Slashdot Mirror
Targeted Attack Campaign Uses Android Malware
Trailrunner7 writes "Android attacks have become all the rage in the last year or two, and targeted attacks against political activists in Tibet, Iran and other countries have been bubbling up to the surface more and more often. Now, those two trends have converged with the discovery of a targeted attack campaign that's going after Tibetan and Uyghur activists with a spear-phishing message containing a malicious APK file. Researchers say the attack appears to be coming from Chinese sources. The new campaign began a few days ago when unknown attackers were able to compromise the email account of a well-known Tibetan activist. The attackers then used that account to begin sending a series of spear-phishing messages to other activists in the victim's contact list. One of the messages referred to a human rights conference in Geneva in March, using the recipients' legitimate interest in the conference as bait to get them to open the attachment. The malicious attachment in the emails is named 'WUC's Conference.apk.'"
The Android App harvests information (contacts, SMS messages, location, SIM data) and reports it back only when ordered to by the reception of a SMS message command. The location is particularly troubling because they can just keep pinging the phone to track the individual in real-time, then who knows what could happen next.
Better known as 318230.
No apologies here. If someone is stupid enough to install a program they receive in email and they weren't expecting one? C'mon!
I'd still rather be able to choose what I want to install than to have the maker and/or seller of the device make those decisions for me.
Regardless of the system, an incompetent privileged user is always going to be a vulnerability.
Wrong APK :)
Do you even lift?
These aren't the 'roids you're looking for.
Before cellular phones existed the Israelis targeted one of the people responsible for the Munich Olympic killings using a good ole fashion public phone. Technology marches on but usually the end result remains basically the same.
It's called spear phishing. Where instead of blasting a million messages to everyone at random, you send a very plausible message to someone who ought to know the sender.
Basically, what happened here is someone hacked an activiist's email account, and used it to send a plausible looking message to their contacts, like say, something about an upcoming human rights conference. The recipient sees it's from someone they trust and the message is appropriate to their relationship (i.e., it came from a human rights activist and is about a human rights conference).
Yes, you probably should not be clicking links from anyone, even those of your trusted friends and relatives, but for most people, they believe it's authentic. Hell, the RSA hack happened the same way - a faked email coming from the hiriing company RSA uses went to the HR coordinator claiming to be a list of new hires.
Exactly right! That is the solution. To be able to do what you like you need $99/yr and enough knowledge to run Xcode. I think it's a pretty good solution.
Er, no? How about take away the privilege by default, and require that the user enable the ability install potentially insecure apps? Those of us who are responsible with our devices shouldn't have to pay the maker of our preferred OS to toggle a setting.
... yeah, don't you need to buy a Mac as well? I think a check box in the settings works perfectly fine.
It's still no excuse. YOU DO NOT OPEN ATTACHMENTS THAT YOU ARE NOT EXPECTING. It doesn't matter who the source is. Anyone could get hacked. Even if the source is someone you trust, but the message seems out of the blue and not something you expect, you get back in touch with them and ask if they sent it. Just because the message seems authentic doesn't mean that it is. It's still your fault as the user for trusting something that you shouldn't.
I have left slashdot and am now on Soylent News. FUCK YOU DICE.
that's fine, just don't text/email/call me from your android, so i can be sure I'm safe.