Slashdot Mirror
New Android Trojan Fakes Device Shut Down, Spies On Users
An anonymous reader writes A new Android Trojan that tricks users into believing they have shut their device down while it continues working, and is able to silently make calls, send messages, take photos and perform many other tasks, has been discovered and analyzed by AVG researchers. They dubbed it, and AVG's security solutions detect it as PowerOffHijack.
Issue closed by NSA
If you really need privacy, you pull the phone battery....and if you might need privacy, you don't buy a phone that can't have its battery pulled.
Not really any solutions, as long as people are walking around with what amount to wireless microphones in their pockets this will always be a potetial problem.
"I opened my eyes, and everything went dark again"
Why is it so damned easy for malware to get root access, and so damned annoying for me to get it?
And, quite honestly, by how annoying and intrusive AVG was becoming when I got away from it ... do we have another source which confirms this?
I'm just not sure I trust them to be quite honest.
Lost at C:>. Found at C.
You may Save a few bucks using pirated software but you'd better stay with the original Play store even if it costs you some dollars to register your app and at lest you make a developer happy for his job
yes actually, but the NSA has been caught doing the last few times in a row, its not ignorant ot make that assumption.
This capability predates Android and was used against feature phones quite a number of years ago. The countermeasure then, as it is now, leave your phone elsewhere or pull the battery if you really need to be sure you aren't being monitored.
should've been the name they gave it.
I think its fair to say that it takes a user to install it first, linux has pretty much always had trustworthy repositories, Google not so much.
I love some of the things you can add to chrome but there seems to be little to no security checking of what an app or extension does. That does worry me.
Blarney Quality Restaurant, Plants
I'd say that Avast is best among the free Windows options and that the free version is specifically a better product than the paid one. One of the paid modules is god-awful for system performance.I only install the Virus and Web Shields and the Browser Cleanup and Rescue Disk options. The rest is just fluff and my local mail gateway will check emails anyway.
Microsoft Security Essentials on Windows 7 is more of an antimalware tool than functional antivirus and testing has shown it to be progressively less effective even at that.
Avira insists on generating pop-ups every time you do anything with it. At least Avast can be put permanently into game mode if you never want it to put messages on screen.
AVG is a performance boat-anchor and some the branded add-on tools distributed by AVG are now recognized by removal tools as Potentially Unwanted Programs. Between those things, I put AVG in the same "uninstall on sight" category as home versions of McAfee, Norton and Webroot security products.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
The only AV products I've found which actually do anything are SpywareBlaster and Malwarebytes, because MB actually blocks by IPs, and SpywareBlaster doesn't actively run, but sets kill bits and blocklists in browsers.
However, with an adblocking browser extension, Web based malware should never hit your system in the first place, and with click to play functionality, should not have a chance of being activated... and with a VM or sandbox, even if the browser does get compromised, it won't get past that.
As for Android, the weakness is that a lot of Chinese stores have little to no curation or filtering out bad stuff. Google does a decent job in stomping out the bad stuff, but I still think they need to go with two tiers, one tier as things are currently, and one tier where developers have to agree to more stringent rules, and the software has to pass more tests... that way, if a user sticks to the more curated tier, there is less chance of an infection happening.
One note -- the exploits we read about with Android almost always are related to either pirate repositories or "app stores" with little to no moderation. Even something like Cydia's ecosystem would be highly unlikely to have malware like this ever hit it it in the first place, and if it did, the devs would have it pulled in minutes to hours.
As for AV software, I use it on machines to make legal eagles happy. I've yet to see it actually actively stop a compromise of a machine. At best, it is good for scanning for 1+ day stuff. The real defense are the IP blacklists, hosts files, kill bits (SpywareBlaster is quite useful), Web browser extensions and click-to-play. The best mitigation if an infection happens are sandboxes (SandboxIE), virtual machines, and jails. AV was useful back when one scanned a floppy with the latest copy of Doom on it, but these days, it is more for the checkbox in paperwork than actual protection.
It's probably in apps that are either copies of or otherwise masquerading as good ones. Listing them would just serve to hurt the makers of the actual real apps while not acomplishing much as the malware pedler's would just quickly adapt by copying someone else's app. It's better just to inform the marketplaces to pull the offenders and publish articles like this to remind people to be careful of what they install in general.
yes actually, but the NSA has been caught doing the last few times in a row, its not ignorant ot make that assumption.
With a track history like the NSAs, it's not even an assumption. It's more like a statistical certainty.
I think the MVPS.org hosts file is a good idea for everyone on every device, but anyone using Windows 8+ should know that if the Windows Defender Service is enabled (and I've seen system updates re-enable it), Windows 8 will ignore the content of your hosts file.
My standard protection list is: Adblock+ with Easylist, Malware Domains and Fanboy's Annoyances subs (I also use Warning removal and turn off unobtrusive ads) for every browser on every user account. I actually impregnate the default user account on whatever desktop OS to make sure every account gets CREATED with those options turned on for Mozilla and Google browsers.
Adblock+ for IE doesn't have all those options, but as of version 1.3 at least unobtrusive ads can be turned off. IE does support TPLs, so in an AD environment I mandate the Easylist TPL for basic ad blocking, even if the user disables other ad blocking tools.
On Windows machines that don't have some kind of security appliance or web filtering in place, I also install Spybot Search and Destroy for its Immunization function.
I'll also throw Malwarebytes on absolutely everything and I urge end users to avoid installation of Java and Adobe Acrobat Reader as much as humanly possible. On systems that I maintain, I have a script that adds a scheduled task to install Chocolatey.org's repo + scripts to update browsers, flash, PDF reader et al on Windows machines.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
If a vampire tries to enter your home he will not succeed...unless he can get you to invite him in. Once you have invited a vampire in you are screwed!
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
MBAM does have an AV module in its paid product, but I think you're not making a distinction between anti-malware and anti-virus applications.The two things are distinct and primarily differentiated by whether or not the software in question tries to spread itself to other files or computers. I agree that anti-malware is much more important because it is much more commonplace, and in my experience there is no single tool that is actually worthwhile for both types of protection, but Windows machines do need both and are best served with best of breed protection from multiple products rather than a single tool that might only really offer worthwhile protection from one side or the other.
I'll also say that Spybot Search and Destroy offers a much more comprehensive array of malware blocking tools when compared to Spywareblaster and it should probably also be in your tool belt.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
At about the peak of analog phones, most would have a dumb message on the screen, usually the maker's name or the carrier name. You could often change this message but almost nobody did, but the displays were so primitive that informational messages usually appeared in the same place and type, like "NO SERVICE".
The fun thing to do was to change the message from "Airtouch Celluar" to "NO SERVICE" and enjoy the hilarity when people picked up their phone and wondered why it wasn't working.
Yes, most phones showed "bars" and there was no reason why someone with half a brain wouldn't sort it out in a second, but it was often funny how many DIDN'T sort it out.
As the article state it needs Root to do it.
And it do not say how you gets it.
So it's some code that need root access to mess with your phone.
So you properly just need to root your phone. And install an app that you have downloaded from some suspected webpage.
So is it a Trojan or just a feature from a rouge app/programmer?
Do not root your phone if you do not have any idea what you are doing and installing apps from every that you find.
Have gnu, will travel.
That's because the malware, after having previously obtained root access
how did it get root? either the device was rooted and the user granted the app root privs (duh!), or they've discovered a hack to gain root on non-rooted devices. if it was the latter, we'd be hearing a lot more about it, and faking a phone shutdown is the least of our concerns.
I'm more likely to use Spybot's, on systems that support it. That's mostly out of laziness. It's actually possible to do both. Spybot will append its list to whatever is already present, but functionally they're close enough that I don't bother.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
These things always happen to people who are using 3th party app stores, besides f-droid (which only has open source android apps), what could the possible reason be to use 3th party app stores? what apps are on there that you can't find on the play store?
On a long enough timeline, the survival rate for everyone drops to zero.
There is no better reason then to stiff up your lip, and write backdoors for no one. The best practice for dealing with the NSA just happens to be best practice for dealing with the GCHQ, Russian FSB, and whatever the chineese, french, or any other nation state has.
1. blow the whistle on everything. Don't ever spy exlusively for any powerful institution.
2. don't write backdoors for anyone
3. don't weaken crypto for anyone
4. don't get involved in super-secret squirel spy-vs-spy plots, for anyone, for any reason(you never know who's pulling the strings, and you know they are all bad). Stay away from the shadows as much as you can. Drain the swamp on unethical behavior
5. write/use/recommend systems that are more distributed and peer to peer systems that can't be controlled centrally, and are hard to stop, or monitor.
6. Release all code and schematics Free and Open Source. Help inspect and audit others code.
7. Put all bugs in the core stack of Free software in appropriate bug trackers and get them fixed, to prevent people from getting spied on. If any company open sources their firmware, help them make sure there are no backdoors or other bugs in it.(its a self serving favor, like everything in Open Source).(white hat hacktivism is best hacktivism) 8. Associate with like minded people to help protect yourself. Agitate to get people to fix bugs, and adhere to the above. Don't be affraid of making alliances of mutual aid, which are unconventional, if they work in common intrest.(an Anarchist as myself, teaming up with corporations to make sure that critical pieces of software and hardware remain free and secure, and readily available).
The point is that we can make social change that weakens the ability of large organizations to use surviallence as leverage against non-involved citizens and use people against their will. This will make governments world wide need more consent from the people to rule, thus improving conditions for everyone world wide
All hackers, programmers, technicians, can and will make a diffrence.