, we advise people download antivirus to protect their devices. This new ransomware appearing on Android is the perfect example of how malware is starting to move away from the PC environment and into our pockets and there are no signs of this slowing down.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news and product information, please follow us on Facebook, Twitter, Google+ and Instagram. Business owners – check out our business products.

Comments off
April 17th, 2014

WordPress plugin vulnerability puts mobile visitors at risk

AVAST finds WordPress plugin redirector

AVAST finds new twist on WordPress plugin vulnerability

Today one of our colleagues came into our office and said, “Hey guys, I’ve been infected.” I thought to myself, yeah, how bad can this be? After a bit of digging we found the results were worth it; it turned out to be a really “interesting ” case of mobile redirected threats localized for each country.

All you need is one bad IP

The case was brought to us by Jakub Carda, a fellow AVAST employee who enjoys blogging in his free time. His WordPress site was compromised through a vulnerability in WordPress, more precisely OptimizePress. OptimizePress is a WordPress plugin that fully integrates itself into the WordPress CMS, helping bloggers optimize their blog’s design. A tiny mistake in the code of a file located in: lib/admin/media-upload.php made it possible for pretty much anyone to upload harmful content onto people’s WordPress sites, and plenty of websites have been compromised because of this.

Read more…

March 31st, 2014

The Gray-zone of malware detection in Android OS

Does the title of this blog post have a mysterious meaning? Not exactly.

In this first part about the gray-zone of Android malware detections, I will introduce the Android:SecApk, a detection regarding the protection that the App Shield (Bangcle) offers to Android applications (.apk). This detection has a big sample set that is still growing. Some SecApk wrapped samples that existed or still exist in the Google Play Store and third party stores, can be seen in the table below.

MD5

Name \ Info

F1EF5B8C671B2146C2A2454ECF775E47

G锁屏冰雪奇缘之来自星星的你V1.0.apk

\ PUP – An application to promote a specific movie. Potentially unwanted because of the extended permissions that was requested.

Current Status: Removed from Google Play

10bd28d4f56aff83cb6d31b6db8fdbd2

Cut_the_bird.apk

\PUP – A game that have potentially unwanted permissions that they can drive to loss of private personal info.

05ffb6f34e40bb1cf8f9628e5647d5e3

aini1314langmanzhutisuoping_V2.5_mumayi_700e0.apk

\PUP – A screensaver application that has permissions unrelated with the purpose of the app.

d6b40bbb79b54c09352a2e0824c0adba

3D职业乒乓球.apk

\Pup – This application is a tennis game. Potentially unwanted because of the extended permissions that was requested.

eefd2101e6a0b016e5a1e9859e9c443e

eefd2101e6a0b016e5a1e9859e9c443e.apk

\Malware – This app steal personal data and SMS messages from the user.

 

The App Shield is an online service that, after a submission of an .apk, encrypts it and adds some layers of protection. The procedure of the encryption and protection of the apk will be discussed with more detail during the course of the second part of this blog post.

Starting with the submission process, a clean app named AvstTest.apk uploaded to the service. The exported .apk was renamed as AvstTest[SecApk].apk. In addition, apktool and dex2jar used accordingly to decode the .apk resources and convert the ‘.dex’ files to ‘.jar’.

Folder structure

  Read more…

March 31st, 2014

Backup your phones and PCs on World BackUp Day!

Your world is on your mobile devices and PC: Your family photos, home videos, documents and emails. Unfortunately, you can lose it in an instance. For those folks who haven’t backed up their files, that means disaster. Today is World BackUp Day. Be prepared. Backup your files on March 31st.
backup_img

Did you know?

  • 113 cellphones are lost or stolen every minute of every day
  • More men (60%) than women (47%) frequently back up their data
  • Women are more at risk than men if their smartphone is stolen or lost, because they do not protect their personal data and information as well as men do.

back-up men_women
Back up your Android phone or tablet

Malware is a growing threat to the Android platform, but because of the small size of our devices, loss and theft is still the bigger threat. Men are more careful about the safety and security of their cellphones than women. We learned that curious fact from an avast! survey conducted last summer,  Lost or Stolen Smartphone: The Consequences are Bigger for Women Than for Men.

avast! Mobile BackUp is available for Android phones and tablets and comes in two different versions.

  1. 1. The standalone free version provides you with basic backup options: Contacts, text messages, pictures, and call logs.
  2. 2. If you would like to backup music, video, and apps, then you need to buy the Premium version. This can be done later, from within the free version.

Get free avast! Mobile BackUp from Google Play. After you install avast! Mobile BackUp, your current data will be backed up to your AVAST Account and Google Drive.

Back up your PC

avast! BackUp is an online backup and recovery service that allows you to backup your entire computer or select sets of data or individual files you want to back up. You can choose the storage capacity you need, and for a few bucks a month, rest assured that your files are safe in case disaster strikes.

Try avast! BackUp free for 30 days. During that time, you’ll get 25 GB for your files.

March 31st is World Backup Day. Take the pledge now, then take action:

I solemnly swear to backup my important documents and precious memories on March 31st.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on FacebookTwitter and Google+. Business owners – check out our business products.

March 18th, 2014

Cyber-hijack unlikely cause of missing Malaysian jetliner

missing_malaysia_airlines_flight-465126An unknown hacker taking control of a plane using an Android phone’s screen sounds like a frightening, but fictional, scenario from the next international spy movie. But, it’s one of many theories being bandied about to explain what happened to missing Malaysian Airways Flight MH370.

This theory, advanced by a British anti-terror expert on Sunday, says that hackers can get into the main computer network of the plane through the inflight, onboard entertainment system. Ondrej Vlcek, Chief Operating Officer at AVAST, believes this theory is highly unlikely.

“The theory is extremely wild and unlikely,” said Vlcek. “The entertainment systems on most airline carriers are relatively old and independent from the main computer systems of the aircraft such as position, temperature, etc. There is no feedback communication from the entertainment system to the main computer. It is basically only one-way information for passengers.”

Long before the mystery of Flight MH370, we shared a different rogue-hacker-with-Android-scenario. It was based on a presentation given at The Hack In The Box security conference in April 2013 called ‘Aircraft Hacking: Practical Aero Series’ by Hugo Teso.  Using PC simulation software, Teso was able to manipulate the steering of a Boeing jet in ‘autopilot’ mode, and said he could make oxygen masks drop down, and even cause the plane to crash by setting it on a collision course with another plane, stated a Forbes’ article about the presentation.

After reviewing the results of his tests, aviation safety groups disputed the findings saying, “The described technique cannot engage or control the aircraft’s autopilot system using the FMS or prevent a pilot from overriding the autopilot. Therefore, a hacker cannot obtain “full control of an aircraft” as the technology consultant has claimed.”

For an up-to-date list of all the theories – from the realistic to the really wild – about what has happened to the plane, please see The Telegraph, Malaysian Airlines MH370: live.

Photo source: Express

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on FacebookTwitter and Google+. Business owners – check out our business products.

March 18th, 2014

Fake Korean bank applications for Android – Pt 3

Recently, we discovered an account on GitHub, a service for software development projects, that has interesting contents. The account contains several projects; one of the latest ones is called Banks, and it has interesting source codes.  The account contains information like user name, photo, and email address, but we cannot tell who the guy in the picture is. He might not be related to the contents at all, it could be a fake picture, fake name, or simply his account may have been hacked, his identity stolen, and the Banks repository created by someone else without his consent. In this blog post, we will explore the source codes in detail.
korea-03

When we downloaded the repository, we found several directories – GoogleService and fake applications imitating mobile applications of five major Korean banks – NH Bank, Kookmin Bank, Hana Bank, ShinHan Bank and Woori Bank.

korea-02

 

We previously published two blog posts with analyses of the above mentioned fake applications.

When we look at GitHub statistics, and Punchcard tab, it tells us what time the creators were most active. From the chart below you can see, that Saturday mornings and evenings and Sunday evenings were the most active times of comments of new versions. It seems that authors of this application do the development as a weekend job. At the time of writing this blogpost, the last update of fake bank applications was in the beginning of January 2014.

korea-20

This is not the first attack against users of Korean banks. About a year ago, we published this analysis.

Conclusion

Github, the web-based hosting service for software development projects, offers a lot of interesting contents, which depending on its settings can be later found and accessed by virtually anyone, including Google robots.  We managed to find the above mentioned repository by simply Googling the strings which occurred in a malicious Android application.

Acknowledgement:

The author would like to thank to Peter Kalnai and David Fiser for help and consultations related to this analysis.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on FacebookTwitter and Google+. Business owners – check out our business products.

March 13th, 2014

AVAST is top choice for mobile and PC security worldwide

Respected testing lab AV-Comparatives ranks AVAST as the most popular provider of both mobile security and antivirus protection in North America, South America, and Europe, and gaining in Asia.

AVcomp mobile security

“This survey highlights that AVAST is the most popular name in security in the world,” said Vincent Steckler, CEO of AVAST Software. “We proudly protect more than 210 million devices from hackers, thieves, spies and even governments.”

The rankings came from the fourth annual global survey released at the end of February. In the survey, AV-Comparatives states that internet usage among home and business users is growing, but how people access the internet is changing. Smartphone and tablet sales have increased, while laptop and desktop sales are on the decline. This means that the focus of cybercrooks is changing too.

Android owners are vulnerable without security protection

Mobile device owners are steadily realizing that the threat to their security is increasing. The survey confirms that the amount of mobile devices protected by security software is significantly lower than that of desktop devices, especially in North America.

“User awareness of mobile malware is dangerously low; yet in 2013, our virus lab found more than 1,850 new pieces of mobile malware a day,” commented Mr. Steckler. Read more…

March 7th, 2014

Google Play: Whats the newest threat on the official Android market?

Official app stores are the primary sources to finding and downloading apps. Experts advise users to stay within the official app stores as they are approved ecosystems, which are widely recognized as safe. But are these sources really trustworthy? Some experts, however, claim that “Android malware is non-existent and security companies just try to scare us. Keep calm and don‘t worry.“ So which is it?

We’ve already blogged about plenty of threats that sneak onto your device from trusted sources, but here we have a really fresh one, one that  is still undetected by other security vendors. An Application called Cámara Visión Nocturna (package name: com.loriapps.nightcamera.apk), which is still available in the Google Play Store as I am writing this post, is something you definitely don’t want to have on your Android device.

Blg1

Starting with the application’s permissions you might notice there are some unusual requests for an app that should be able to work only using your camera.

    <uses-permission android:name=”android.permission.CAMERA” />

Read more…

March 3rd, 2014

Fake Korean bank applications for Android – part 2

In February, we looked at the first part of the fake Korean bank application analysis along with Android:Tramp (TRAck My Phone malicious Android application), which uses it. In this blogpost, we will look at another two Android malware families which supposedly utilize the same bunch of fake Korean bank applications. At the end of this article, we will discuss the origin of malware creators.

Analysis of Android:AgentSpy

It is interesting to search for references of bank applications package names – KR_HNBank, KR_KBBank, KR_NHBank, KR_SHBank, KR_WRBank. One reference goes to a malicious application called Android:AgentSpy. The infection vector of this application was described by Symantec, contagio mobile and Alyac. We will not delve into details, we will just mention that the malicious application is pushed to a connected mobile phone via ADB.EXE (Android Debug Bridge). The uploaded malicious file is called AV_cdk.apk.

Android:AgentSpy contains activity MainActivity and several receivers and service CoreService.

BootBroadcastReceiver

Monitors android.intent.action.BOOT_COMPLETED and android.intent.action.USER_PRESENT and if received, starts CoreService. It also monitors attempts to add or remove packages – android.intent.action.PACKAGE_ADDED and android.intent.action.PACKAGE_REMOVED.

CoreService

1) Calls regularly home and reports available connection types (wifi, net, wap), IMSI, installed bank apps

2) Regularly polls C&C and responds to the following commands

sendsms – sends SMS to a given mobile number

issms – whether to steal received SMS or not

iscall – whether to block outgoing call

contact – steals contact information and upload them to C&C

apps – list of installed bank apps

changeapp – replaces original bank applications with fake bank applications

move – changes C&C server

PhoneListener receiver

Moniors new outgoing calls. If android.intent.action.NEW_OUTGOING_CALL is received, information about the outgoing call is sent to C&C.

Config class

Contains C&C URL, name of bank packages (String array bank), name of fake bank packages (String array apkNames). It also contains reference to conf.ini configuration file.

koreanbanks_agentspy_config

Analysis of Android:Telman

One more Android malware family, which uses fake bank applications is called Android:Telman. Similarly to Android:Tramp and Android:AgentSpy, it checks for installed packages of the above mentioned banks. Read more…