Slashdot Mirror
Tech Firms Team Up To Take Down 'WireX' Android DDoS Botnet (krebsonsecurity.com)
An anonymous reader quotes a report from Krebs On Security: A half dozen technology and security companies -- some of them competitors -- issued the exact same press release today. This unusual level of cross-industry collaboration caps a successful effort to dismantle "WireX," an extraordinary new crime machine comprising tens of thousands of hacked Android mobile devices that was used this month to launch a series of massive cyber attacks. Experts involved in the takedown warn that WireX marks the emergence of a new class of attack tools that are more challenging to defend against and thus require broader industry cooperation to defeat. News of WireX's emergence first surfaced August 2, 2017, when a modest collection of hacked Android devices was first spotted conducting some fairly small online attacks. Less than two weeks later, however, the number of infected Android devices enslaved by WireX had ballooned to the tens of thousands. Experts tracking the attacks soon zeroed in on the malware that powers WireX: Approximately 300 different mobile apps scattered across Google's Play store that were mimicking seemingly innocuous programs, including video players, ringtones or simple tools such as file managers.
Experts involved in the takedown say it's not clear exactly how many Android devices may have been infected with WireX, in part because only a fraction of the overall infected systems were able to attack a target at any given time. Devices that were powered off would not attack, but those that were turned on with the device's screen locked could still carry on attacks in the background, they found. The identical press release that Akamai and other firms involved in the WireX takedown agreed to publish says the botnet infected a minimum of 70,000 Android systems, but Seaman says that figure is conservative.
Experts involved in the takedown say it's not clear exactly how many Android devices may have been infected with WireX, in part because only a fraction of the overall infected systems were able to attack a target at any given time. Devices that were powered off would not attack, but those that were turned on with the device's screen locked could still carry on attacks in the background, they found. The identical press release that Akamai and other firms involved in the WireX takedown agreed to publish says the botnet infected a minimum of 70,000 Android systems, but Seaman says that figure is conservative.
Name the fucking apps or GTFO!
Death to Billionaires
Give us our Basic Income
The question everyone is asking. #Mueller is hunting.
I still don't see why they don't release the names of the compromised apps. I now trust the app store less. Guess I should have never trusted it in the first place.
Trump lied! America isn't great again!
Can't wake up!
You know, that Android advantage of unrestricted background execution... Yeah, yeah, they fixed it in Oreo, which is on all of 600 devices at this point.
Another day, another Android security mess. Oh, and look, it comes straight from the Google Play store, again.
1. Google identified approximately 300 apps associated with the issue, but they have NOT made that list available to users.
2. Not only has Google blocked these apps from the Play Store, but they’re in the process of removing them from all affected devices with NO user notification. This is despite the fact that they have the email address of the user.
3. They clearly want to be seen as a savior, but in fact, they have caused the problem by failing to exercise control over the companies that use Android and the Android name.
4. These idiots are worse than Microsoft ever was. There is no attempt at a solution here - just a stopgap action. No matter what you think of Apple, they would never let this kind of nightmare go unchecked.
Android Treble may finally help with this disaster - but for now, those of you that can, should try LineageOS.
That isn't even a minor botnet. That's a half-arsed hobby project. And this requires an unprecedented press release? Methinks a minor threat is being leveraged for some wider purpose.
Your prophet is a registered sex offender in both Vietnam and Thailand. Just so you know.
See subject & these domains to block out in hosts files:
0.0.0.0 u.axclick.store
0.0.0.0 g.axclick.store
0.0.0.0 p.axclick.store
0.0.0.0 axclick.store
0.0.0.0 com.luckybooster.app
0.0.0.0 luckybooster.app
* Per https://blog.cloudflare.com/the-wirex-botnet/
APK
P.S.=> Of course, nothing builds a custom hosts file for more speed, security, reliability & anonymity online better than APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ ... apk
Before WhatsApp was devoured by a giant tech firm, it was also accessing your address book. I uninstalled it after reading the Privacy Policy. Don't know about its current tactic now though.
See subject: You need a rooted phone & Android Debugging Bridge's PULL command to import & overwrite the existing one.
* Plus, what happens to you IF you need to hookup with a router that does NOT have the blocking list? You're "SOL" depending on routers - I'm not using hosts.
(It's ALWAYS there locally on the device itself & it's a standard part of any BSD based IP stack (most if not ALL currently are)).
APK
P.S.=> Those ARE the facts... apk