Windows Spy tool equipped with Android malware to hack Smartphones

I am quite sure that you must be syncing your Smartphone with your Computers for transferring files and taking backup of your device.

If you are using windows operating system and Android devices, then it’s a bad news for you, because FireEye Security Researchers have identified a new piece of windows malware that can also infects your Android Devices.

During an investigation of a targeted attack on a US based financial institution, researchers spotted a new version of Windows Remote Access Trojan (RAT) called 'Win-Spy Software Pro v16', a spying and monitoring tool. WinSpy was embedded in macro documents to kick off a spam campaign via a spear phishing email.

“The recent surge in Android-based RATs such as Dendroid and AndroRAT shows a spike in the interest of malicious actors to control mobile devices. GimmeRAT is another startling example of malicious actors venturing into the Android ecosystem,” security firm said.

The Researchers dubbed the Android spying component pre-loaded with WinSpy as GimmeRat, that allow hackers to control the victims’ device by using their own phone remotely over SMSs, or alternatively through a Windows-based controller.

"We also discovered various Android components that can be employed to engage in surveillance of a target."  security firm said in a blog post.

To install the Android malware, WinSpy communicates with mobile devices connected to the infected computer using a command line tool called Android Debug Bridge (ADB), that allows the Windows malware to execute commands on the Android device. ADB is a legitimate tool and part of the official Android software development kit (SDK). If USB debugging Mode is enabled on the device, it initiates the installation process.

The new Android components also smooth the ways for surveillance of the target and there are three different applications that are part of the Android surveillance package.

“We have found three different applications that are a part of the surveillance package. One of the applications requires commandeering via a window controller and requires physical access to the device while the other two applications can be deployed in a client-server model and allow remote access through a second Android device,” wrote the researchers.

The technique is now new, Similar payload was used by other windows malware called ‘Trojan.Droidpak’ to infect Android Device, that was discovered by Antivirus firm Symantec in January.

Using Android malware, the attackers could trace victims’ GPS location, can take screenshots of victims’ devices and could send these data to the remote Command-and-Control servers. Trojan is also perfect in monitoring the device' text messages.

"The hostname, port, username, and password are used to connect to the attackers’ FTP server to send screenshots, which is explained, in a later section. Once this intent is received the GlobalService is restarted with the interval parameter.." FireEye said.

When Windows system infected with WinSpy, an attacker can take screenshots, log keystrokes and even can also use it to open a backdoor for remote commands, upload and download of more files and the execution of remote commands.

With the widespread use of Smartphones, the adoption of the mobile platforms such as Android has been increased, and so the new market of cyber criminals demands for RATs to support these platforms. Such interesting tactics can be used to serve fake Mobile Banking apps.. Fairly evil Ideas!

Linux Worm targets Internet-enabled Home appliances to Mine Cryptocurrencies

Could a perfectly innocent looking device like router, TV set-top box or security cameras can mine Bitcoins? YES! Hackers will not going to spare the Smart Internet-enabled devices.

A Linux worm named Linux.Darlloz, earlier used to target Internet of Things (IoT) devices, i.e. Home Routers, Set-top boxes, Security Cameras, printers and Industrial control systems; now have been upgraded to mine Crypto Currencies like Bitcoin.

Security Researcher at Antivirus firm Symantec spotted the Darlloz Linux worm back in November and they have spotted the latest variant of the worm in mid-January this year.

Linux.Darlloz worm exploits a PHP vulnerability (CVE-2012-1823) to propagate and is capable to infect devices those run Linux on Intel’s x86 chip architecture and other embedded device architectures such as PPC, MIPS and MIPSEL.

The latest variant of Linux.Darlloz equipped with an open source crypto currency mining tool called 'cpuminer', could be used to mine Mincoins, Dogecoins or Bitcoins.

Symantec Researchers scanned the entire address space of the Internet and found 31,716 devices infected with Darlloz. "By the end of February 2014, the attacker mined 42,438 Dogecoins (approximately US$46 at the time of writing) and 282 Mincoins (approximately US$150 at the time of writing). These amounts are relatively low for the average cybercrime activity so, we expect the attacker to continue to evolve their threat for increased monetization." Kaoru Hayashi, senior development manager and threat analyst with Symantec in Japan.

Major infected countries are China, the U.S., South Korea, Taiwan and India.

Crypto Currency typically requires more memory and a powerful CPUs, so the malware could be updated to target other IoT devices in the future, such as home automation devices and wearable technology.

A Few weeks back, Cisco has announced a global and industry-wide initiative to bring the Security community and Researchers together to contribute in securing the Internet of Things (IoT) and launched a contest called the "Internet of Things Grand Security Challenge", offering prizes of up to $300,000 for winners.

Users are advised to update firmware and apply security patches for all software installed on computers or Internet-enabled devices. Make sure, you are not using default username or password for all devices and block port 23 or 80 from outside if not required.

Uroburos Malware: Russian Intelligence Suspected

Russian government hackers have been suspected of establishing a highly sophisticated piece of malware that is designed to obtain files from digital infrastructure.  The Uroburos malware is named after an ancient symbol, which depicts a dragon eating its own tail.
G-Data said of the Uroburos malware that it was “one of the most advanced rootkits we have ever analysed in this environment”.  The malware is able to work on both 32-bit and 64-bit Microsoft Windows operating systems.  This gives rise to the theory that it is a well-funded effort on behalf of the criminals involved. It is estimated that Uroburos went undetected for at approximately three years.


G-Data said, “The development of a framework like Uroburos is a huge investment. The development team behind this malware obviously comprises highly skilled computer experts, as you can infer from the structure and the advanced design of the rootkit…The design is highly professional; the fact the attackers use a driver and a virtual file system in two separate files which can only work in combination, makes the analysis really complicated. One needs to have the two components to correctly analyze the framework. The driver contains all of the necessary functionality and the file system alone simply cannot be decrypted…The network design is extraordinarily efficient, too; for an incident response team, it is always complicated to deal with peer-to-peer infrastructure. It is also hard to handle passive nodes, because one cannot quickly identify the link between the different infected machines.”
The connection to Russia was established after researchers from G-Data had discovered stacks of Russian-language strings in the code. Also, they found the malware whilst searching for the presence of Agent.BTZ. A piece of malware used in attacks on the United States back in 2008, which were alleged to have been orchestrated by Russian spies.
“We believe that the team behind Uroburos has continued working on even more advanced variants, which are still to be discovered…We are sure of the fact that attacks carried out with Uroburos are not targeting John Doe but high profile enterprises, nation states, intelligence agencies and similar targets.” G-Data added.
Do you think that this originated with Government agents? If you have any sensible comments regarding this story, please leave your comments in the section below.

Android iBanking Trojan Source Code Leaked Online

Smartphone is the need of everyone today and so the first target of most of the Cyber Criminals. Malware authors are getting to know their market and are changing their way of operations. Since last year we have seen a rise in the number of hackers moving from the Blackhat into the Greyhat.

The Head of knowledge delivery and business development for RSA's FraudAction Group, Daniel Cohen warned users about the new threat via a company blog on Thursday, that explains everything about the malware app, called iBanking.

iBanking, a new mobile banking Trojan app which impersonates itself as an Android 'Security App', in order to deceive its victims, may intimidate a large number of users as now that its source code has been leaked online through an underground forum.

It will give an opportunity to a larger number of cybercriminals to launch attacks using this kind of ready-made mobile malware in the future.

Since many banking sites use two-factor authentication and transaction authorization systems in order to deal with the various threats, by sending unique one-time-use codes to their customers' registered phone numbers via SMS, but in order to defraud them, cyber criminals have started to create various mobile malware like iBanking to solve their purpose.

According to Security Researcher Daniel Cohen, the iBanking mobile bot is a relative all new to the mobile malware arena, and has been available for sale in the Underground Hacking Marketplace [Forum Link] since late last year for $5,000.

"We first saw the iBanking malware was distributed through HTML injection attacks on banking sites, social engineering victims into downloading a so called 'security app' for their Android devices," said the RSA researchers in a blog post.

In addition, with the iBanking malware, Computer malware is used to defeat the mobile-based security mechanisms used by the banking sites.

"Apart from the server-side source-code, the leaked files also include a builder that can un-pack the existing iBanking APK file and re-pack it with different configurations, essentially providing fraudsters with the means to create their own unique application," added Daniel Cohen.

In addition to SMS Sniffing, the iBanking app allows an attacker to redirect calls to any pre-defined phone number, capture audio using the device's microphone and steal other confidential data like call history log and the phone book contacts. 

During the installation process, the malicious app attempts to Social Engineer the user into providing it with administrative rights, making its removal much more difficult.

"The malware is an example of the ongoing developments in the mobile malware space and we are now seeing the next generation of malicious apps being developed and commercialized in the underground, boasting web-based control panels and packing more data-stealing features," said Daniel and added that 

"The malware’s ability to capture SMS messages and audio recordings, as well as divert voice calls makes step-up authentication all the more challenging as fraudsters gain more control over the OOB device. This highlights the need for stronger authentication solutions capable of validating users’ identities using multiple factors including biometric solutions."

These Days, the malware apps are particularly dangerous as they are often designed to look as authentic as possible and one in five mobile threats are now bots, which is a sign that the complexity of Mobile Malware is increasing.

First Tor-Based Android Malware Spotted in the Wild

We use our Smartphone devices to do almost everything, from Internet Banking to Sharing private files and at the same pace, the mobile malware sector is also growing.

The number of variants of malicious software aimed at mobile devices has reportedly risen about 185% in less than a year. 

Security researchers have observed a growth in the numbers of computermalware families starting to use TOR-based communications, but recently the Security Researchers at anti-virus firm Kaspersky Lab havespotted the world's first Tor-Based Malware for Android Operating system.

The Android Malware dubbed as 'Backdoor.AndroidOS.Torec.a', using Tor hidden service protocol for stealth communication with Command-and-Control servers.

Researchers detected that the Trojan is running from .Onion Tor domain and working on the functionality of an open source Tor client for Android mobile devices, called 'Orbot', thus eliminating the threat of the botnet being detected and blocked by law enforcement authorities, although often it's not clear how many devices has been infected by this malware till now.

The Trojan is capable of intercepting and stealing incoming SMS, can make USSD requests, stealing device information including 'the phone number, country, IMEI, model, version of OS', can retrieve the list of installed applications on the mobile device, and also can send SMSs to a specified number.

Kaspersky didn't mention particularly that the malware is focused on stealing banking information or not, but the popularity of Android OS is kept motivating cyber criminals to develop far more advanced Android malware with more stealthy and anti-reverse methods.

Here are some things you can do to dramatically reduce the risk of malware infections on your Android phone:

• Install apps from official Android Market instead of third-party app stores or websites.
• Before installing any apps, check the publisher and app reviews.
• Pay attention to app permissions during the installation.
• Install Antivirus and Firewall apps.