Slashdot Mirror
Malware That Fakes Bank Login Screens Found In Google Ads (fastcompany.com)
tedlistens quotes a report from Fast Company: For years, security firms have warned of keystroke logging malware that surreptitiously steals usernames and passwords on desktop and laptop computers. In the past year, a similar threat has begun to emerge on mobile devices: So-called overlay malware that impersonates login pages from popular apps and websites as users launch the apps, enticing them to enter their credentials to banking, social networking, and other services, which are then sent on to attackers. Such malware has even found its way onto Google's AdSense network, according to a report on Monday from Kaspersky Lab. The weapon would automatically download when users visited certain Russian news sites, without requiring users to click on the malicious advertisements. It then prompts users for administrative rights, which makes it harder for antivirus software or the user to remove it, and proceeds to steal credentials through fake login screens, and by intercepting, deleting, and sending text messages. The Kaspersky researchers call it "a gratuitous act of violence against Android users." "By simply viewing their favorite news sites over their morning coffee users can end up downloading last-browser-update.apk, a banking Trojan detected by Kaspersky Lab solutions as Trojan-Banker.AndroidOS.Svpeng.q," according to the company. "There you are, minding your own business, reading the news and BOOM! -- no additional clicks or following links required." The good news is that the issue has since been resolved, according to a Google spokeswoman. Fast Company provides more details about these types of attacks and how to stay safe in its report.
In order to view this post, please reply to it by logging into your slashdot account. Please enter your username and password in the reply box and press the "preview" and "submit" buttons.
as the old movie said: the only winning move is not to play
>> Fast Company blah blah...
I thought that place folded in the late 1990's. Did somebody buy the rights or has Fast Company just been quietly publishing to some invisible niche for the past 16 years?
Hey! My Chevy volt gets 250+ mpg. So I'm better than u, uBlock!
This Slashdot story is a very effective advertisement for ad blockers.
"It then prompts users for administrative rights..."
Why would you give admin rights to something you didn't explicitly download?
Just cruising through this digital world at 33 1/3 rpm...
It's because your ad business model is broken. How long will it take before you admit to yourselves that accepting random scripted ads from an insecure third party ad farm totally out of your control is stupid? Either vet the ads yourself (and accept responsibility if you let a malicious ad get through), or contract it out to a third party security service which does it for you.
Too hard you say? Here's a hint: If the only ads you allow are a static JPEG which clicks through to the advertising site, you've done your job. Newspapers and magazines got along just fine for over a century with static ads. Advertisers don't need scripting, and in fact they've demonstrated they're too immature to be given the power of scripts.
And I don't exempt anyone, not even "safe" vendors like Google. No ad network is truly safe, they all deliver malware sooner or later.
would automatically download when users visited certain Russian news sites, without requiring users to click on the malicious advertisements
Can we please stop pretending that computers "automatically" do things, as if they are some magical entity that is not subject to understanding? They do what they are programmed to do, and configured to do within that programming.
Ads do not "automatically" download jack shit. They download things if you are allowing unknown remote sites to run scripts without your explicit approval. Almost always that happens because Javascript was enabled by default, which we have seen about 1000000 times is a security clusterfuck. Almost all such events happen only because someone said, "Sure! I don't care who the other party is, I'm just fine with them running code I haven't seen on my computer, automatically, by default. No no, really, it's fine! Go right ahead. I don't care what you want to do. Behavioral tracking, malware downloading, anything you want! Go for it! Door's wide open."
This is no smarter than letting anyone, at any time, use your house for any purpose they might want, "as long as they promise to stay in the living room". Drug cartels? Mafia? Human traffickers? It's all good! No, I don't need to approve the uses of my house, I'm willing to let literally anyone in the world use it for any reason. Later on, I'm going to act mystified about why the SWAT team just showed up, my house is on fire, there's a dead body in the kitchen, and the neighbors are running around screaming. There can't possibly be any connection between that, and my default-allow policy.
If you wouldn't do that with your house, why would think it's any smarter to do it with your computer?
Would a host blocker written in Delphi help here?
The good news is that the issue has since been resolved, according to a Google spokeswoman.
She now uses adblockers. Right?
Unfortunately for sites that rely on advertising to survive, malware delivery through ads is nothing new and this forces many people to block ads as part of their online security. This is not because the sites they visit are not trustworthy. It is simply due to the fact that not every advertiser can be trusted and the companies serving ads have failed to effectively prevent malware getting on to their networks. Criminals distributing their malware through ads are able to reach legitimate web sites that they would be unable to compromise, expanding their reach to a larger audience and making it an attractive option.
Many of us would be happy to view ads to support our favourite sites but are unwilling to take the risk. Antivirus software can only protect against known threats so, when new malware is constantly being discovered, their success rate of detection can never be 100%. Antivirus software forms part of a sensible online security plan but it does not replace ad blocking or blocking third party scripts.
The good news is that the issue has since been resolved, according to a Google spokeswoman.
Yeah, well, the bad news is it happened in the first place, dingus. EVEN GOOGLE ADS GET COMPROMISED, this isn't the first time. Ads are an exploit vector, protect your network accordingly.
depois tu não sabe pq eu nao ligo pra merda da tua mãe, seu freemason pedófilo filha da puta.
Remind me about the Ad pushers rights to force malware? I smell Class Action Lawsuit!
And once again, Ad Blocking is justified. Those darn ads can be outright dangerous, which computer people have been saying for years.
Simply put, if companies can't be bothered to vet the ads they're serving, we can't be bother viewing any ads at all. Clean it up, already.
Really?
It is pitch black. You are likely to be eaten by a grue.
A publisher or ad network can still protect users by recompressing advertisers' uploaded files. There are two ways to go about this. One is to use a JPEG optimizer such as IJG's jpegtran, which optimizes JPEG files without additional loss. The other is to require advertisers to upload PNGs or high-quality JPEGs and then transcode them to web quality using mozjpeg.
By simply viewing their favorite news sites over their morning coffee users can end up downloading last-browser-update.apk
Yeah, right, like I'm going to trust APK to defend me against apks.
By updating the Host file (yes, it will be a back and forth thing) the ability to block the web sites and keep this crap from coming in - or going out. Great, they can capture all the key strokes they want. HOWEVER: if the data can't make it out, it is useless to them.
Also - for those of us who use a different computer for bank activities: how can we block entire countries?
Fuck off, loser.
would fall for such a cheesy trick? Certainly none of the brainiacs here at /. right? ;-)
See subject: It's all there needs to be said about it - take your own far more TRUE about YOU advice. You're a scared unidentifiable imaginary man (lol, see below) in your own mind zero...
APK
P.S.=> It's as if this place has become so troll infested it's hilarious - your type's the worst & I call "your kind", lol, the "not-men" (as in weasels) - they signal downmods of my posts I just laugh MORE @, & why? Ever see the film "LIMITLESS"? That's me exhausting you of YOU & your sockpuppets' modpoints also - & in the end?? I post unscathed, as always... takes brains - you don't have them (or balls) doing what you do, unidentifiable weasel... apk
And my family wonders why I refuse to use my phone as anything other than a phone.
If it isn't obnoxious ads, it's poorly preforming apps, and if it's not those two, it's the bill at the end of the month.
One way or the other, if you have a cell phone in the US, you're going to get "got".
Ever notice how they call it a "cell" phone? You keep prisoners in cells. Just sayin'.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
When are Google going to wake up and take security of their mobile OS seriously?
Their security model is broken - completely. They just need to start over.
And with that, all the "good advertisers" bullshit is dead. Not just scammy and shady ad networks deliver malware. Advertisement is evil and needs to die, at least the way it is handled right now. The whole thing needs to be made illegal and restarted fresh with a clean slate and the first question should be "what do we, the users, want from advertisement?".
I like product information, for example. I'm a big fan of sites that compare products. These days, there are a thousand mobile phones, or printers, or vacation destinations, or chairs or cars or really anything, and it's not easy to find the one that's perfect for you.
There's also new and interesting stuff coming out all the time, and most of us miss most of it. Something that focusses on these aspects, on the customer desires, that would be wonderful.
Assorted stuff I do sometimes: Lemuria.org
Does this Google malware weapon work on anything else except Microsoft Windows ?
because you know I always log on to my bank from the ad banner at the top of third party websites..
The best way to deal with these problems would be for browser manufacturers to simply remove javascript (and any other scripting language support) from the browser altogether.
"But... but we won't be able to play audio, video, make things spin and whirl" etc. etc. the hordes will cry. And nothing of value will be lost.
At the very least banks should produce dedicated, hardened browsers with no javascript/flash/whatever support, no cookie support and should serve their online banking pages by hosting all page resources on a single URL, and lock their browser to that URL and that URL only.
Javascript has utterly ruined the web. It should be put to death. For every small bit of utility it provides it has provided 100 times more exploitable problems. Not to mention all the code abominations where idiots have misused it to replace simple HTML facilities (such as the "a"nchor tags) with crap code.
The articles don't seem to say, or I missed it. But I assume for this to work you would need to have side loading enabled.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Google takes ads from whomever regardless of their content in a money grab and Android fails at security when it comes to these ads...
The entire Google ecosystem is a wreck.
I'm never going back to that nonsense.
Every once in a while APK is actually relevant. But there is something to be said about horseshoes and hand grenades.
I'm a good cook. I'm a fantastic eater. - Steven Brust
Meanwhile, these asshats are trying to force users to stop utilizing tools like Adblocker. "Trust us" they say. Well... BULLSHIT on you.
"Shall we play a game?" -W.O.P.R.
Ads can be good. They can enable commerce and content. Responsible advertising contains a combination of three things: a still image, and/or text, and a link. IOW: an HREF element, and within that, an IMG element and/or perhaps (preferably) some textual content. No scripts other than what's required to actually serve the ad, no videos, no animations, no scraping of user-specific information.
Anything/everything else is abuse.
Remember when Google was all about text ads?
Google's ethics cancer took care of that. For myself, I don't see many ads any longer. The status quo is to attempt to abuse me; fine. The status quo on this end is to block ads.
I've fallen off your lawn, and I can't get up.
This is why I don't call them "Adblockers" but "Malware Vector Blockers".
Google is a spy shop. Slashdot is FBI.
Yea yea yea, malware ok got it.
APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?...
Ads rob speed, security (malvertising), privacy (tracking).
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively.
Works vs. caps & PUSH ads.
Avg. page = big as Doom http://www.theregister.co.uk/2... & ads = 40% of it.
Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity.
Compliments firewalls (blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load).
Gets data via 10 security sites.
APK
P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "seen the code & it's safe" http://forum.hosts-file.net/vi... )
Yes he is. He's only 1 of perhaps 4 here who actually personally are relevant in computing due to their work in programs they produce or sevices they created. Not many here are or can prove it.
Adblock can't do (or do as well) 16 things hosts do 4 speed, security & reliability:
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnet C&C servers
3.) Protect vs. dynamic dns botnet C&C servers
4.) Protect vs. DGA botnet C&C servers
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS redirect poisoned/downed dns
7.) Protect vs. trackers
8.) Protect vs. spam payloads
9.) Protect vs. phish payloads
10.) Protect vs. caps
11.) Get past dns blocks
12.) Keep off dns request logs
13.) Speed up 2 ways (adblocks & hardcodes)
14.) Work on anything webbound multiplatform.
15.) Ez data edit
16.) Block ads more efficiently in cpu/ram/I-O us
APK
P.S.=> Ab+ does less vs. hosts less efficiently (a 128-151mb memory hog http://cdn.ghacks.net/wp-conte...)
ClarityRay defeats it
Ab+'s bribed not to work by default http://www.businessinsider.com...
AdBlock's SLOWER: http://superuser.com/questions...
^Garbage.
"Every legitimate app is going to be on Google Play or on iTunes" Then where are the adblockers and F-Droid on Google Play?
^Do nothing troll douchebag
I support APK's stand on the hosts file by Trax3001BBS
his hosts program is actually pretty good by xenotransplant
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg
I've never tried to belittle (APK's) work, I've flat out said it's good by BronsCon
I like your host file system by Karmashock
I find your hosts file admirable by vel-ex-tech
take a look at the APK hosts file engine by SuperKendall
APK is kinda right. I've given up on JS based adblocking and gone to blackholing in /etc/hosts, just like it was back in the 90s. The computational load has gotten intolerable for any ad-blocking using JS. I've tried his hosts file generating software. It works by bmo
APK is totally right on this count. Adblock Plus on Firefox mobile is a dog on older, or lower end, phones. A hostfile based adblocker makes for a much better experience by chihowa
APK
P.S.=> Want more? apk