Protecting over 230 million PCs, Macs, & Mobiles – more than any other antivirus


April 30th, 2015

PCs require antivirus. Smartphones don’t. Right?

Woman using smartphone

That smartphone means a lot to her. Protect it from hackers and thieves with Avast Mobile Security.

It’s very common to find people concerned about Windows viruses and malware that say, “Oh, my PC is protected by Avast Antivirus, but we don’t need it for our smartphones and tablets.”

With more than 230 million Avast Antivirus customers, we see “only” 60 million or so Android users of Avast Mobile Security. Many more mobile devices are sold every second than desktops and notebooks together. Why are people not as concerned about the security of their smartphone as their desktop?

The AV-Comparatives survey that we wrote about yesterday  in Avast Mobile Security is the #1 choice for Android users says that Android users in North America protect their phones more than anywhere else in the world with 31 percent of respondents reporting they have protection. South America, Asia, and Europe are much lower at 17 percent.

What about the rest of the Android users?

- Do you realize that mobile malware is increasing?

- Do you realize that you (most probably) have much more personal info in your smartphone than your PC? Like photos, selfies, contacts, videos, and also banking and financial information.

- What if one of your apps is using your personal info against you like the Dubsmash 2 app we just discovered?

Your Android device needs protection

Avast Mobile Security is a complete suite for Android protection. It is completely focused on security and privacy features.

Maybe you have a friend or your girlfriend that should be reading this… Take this opportunity to introduce them to Avast Mobile Security and teach them some tips about mobile security. Maybe we’ll see a better protected world if we reduce the number of unprotected devices and the cybercrooks have more work to steal from innocents. Download Avast Mobile Security for free on Google Play.

Earn free Avast Mobile Premium

In the latest update of Avast Mobile Security, we added a referral program, so you can recommend Avast Mobile Security to your friends and family. Not only can you recommend the best mobile security app available on Google Play, but you will be rewarded for doing so; you can earn up to three months of Avast Mobile Premium for free!

Here is how it works: For every five friends you send an SMS to recommending Avast, you get one free month of Avast Mobile Premium. Cool, huh?

Do your good action today: Tell someone you care about that smartphones and tablets need to have a security app installed and updated..

 


April 29th, 2015

Avast Mobile Security is the #1 choice for Android users

The most popular mobile security product in the world is Avast Mobile Security.

In their annual IT Security Survey, AV – Comparatives asked, Which mobile anti-malware security solution do you primarily use on your smartphone?

Avast took 1st or 2nd place on four continents: Europe, North America, Asia, and South/Central America.

 Avast Mobile Security is #1 Android protection.

Don’t get burned! Protect your Android with Avast Mobile Security.

 

How great is the risk of infection on an Android smartphone?

The risk of your Android smartphone becoming infected depends on several factors. In the US and Europe most people use official stores such as Google Play for installing apps. The risk is much lower than in many Asian countries, especially China, where app stores are not subject to stricter controls. Because of these unofficial app stores, along with numerous rooted phones, the chance of installing a dangerous app is highly increased.

In Asia, the smartphone is often used as an alternative to the PC. People frequently use it for online banking which make them vulnerable to Zeus Trojan malware. Zeus is commonly delivered via a link or an attachment in a phishing message or through a text message via WhatsApp, SMS, or Twitter. This threat will similarly increase in Europe and the US as banking apps get more popular.

An ounce of prevention is worth a pound of cure

The Avast Virus Lab has more than one million samples of mobile malware in its database, and reports that 2,850 new mobile threats are created every day by hackers. The threat situation can change quickly and dramatically so it is best to use preventative protection and install security software on your smartphone. At this point though, protecting important data in the event that your phone is lost or stolen is more critical than malware protection.

The AV-Comparatives survey says that Android users in North America protect their phones more than anywhere else in the world with 31 percent of respondents reporting they have protection. South America, Asia, and Europe are much lower at 17 percent.

Protect your Android smartphone and tablet with Avast Mobile Security and Avast Anti-Theft: Free from the Google Play store.

 


April 28th, 2015

Your SMB’s Biggest Security Threat Could be Sitting in Your Office

This article is a re-print from the April 1, 2015 edition of Silicon India.

Educate your employees about data security.

Careless employees, not hackers, are the biggest threat to your company’s data security.

Security threats are evolving quickly, making it difficult to pinpoint just one threat that is currently affecting small and mid-size businesses.

From the threats we have observed in the past and the ones we anticipate for the future, we have learned that while malware can be damaging to businesses, so can human decisions. This makes it vital for small and mid-size business owners to discuss possible threats with their employees and share basic IT guidelines with them, but more importantly, to implement a strong security solution that holds up dangers before they become a real threat.

Taking Advantage of Human Nature: Social Engineering

Hackers understand that it is human nature to make mistakes, which is why they often turn to social engineering. Social engineering is a tactic that tricks people into revealing their personal information, like log in details, or into performing actions, like downloading malware disguised as an attachment or link.

Phishing emails are a popular form of social engineering that can easily sneak their way into your employees’ inboxes, disguising themselves as yet another offer, promotion, or even customer, if you do not have anti-phishing protection. Phishing campaigns come in many forms; they can either use scare tactics to make people believe they are in trouble or that they have won a prize.

In the last few months we have seen Trojans like Pony Stealer and Tinba make their rounds. Both Pony Stealer and Tinba attempted to convince people they owed money and to download an invoice, which was of course not an actual invoice, but a Trojan.

Falling for phishing scams can have devastating effects on businesses; they could not only steal personal information, but also attack Point of Sale (PoS) systems to steal customers’ financial information, thus not only affecting the business itself, but its clients as well.

Lack of security awareness: Beneficial for hackers, bad for your business

Not taking proper security precautions, like choosing weak passwords or ignoring security updates, is another human flaw cybercriminals like to abuse to access accounts and networks. To gain control of a system, hackers can enter common or weak passwords or simply look up hardware’s default administrative log in credentials.

Read more…


April 27th, 2015

Malware authors go a step further to access bank accounts

Malware authors like to play hide-and-seek. Hiding executable files inside PDFs and Microsoft Office documents then emailing them as attachments are nothing new, but sometimes one layer isn’t enough. This Avast Virus Lab analysis peels back the layers of a new threat.

layers-banking-malware

Malware authors continually surprise us with their creativity. In an effort to trick banking customers into revealing the login credentials for their online account, cycbercrooks are using the trust people have in Microsoft Office to make them execute banking malware on their own computers. Here’s how it works:

Typically, spam emails contain executable files that can harm a victim’s computer and steal private information. In the layered version, they have PDFs or Microsoft Office documents attached that contain a malicious executable file. We recently found an email that had an added layer and decided to analyze the email.

The email, disguised as a financially-related message from a legitimate company,  informed the recipient that an invoice was due and had a PDF file attached. Embedded inside the malicious PDF was a Microsoft Office document and simple java script that dropped and executed the DOC file.

pdf_jsInside the DOC file we found malicious macro code, which users must activate, as the code is disabled by Microsoft Office by default. The code obfuscates DOC files by creating new documents with unique methods names, variable names, and URLs, making it difficult to detect the malicious files.

 Macro_modules

When we analyzed the malicious macro code, we found some hints that helped us with our analysis. In this sample it was a function called MICHEL.

Functions

We already knew this function would open the URL with the malicious file, and when we found this function in one of the modules, we were able to find the download path.

Macro_downloader

The address is stored as a GUADALUPE variable. The URL is unique for each sample and leads to the download of a malicious PE file.

Macro_downloader_watch

The PE file would act as an information stealer, stealing login credentials from banking sites like

  • Santander, whose principal market is in the Northeastern United States
  • Ulster bank, based in Ireland
  • From Google accounts
  • Microsoft

How to protect yourself from banking malware

Our number 1 recommendation is keep your security software updated. Avast streams hundreds of updates every day to your devices, so you will stay protected. For example, the executable file downloaded by the malicious Microsoft Office document belongs to a banker family evolved from infamous Zeus. This variant is also known as a Dridex Botnet. At the time of writing this post, the botnet is still active, but the malware itself is inactive. Avast detects it as Win32: Pierre-A.

Clever cybercrooks use social engineering to manipulate their victims. Use extreme caution when opening emails related to your finances until you can verify the legitimacy.

Samples related to this analysis:

PDF virustotal

DOC virustotal

PE virustotal


April 24th, 2015

Porn clicker app slipped into Google Play imitating popular Dubsmash app

Everyone from celebrities like Lena Dunham to Hugh Jackman are using the (currently) seventh most popular app available on Google Play: Dubsmash. Dubsmash is an app with more than 10 million Google Play installations that lets users choose a sound, record a video to go along with the sound and send their dub to their friends or social media channels. Dubsmash is not only widely popular amongst teens and celebs, but the app has also caught the attention of malware authors.

Avast finds porn clicker app named Dubsmash 2 on Google Play

Google removed the rouge app after Avast notified them

Avast recently discovered “Dubsmash 2” (with the package name “com.table.hockes”) on Google Play – and no, it was not the bigger and better version of the original app. The app is a so called “porn clicker” and was installed 100,000-500,000 times from the Google Play Store. We contacted Google when we discovered the rogue app and it was removed from the Play Store shortly thereafter. Once the app was installed there was no evidence of an app named “Dubsmash 2” on the user’s device, instead the app installed an app icon named “Setting IS”. This is a common trick malware authors use to make it harder for the user to figure out which app is causing problems. This should also be the user’s first clue that something shady is going on. The “Settings IS” icon looked very similar to the actual Android Settings icon (see screenshot below).

The app’s mischievous activities could be triggered by two actions. The first possible way was by simply launching the “Settings IS” app and the second, which occurred only if the user had not yet launched the app, was via the BroadcastReceiver component within the app. BroadcastReceiver observed the device’s Internet connectivity and  if the BroadcastReceiver noticed the device was connected to the Internet, the app’s true functions would be triggered.

If the “Settings IS” app was opened by the user, the Google Play Store would launch to the actual “Dubsmash” app download page.

Porn clicker "Settings IS"

The rogue icon looked very similar to the Android Settings icon

Once activated, the app sent an HTTP GET request to an encrypted URL. If the request returned a string containing the character “1”  two services would begin to work: MyService and Streaming. Using this method the author could also effectively turn off the start of the services remotely.

The MyService service began by deleting the “Settings IS” app icon from the device’s main menu and scheduled a task to run every 60 seconds in the background of the device, meaning the user never realized that anything was happening. The task would download a list of links to various porn sites from an encrypted URL stored within the app, along with JavaScript execution code. One of the porn links from the list would be launched in the browser and after ten seconds, the JavaScript code (also downloaded from an encrypted URL) was executed, clicking further links within the porn site. In the case seen in the picture below, the function opened a random link from the web page.

Porn links app opened

The developer probably made money on pay-per-click ads.

The second service, the Streaming service, was fairly similar in structure to the MyService component in that it also scheduled a task to run every 60 seconds. The main difference to MyService, is that users could notice the Service tasks did not run secretly in the background. The task would check for changes in the device’s IP address or date. If either of them had changed, a video would launch in the device’s YouTube app. The YouTube app needed to be installed on the device for this to function properly. The video address was also obtained from an encrypted URL.

code_screen_1

The encrypted URLs used by the app

After decrypting and further examining the URLs and the video from YouTube, the Avast Virus Lab came to the conclusion that the malware most likely originated from Turkey. The developer’s name listed on Google Play and YouTube hint to this.

We suspect the app developer used the porn clicker method for financial gain. Through clicks on multiple ads within the porn sites, the app developer probably received pay-per-click earnings from advertisers who thought he was displaying their ads on websites for people to actually see.

Despite being undesirable, but basically harmless to the user and less sophisticated than other malware families such as Fobus or Simplocker, this app shows that although there are safeguards in place, undesirable apps that fool users can still slip into the Google Play store.

If you installed Dubsmash 2 (package name “com.table.hockes”), you can delete the app by going into Settings -> Apps -> find “Settings IS” and then uninstall the app.

The Avast Mobile Security application detects this threat as Android:Clicker. SHA-256 hash: de98363968182c27879aa6bdd9a499e30c6beffcc10371c90af2edc32350fac4

Thank you Nikolaos Chrysaidos for your help with the analysis :)


April 23rd, 2015

Avast Battery Saver raises the bar with new Wi-Fi-based smart profiles

Avast Battery Saver increases battery life by an average of 7 hours.

Avast Battery Saver increases battery life by an average of 7 hours.

We’ve recently told you about Avast Battery Saver, an application which saves your Android’s power without hassle. It optimizes phone settings such as Internet connectivity, screen brightness, and timeout according to your needs. We’d now like to announce an exciting new feature of the app: Wi-Fi-based smart power profiles. These profiles are activated automatically based on designated local Wi-Fi networks that are detected.  Users can now assign specific wireless networks to be used within their home or work smart profiles. Not only are Wi-Fi-based profiles more precise than GPS-based profiles, but they are also more efficient and require less energy to detect.

In contrast to other battery-saving applications, Avast Battery Saver learns about your daily routine and thus suggests the best smart profiles for your phone. It doesn’t require you to change your behavior or usage, nor does it affect voice calls, text messages, or the ring volume of your phone.

“Everyone needs more battery life for their mobile devices, but most battery savers shut down the wrong apps,” said Jude McColgan, Avast’s President of Mobile. “Avast Battery Saver learns which apps are most important to the user, and shuts down only those that are less used.”

Avast Battery Saver significantly improves battery life, saving up to 20% on one charge — and it’s free from the Google Play Store.

New Wi-Fi-based profiles have been added to make the app’s convenient features significantly more efficient

 

  • Smart profiles activate automatically based on time, location, user-designated Wi-Fi networks and battery level.
  • App consumption detects and permanently stops apps that drain too much battery life.
  • Precise estimate of remaining battery life based on actual phone usage and historical data. Battery level is displayed in a percentage and time remaining in status bar notification.
  • The application can turn off Wi-Fi when there are no known hotspots nearby.
  • Your phone limits connections to the Internet to every 5, 10, 15 or 30 minutes, based on your current profile configuration, when its screen is turned off.
  • Emergency mode is activated when your battery level is very low, and it turns off all functions that require significant energy, saving power for when you really need it (e.g. Wi-Fi, data connection, Bluetooth or GPS).

 

The app currently works with the following four profiles: Home, Work, Night, and Super-Saving Emergency Mode. You can easily access the list of profiles by clicking the Smart Profiles button on the app’s home screen. Avast Battery Saver is available for download in the Google Play Store.

Comments off

April 22nd, 2015

Avast highlights Battery Saver users for their positive impact on the environment

Today is Earth Day. It’s a day that people, organizations, corporations, and governments around the world demonstrate their commitment to protect the Earth and help advance a sustainable future. Every action, no matter how small, counts -  from eating less meat to recycling or composting to reducing your energy footprint; it all contributes to a cleaner, greener world now and in the future.

Avast users do their part to save the Earth

Since our minds are on all things green this Earth Day, we want to highlight a particular bunch of Avast customers. These Android users simply came to Avast to find a way to save some of their smartphone’s battery power. Little did they realize when they installed Avast Battery Saver on their Android device that together they were making a difference that even we were surprised about.

In the first month that Avast Battery Saver was available, 200,000 customers downloaded and actively used it on their Android phone or tablet. This infographic shows how that cumulative use added up to real energy savings.

Do your part for Earth Day, and save up to 20% battery power everyday! Install Avast Battery Saver for free from Google Play.

battery-saver-infographics-ENsm

Install Avast Battery Saver for free from Google Play.

Comments off

April 21st, 2015

Avast for Business adds 75,000 new customers in just two months

Avast for Business

Luke Walling, GM of Avast for Business, had confidence in the Avast for Business product all along. But the explosion of new customers has surprised and delighted even him. ~Editor

Avast for Business is the industry’s first free, easy to use, cloud-managed security offering that protects small-to-medium-sized business (SMB) from cyber attacks and data breaches.

The new product has been available for two months, and already more than 75,000  SMB owners have enthusiastically selected Avast for Business to protect their companies.

The new, cloud-managed solution has specifically been adopted by IT consulting, education, and non-profit sectors. Early results also show a strong uptake in managed service providers, who make up 12 percent of Avast for Business’ total installed device count and 2.5 percent of its new users.

A reason for it’s booming success is because most start-ups, small businesses, schools, and nonprofit organizations lack the IT infrastructure to install costly and complex on-premise security solutions. Avast for Business provides the ideal solution. It’s easily scalable and managed from anywhere. Additionally, Avast for Business starts at a price everyone can afford: free, making it a natural fit for small-to-medium-sized businesses and organizations worldwide.

Avast for Business is free for as long as you want it and for an unlimited number of admins and devices. Protect your company with Avast for Business.

Avast for Business

Avast for Business replaces expensive, complicated security solutions for SMBs.

Categories: SMB/Business Tags: , , ,

April 20th, 2015

Why some people would rather be right than believe a malware warning

usb_hub_robot

This innocent looking USB drive could lead to infection – but only if you second-guess Avast warnings!

Would you rather trust the virus experts or your instincts?

Every day 140,000 people connect their USB flash drive or mobile phone to a computer, and get a warning from Avast about an infection called LNK:Jenxcus.

Which kind of person are you?

Many of them act on that information from their trusted Avast Antivirus security software and as a result, they scan their USB device for malware and they wipe it away. Crisis over.

But there is another group of people who keep this infection alive and active, because they refuse to believe it is a real or dangerous threat. In other words, because something has always been one way, they assume it can’t change, therefore Avast must be wrong.

As a result, they decide to turn off their antivirus shield and by doing so, they create an obstacle-free way for malware to enslave their computer and steal data or valuable computing time.

A perfectly good reason. Or is it?

One of the most frequent reasons people use for disabling shields and allowing malware to spread in their computer is

“I use this file all the time and it is safe.”

Another variation is,

“I created this file, it’s only a picture.”

Do you find this situation familiar? Are you guilty of over-riding the security software you installed to protect yourself?

If your answer is yes, then test your virus detection knowledge with the image below. There are two screenshots of a directory from a USB stick; one is infected and the other is clean. Can you tell the difference?

usb_folder_compare

It’s difficult to tell, isn’t it?

The one on the left is infected. The most visible differences are on the icons, but there is another clue in the file types. Some files and directories on the left side changed their type into a shortcut. This happened because a malicious script installed itself onto a USB drive and replaced legitimate files with links. If the owner of the USB opens the directory Firm Accounting, for example,  he executes malware that in the end opens the real Firm Accounting directory, so it looks like everything is normal. But it is not, because in the background all the computer’s drives are getting infected over and over again.

Avast detects LNK:Jenxcus and warns you.

The trick is; you have to heed the warning.

Source of infection

Except from other infected drives, this malware is downloaded onto your computer from hacked websites. The screenshot below shows an example of a hacked website waiting for random users with a vulnerable internet browser. Can you tell the difference this time?

www_page_compare

If you answered no, you are absolutely right, because for the normal user there is no visible change. That is probably the reason for another frequent excuse before disabling the shields,

“I visit this page every day. It doesn’t have malware.”

That’s just not good enough, because the fact that the page is clean most of the time, does not mean it is not vulnerable to attacks. In fact most small and medium-sized business (SMB) pages have some exploitable vulnerability and when they get targeted by exploit kit authors, your best chance to stay safe are updated applications and active antivirus. With the shields ON!

Extermination

If you are comfortable with computers, then you may want to clean this infection manually. Start with your computer and look for links (.lnk) and visual basic script (.vbs .vba .vbe) or batch files (.bat). Links usually point to this hidden script files so it is not hard to find them. If you wonder where the original files are, you can find this information in links too. They were not moved in most cases, just marked as hidden so they are not visible on computers with standard configuration. When you are sure all hard drives are clean, it is time to go through all your removable ones and go through the same procedure.

An easier way to clean an infection is by using a good cleaning tool. If you need help searching for such tool, visit our Avast forum and read what others do in your situation, or ask nicely for help from Evangelists, who dedicate their free time to helping users and researching security problems.

Suspect a false positive?

If you think it’s a false positive, do a little checking first. The Avast forum is a good place to start. You can read about LNK:Jenxcus, or you can start a new thread with your own question.  If you are still convinced that you have a false positive, then please report it so the Avast Virus Lab can determine how/why it’s detected,. This video tells you how,

 

 

Categories: lab, Virus Lab Tags: , , , , ,

April 17th, 2015

TGIF: Avast news wrap-up for April 3 – 17

The Avast bi-weekly wrap-up is a quick summary of what was on the Avast blog for the last two weeks.

house cleaning serviceSpring has sprung and it’s time to clean the dust and grime away after a long winter. In a departure from our regular security-oriented blog posts, we share 10 spring cleaning tips to combat grime. Don’t forget you can also clean your mobile devices! But you barely have to lift a finger because Avast GrimeFighter Safe Clean will remove the grime from your Android mobile devices with the touch of a button. If only window washing were so easy!

Screenshot_shieldsIndependent testing lab AV-TEST gave their coveted certification to our popular mobile security application, Avast Mobile Security. If you are still on the fence regarding protecting your Android smartphone then read How to find the best protection for your Android phone? Independent tests.

Don't forgetMany smartphone owners are more worried about losing their device then they are about becoming infected with malware. That’s why we created Avast Anti-Theft. Make sure you have the latest version of our free app so if your phone gets lost, you can track it via your My Avast account or using SMS notifications from your friend’s phone. Turned Android auto-updates off? Manually update Anti-Theft to stay protected. explains how you can use Avast Anti -Theft to recover your lost Android device.

Battery-Saver--1920x1200The mobile development team released a handy little app called Avast Battery Saver. This free app from Google Play helps you save some battery power. But not just any app can do it. The blog post Fear and loathing on Google Play: An in-depth look at today’s battery saving and cleaning apps gives us the scoop on apps that promise to save battery life with task cleaning.

How to use Avast productsHow to extend the life of your phone’s battery is a question that we all have when the juice starts running out. The Avast Battery Saver app can help save about 20% but there are other ways to save battery life. We give you the tips and also share the future of smartphone batteries.

laptop using Wi-FiThe unsecured Wi-Fi hotspot at the local cafe can be bad news if thieves capture your login credentials. Android users with Avast Mobile Security have a built-in feature called Wi-Fi Security that warns them if any issues are detected. We are now seeking iOS beta testers for an app called Avast SecureMe that will include the same type of feature for iPhone users. Check our blog Wi-Fi Security feature foolproofs your network connections both in public and at home and scroll down to the bottom for the beta test sign up link.

Mousetrap with cheeseCybercrooks use a variety of attack vectors to reach their victims. Targeted spearphishing attacks use email messages to trick people into providing sensitive information while malicious apps for Android disguise themselves as innocent games. The scary ransomware locks up all your files and demands ransom for the key to unlock it – on both PCs and and mobile devices! Avast keeps you aware of cybercrooks latest tricks in Don’t take the bait: Beware of web attack techniques.

Comments off