Archive | 2012

XMPPloit – A Tool to Attack XMPP Connections

Don't let your data go over to the Dark Side!


XMPPloit is a command-line tool to attack XMPP connections, allowing the attacker to place a gateway between the client and the server and perform different attacks on the client stream.

The tool exploit implements vulnerabilities at the client & server side utilizing the XMPP protocol.

The main goal is that all the process is transparently for the user and never replace any certificate (like HTTPS attacks).

Features

  • Downgrade the authentication mechanism (can obtain the user credentials)
  • Force the client not to use an encrypted communication
  • Set filters for traffic manipulation

Filters that have been implemented in this version for Google Talk are:

  • Read all the the user’s account mails
  • Read and modify all the user’s account contacts (being or not in the roster).

You can download XMPPloit here:

XMPPloit.7z

Or read more here.


Posted in: Hacking Tools, Network Hacking

Tags: , , , , , , ,

Posted in: Hacking Tools, Network Hacking | Add a Comment
Recent in Hacking Tools:
- The Backdoor Factory (BDF) – Patch Binaries With Shellcode
- Gdog – Python Windows Backdoor With Gmail Command & Control
- SPF (SpeedPhish Framework) – E-mail Phishing Toolkit

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,972,782 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,398,990 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 675,660 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Microsoft Patches Critical Security Vulnerabilities In Windows, Office, IE, Exchange & SQL Server

Cybertroopers storming your ship?


Another huge raft of critical fixes has been pushed out by Microsoft across almost their entire range of products, including client and server side software and the Windows OS itself.

It’s been a while since I’ve seen such a huge variety of security issues in one update including 5 critical vulnerabilities.

If you are running a Microsoft oriented organization you better get your update testing rig on-line and get rolling ASAP.

Microsoft has fixed 26 vulnerabilities in its software products, including several considered critical, the company said on Tuesday in its monthly security patch report.

The security holes, described in five critical and four important bulletins, affect multiple products, including Windows, Internet Explorer, Exchange, SQL Server and Office. In the worst-case scenarios, exploits could give attackers control of affected systems.

The first critical bulletin, labeled MS12-060, involves Windows Common Controls vulnerabilities, which affect Office, SQL Server, other server products and developer tools.

There have been “limited, targeted attacks” to try to exploit this security hole, but no public proof-of-concept code has been made available to Microsoft’s knowledge, wrote Microsoft security official Yunsun Wee in a related blog post.

If a user visits a website that contains “specially crafted content” designed to exploit the vulnerability, attackers could execute code remotely on the affected machine. However, users would have to be tricked into visiting such a website. The malicious code can also be sent as an email attachment, but users would need to open the attachment for the attack to work.

Most of them don’t seem to be out in the wild as such, as in they don’t have confirmed publicly available exploits. There have been cases of targeting attacks using these exploits, so they would be very much considered 0-day attacks and are probably being traded or sold in the underground.

The Common Controls exploit would be mitigated against if you had trained your users well on the dangers of opening unknown attachments as it would come in the form of a malicious .rtf file – most likely via e-mail.


Affected products include all supported editions of Office 2003, Office 2007, Office 2010 (except x64-based editions), SQL Server 2000 Analysis Services, SQL Server 2000 (except Itanium-based editions), SQL Server 2005 (except Microsoft SQL Server 2005 Express Edition, but including Microsoft SQL Server 2005 Express Edition with Advanced Services), SQL Server 2008, SQL Server 2008 R2, Commerce Server 2002, Commerce Server 2007, Commerce Server 2009, Commerce Server 2009 R2, Microsoft Host Integration Server 2004 SP 1, Visual FoxPro 8.0, Visual FoxPro 9.0 and Visual Basic 6.0 Runtime.

Microsoft patched a Windows Common Control bug in April that “made everyone sit up and take notice” due to the broad scope of important products it touched, said Andrew Storms, director of security operations at enterprise security vendor nCircle.

“There is some good news this month: that the attack vector associated with the [Windows Common Control] patch is an RTF (rich text format) file, and the victim has to explicitly open the file to allow the exploit. If you can’t get this patch rolled out or mitigation applied quickly, you should remind users about the dangers of opening attachments from unknown persons,” he said via email.

The second critical bulletin, labeled MS12-052, concerns four issues with IE that aren’t known to be under “active attack.” If successfully exploited, a malicious hacker could execute code on the affected machine with the privileges of the current user. As with the previous hole, users would need to visit a malicious Web page to fall victim to the attack. This vulnerability is rated critical for IE 6, IE 7, IE 8 and IE 9 on Windows clients and moderate for those same IE versions on Windows servers.

The more serious vulnerability, which effects Internet Explorer – allow code execution. But from the research done, it seems like these are not being actively attacked.

It’s critical for all versions of IE, including the current version IE9.

Source: Network World


Posted in: Countermeasures, Exploits/Vulnerabilities, Windows Hacking

Tags: , , , , , , , , ,

Posted in: Countermeasures, Exploits/Vulnerabilities, Windows Hacking | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,025 views
- Password Hasher Firefox Extension - 117,718 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,707 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


chapcrack – A tool for parsing and decrypting MS-CHAPv2 network handshakes.

Cybertroopers storming your ship?


chapcrack is a tool for parsing and decrypting MS-CHAPv2 network handshakes, it was announced recently at Defcon as we read over here – Marlinspike demos MS-CHAPv2 crack.

The process is as follows:

  1. Obtain a packet capture with an MS-CHAPv2 network handshake in it (PPTP VPN or WPA2 Enterprise handshake, for instance).
  2. Use chapcrack to parse relevant credentials from the handshake (chapcrack parse -i path/to/capture.cap).
  3. Submit the CloudCracker token to www.cloudcracker.com
  4. Get your results, and decrypt the packet capture (chapcrack decrypt -i path/to/capture.cap -o output.cap -n )

If you are interested in a much more in-depth, technical explanation – you can read more here:

Divide and Conquer: Cracking MS-CHAPv2 with a 100% success rate

Using this attack they have a 100% success rate of cracking DES hashes within 23~ hours.

You can download chapcrack here:

moxie0-chapcrack.zip

Or read more here.


Posted in: Cryptography, Exploits/Vulnerabilities, Hacking Tools

Tags: , , , , , , , , , , ,

Posted in: Cryptography, Exploits/Vulnerabilities, Hacking Tools | Add a Comment
Recent in Cryptography:
- DROWN Attack on TLS – Everything You Need To Know
- Dell Backdoor Root Cert – What You Need To Know
- ISIS Running 24-Hour Terrorist Crypto Help-desk

Related Posts:

Most Read in Cryptography:
- The World’s Fastest MD5 Cracker – BarsWF - 47,650 views
- Hackers Crack London Tube Oyster Card - 44,674 views
- WPA2 Vulnerability Discovered – “Hole 196” – A Flaw In GTK (Group Temporal Key) - 32,906 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Sophos Offers Free Android Antivirus App

Cybertroopers storming your ship?


Sophos seems to be a lot more aggressive recently when it comes to the consumer market, they used to be a hardcore enterprise only solution when they first started out. I guess they’ve realized where the money is.

Back in 2010 they one of the first to come out with a free Antivirus solution for Apple (Sophos Launches FREE Anti-Virus Software For Mac), and now they are coming out with a free AV solution for Android devices.

Sophos has crafted a freebie antivirus app dubbed Sophos Mobile Security for Android-powered devices.

The software tries to protect smartphones against malware, warns fandroids of privacy-invading programs and can lock down a gadget if it’s lost or stolen, ideally without taxing either performance or battery life. The software, released on Monday, can be downloaded from Google Play.

Several free-of-charge security scanners already exist for the Android platform, but the performance of some in recent tests has been mediocre. Paid-for products from the likes of Kaspersky and F-Secure tend to perform better. Sophos is positioning its product against the more capable freebie Android scanners from the likes of Lookout and AVG (Droid Security), but with the additional benefit of offering hardware loss and privacy dashboard features more associated with paid-for products.

Sophos Mobile Security is designed to automatically scan apps as users install them, thus blocking undesirable software. The technology also locates lost or stolen Android devices as well as shielding personal information from thieves.

It is something that’s definitely required as there has been an extremely worrying and rather dangerous trend of Android malware emerging lately:

Android Malware App Covertly Makes Purchases On China Mobile Market
Android Trojan Targets Japanese Market – Steals Personal Data
China Facing Problems With Android Handsets & Pre-installed Trojans

They definitely aren’t the first either, back in 2010 Symantec had already expanded their range to cover Android – Symantec Expands Security Products To Cover Android & iOS.


Sophos has entered the mobile security zone a few years late, but rather than corner the freebie Android scanner market, its new software will be used to market a managed Enterprise version, due to be released this year.

The strategy makes sense because it dovetails neatly with the bring-your-own-device craze that’s allowing consumers’ technology choices shape corporate IT, including the mobile security products that are used.

Android malware last year increased 155 percent from 2010, according to Juniper Networks.

“We’re seeing no slowdown in the number of malicious apps, as more smartphone owners use their devices to not only store personal data, but also access social networks and the internet,” said Matthias Pankert, vice president of product management, Sophos. “This usage, coupled with the increase in Bring Your Own Device (BYOD) activity, is making Android devices a compelling target for cybercriminals and malware.”

Sophos released a freebie security scanner for Macs two years ago. The plan in that case was more about improving home punters’ cyber-hygiene than pushing licences, but mobile security is much more integral to the corporate plans of the UK-based security software firm, so Sophos Mobile Security is not a philanthropic gesture

It seems to be more of a marketing play than anything else though, with them introducing this free version to hook people into a commercial enterprise solution later. We’ll start seeing this in employment contracts in the future I guess:

If you use your own device with the company e-mail/fileshare/wifi etc you need to have the corporate mobile security solution XXX installed

We will see more people entering this arena too, with Android having a more open ecosystem than iOS – it’s also a lot more open to malware and spurious apps.

Source: The Register


Posted in: Countermeasures, Malware, Security Software

Tags: , , , , , , , , , ,

Posted in: Countermeasures, Malware, Security Software | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,025 views
- Password Hasher Firefox Extension - 117,718 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,707 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Hcon Security Testing Framework (HconSTF) v0.4 – Fire Base

Cybertroopers storming your ship?


HconSTF is an Open Source Penetration Testing Framework based on different browser technologies, Which helps any security professional to assists in the Penetration testing or vulnerability scanning assessment. It contains webtools which are capable of carrying out XSS attacks, SQL Injection, siXSS, CSRF, Trace XSS, RFI, LFI, etc. It could prove useful to anybody interested in the information security domain – students, security professionals, web developers and so on.

Hcon Security Testing Framework (HconSTF) v0.4

Features

  • Categorized and comprehensive toolset
  • Contains hundreds of tools and features and script for different tasks like SQLi, XSS, Dorks, OSINT to name a few
  • HconSTF webUI with online tools (same as the Aqua base version of HconSTF)
  • Each and every option is configured for penetration testing and Vulnerability assessments
  • Specially configured and enhanced for gaining easy & solid anonymity
  • Works for web app testing assessments specially for OWASP top 10
  • Easy to use & collaborative Operating System like interface
  • Multi-Language support (feature in heavy development translators needed)

You can download HconSTF 0.4 beta here:

HconSTF_v0.4_Freedom_portable.exe

Or read more here.


Posted in: Hacking Tools

Tags: , , , , , , , , , , , ,

Posted in: Hacking Tools | Add a Comment
Recent in Hacking Tools:
- The Backdoor Factory (BDF) – Patch Binaries With Shellcode
- Gdog – Python Windows Backdoor With Gmail Command & Control
- SPF (SpeedPhish Framework) – E-mail Phishing Toolkit

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,972,782 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,398,990 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 675,660 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Nvidia Investigates Claims Of Online Store Compromise During Spate Of Hacking

Cybertroopers storming your ship?


Just a few days back we posted about Yahoo! Voices Hacked With SQL Injection – Passwords In Plaintext, and most recently it seems someone has been going after Nvidia pretty hard.

They have already had a few web properties hacked including their forum, the developer zone and their research site. The latest break in the news is a claim that the store has been hacked – they have suspended access whilst they investigate.

Graphics chip manufacturer Nvidia is investigating claims that hackers have compromised its online stores as part of a larger attack that affected several of its websites.

On Friday, a hacker group calling itself Team Apollo claimed that one of Nvidia’s online stores was compromised. As a result, the company suspended access to its Board Store and Gear Store websites.

“Nvidia is investigating whether the store sites were hacked,” Bea Longworth, Nvidia’s senior PR manager for EMEAI (Europe, Middle East, Africa, India), said Monday via email. “We don’t have any evidence that credit card data or customer lists have been put at risk, but we’re investigating.”

The news follows confirmed compromises of some of the company’s other websites last week. “Nvidia Forums, Nvidia Developer Zone and Nvidia Research were compromised in what appears to have been a breach by third parties seeking sensitive information,” Longworth said. On Thursday, Nvidia revealed that hackers had gained access to the Nvidia Forums database and stole usernames, email addresses, hashed passwords and user profile information.

We haven’t really discussed Nvidia much before and I dont recall them being a hacking target previously, we’ve only mentioned them in passing when it comes to tools and methods using graphics card chips for brute forcing like – CUDA-Multiforcer – GPU Powered High Performance Multihash Brute Forcer.

I imagine them having a store and carrying out transactions online puts them in the firing range though, when there’s money or credit card details involved – the bad guys will come.


On the same day, the company also took its Developer Zone and Nvidia Research websites offline over suspicions of compromise. Those suspicions were confirmed on Friday, when a hacker posted hashed passwords for a proportion of DevZone users on a public website.

Nvidia was not the only company forced to deal with data leaks that resulted from hacker attacks during the past week.

On Tuesday, the company operating Formspring, a website where users can post and answer questions, disabled its users’ passwords after 420,000 password hashes were posted on a forum. The company later confirmed that someone broke into one of its development servers and stole user account information from a production database.

On Thursday, a hacker group published a list of 450,000 log-in credentials that it claimed to have stolen from the database of an unnamed Yahoo service. Yahoo later confirmed that the log-in credentials were from its Yahoo! Contributor Network service.

Nvidia has taken the other compromised sites down and confirmed they were hacked, I wonder if the threat against the store is just bravado or someone genuinely has compromised it. There seems to be no proof of that at this point however.

There seems to have a been a real glut of these kind of attacks lately, I wonder if there’s a new vulnerability passing around the underground that no-one knows about in a common web language like PHP or in a common service like Apache or the recent MySQL bug.

I wouldn’t be surprised if a lot of these are due to this: MySQL 1 Liner Hack Gives Root Access Without Password.

Source: Network World


Posted in: Exploits/Vulnerabilities, General Hacking

Tags: , , , , , ,

Posted in: Exploits/Vulnerabilities, General Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,314 views
- AJAX: Is your application secure enough? - 120,025 views
- eEye Launches 0-Day Exploit Tracker - 85,478 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


spt v0.6.0 – Simple Phishing Toolkit Available For Download

Cybertroopers storming your ship?


spt is a simple concept with powerful possibilities. It is what it’s name implies: a simple phishing toolkit.

The basic idea the spt project had was “Wouldn’t it be cool if there were a simple, effective, easy to use and free (most importantly!) tool that information security professionals could use to evaluate and train what we all know is the weakest link in any security minded organization: the people?“.

spt - Simple Phishing Toolkit

Since the founders of the spt project are themselves information security professionals by day, they themselves faced the frustration of dealing with people within their own organizations that claimed to know better, but 9 times out of 10 fell for the most absurdly obvious phishing emails ever seen. A malware outbreak here, a stolen password and loss of critical organizational data there and the costs of dealing with the results of phishing can get to be astronomical pretty darn quickly!

Enter spt. spt was made from scratch, with the goal of giving over-worked and under-staffed information security professionals a simple tool (more like a framework, as they hope to add more features over time) that could be used to identify and train those weakest links. spt is a fully self-contained phishing email toolkit that can be installed, configured and phishing in less than 15 minutes. Its design is modular and open-ended allowing for future expansion and additional features via easy to snap-in modules that are simply uploaded in the administration dashboard. Why not try out spt today and see who your weakest link is?

You can download spt here:

sptoolkit_0.60_zip.zip

Or read more here.


Posted in: Countermeasures, Phishing, Security Software

Tags: , , , , , , , , ,

Posted in: Countermeasures, Phishing, Security Software | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,025 views
- Password Hasher Firefox Extension - 117,718 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,707 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Yahoo! Voices Hacked With SQL Injection – Passwords In Plaintext

Don't let your data go over to the Dark Side!


There’s been a few HUGE cases of large sites being hacked and exposing either plaintext or extremely poorly encrypted passwords, it happened to LinkedIn not that long ago – and the latest case is of Yahoo!.

It wasn’t the main site, but with almost half a million username and password combos exposed – it’s a fairly large leak. It came from the Yahoo! Voices subdomain (Yahoo! Contributor Network) and seems to have been carried out with a fairly basic UNION type SQL Injection.

I imagine the database or old part of the site that powered the Yahoo! Contributor Network was developed way back in history before secure programming was as big (and as prominent) as it is now, and before frameworks took care of most the security nuts and bolts.

A Yahoo security breach that exposed 450,000 usernames and passwords from a site on the huge web portal indicates that the company failed to take even basic precautions to protect the data.

Security experts were befuddled Thursday as to why a company as large as Yahoo would fail to cryptographically store the passwords in its database. Instead, they were left in plain text, which means a hacker could easily read them.

“It is definitely poor security,” Marcus Carey, a security researcher at Rapid7, said. “It’s not even security 101. It’s basic application development 101.”

Yahoo declined a request for an interview, and only emailed a statement confirming the breach that occurred Wednesday. The company said that an “older file” containing roughly 450,000 user names and passwords was stolen from its Contributor Network, a subset of Yahoo’s massive network of Web sites. Membership in the Contributor Network consists of freelance journalists who write content for Yahoo Voices. The network was established following Yahoo’s 2010 acquisition of Associated Content.

Less than 5 percent of the stolen data had valid passwords, Yahoo said. “We are taking immediate action by fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo! users and notifying the companies whose users accounts may have been compromised,” the statement said.

Yahoo! seemed to have taken action fairly quickly, but still this is a very sloppy example of data security – even if it was an old system and a defunct one at that.

Unsurprisingly, the top 5 most common passwords in this data set were extremely easy to guess:

  • 123456
  • password
  • welcome
  • ninja
  • abc123

Ninja is a new entrant though, I don’t remember that being in the old common password lists, such as those in this article: The Top 10 Most Common Passwords


The breach had ramifications far beyond Yahoo, because the portal allowed people registering with the Contributor Network to use credentials from other sites to log in. Carey identified some of the other sites as Google’s Gmail, Microsoft’s Hotmail, AOL, Comcast and Verizon.

A hacker group called D33Ds Company took credit for the breach, and posted a statement on its website saying the attack was a warning. “We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat,” the group said, according to media reports. “There have been many security holes exploited in Web servers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly.”

The hackers claimed to use a common attack method called a SQL injection to access the database that fed the server hosting the site. A SQL injection typically involves sending commands through a search field or a URL to break into a poorly secured site. Tony Perez, chief operating officer for Sucuri, who used to work with defense contractors in developing secure applications, said Yahoo’s overall security lapses were a disservice to its users. “It makes you wonder. If a property like Yahoo at that scale is doing that, and they did it for their Yahoo Voices, what’s the probability of that also occurring in their other properties?”

The Yahoo breach occurred a month after professional social networking site LinkedIn acknowledged that 6.5 million usernames and passwords were stolen and posted on a Russian hacker forum. In that case, the passwords had been stored using a cryptographic method called hashing.

At least LinkedIn had the passwords hashed, albeit without salting – so they were pretty secure (but still not secure enough). Please hash, salt, use a salt on the physical disk from a file – oh there’s so many things developers can do to make sure if their system does get cracked – the damage is limited.

But do they do it, well mostly no – because product owners/managers are pushing out things with feature-set being the priority and anything else being pretty much unimportant.

It does make you wonder though, Yahoo! as an organization – how do they store their passwords for other web properties? I wouldn’t be surprised if it’s done with equal slackness.

Source: Network World


Posted in: Exploits/Vulnerabilities, Privacy, Web Hacking

Tags: , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Privacy, Web Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,314 views
- AJAX: Is your application secure enough? - 120,025 views
- eEye Launches 0-Day Exploit Tracker - 85,478 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Microsoft Enhanced Mitigation Evaluation Toolkit (EMET) 3rd Party GUI

Don't let your data go over to the Dark Side!


We published an article about Microsoft Enhanced Mitigation Evaluation Toolkit (EMET) when it came out back in June 2011.

The Native GUI for EMET is in .NET and there are some situations or restricted environments where you may be unable to install .NET or just simple don’t want to use it.

This is where this third-party graphical interface for the Enhanced Mitigation Experience Toolkit comes in, it has no dependence on .NET and will work fine in environments without that capability.

3rd Party GUI for Microsoft EMET

You can download EMET GUI here:

nemet.zip

Or read more here.


Posted in: Countermeasures, Security Software, Windows Hacking

Tags: , , , , , , , , ,

Posted in: Countermeasures, Security Software, Windows Hacking | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,025 views
- Password Hasher Firefox Extension - 117,718 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,707 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Android Malware App Covertly Makes Purchases On China Mobile Market

Don't let your data go over to the Dark Side!


There seems to be a trend towards malware on the Android platform that extorts money from the user somehow, either through premium SMS or services – or the latest trojan – which covertly purchases apps from the mobile market.

We first wrote about Android Antivirus software from Symantec back in 2010 and it seems like recently, it’s becoming more necessary.

DroidDream malware starting proliferating the app store last year in 2011, and there was the article about China Facing Problems With Android Handsets & Pre-installed Trojans.

Security researchers are warning of yet another Android malware outbreak which has spread to nine app stores and infected 100,000 with code designed to covertly purchase apps and content from China Mobile’s Mobile Market.

Mobile security firm TrustGo explained that the MMarketPay.A Trojan could be hidden in a number of legitimate-looking applications, including those from Sina and media streaming company Funinhand, as well as travel and weather apps.

The malware has already been placed in nine different third party Android app markets in China, infecting over 100,000, the firm said. Once downloaded, the Trojan will automatically place orders for paid content and apps at China Mobile’s official Mobile Market online store without informing the user. It is able to intercept China Mobile’s verification SMS and post the code to the Mobile Market web site in order to complete the purchase, said TrustGo.

In the event of CAPTCHA being triggered at this stage, the malware will apparently send the relevant image to a remote server for analysis.

It seems to be happening most of all in China, this isn’t the first time and I guess it won’t be the last. I attribute it to the fact it’s a fairly new smartphone market and the sheer number of people there makes it very attractive to develop this kind of money making malware.

Just get it out there to a few million people (an extremely small percentage of the population in China) and you’re rich. China is being flooded with cheap Android handsets and tablets, so I’d expect to see more of these threats coming from there in the coming months.


The advice from the security experts at TrustGo is for users to only download Android apps from trusted app stores and to have some form of real-time mobile security scanner installed on their device to prevent any dodgy downloads.

Visiting an apparently legit app store is no guarantee you’re going to get a malware-free experience, however. Malware is frequently turning up on the official Android marketplace Google Play – although admittedly less frequently than on some of the more dubious third party sites.

The latest discovery came at the tail end of last week when researchers found malware that lifts the victim’s location data and address book info. China in particular has been a hotbed of malicious Android activity for some time.

In April, the Chinese authorities were forced to publically reprimand the country’s two biggest mobile carriers, China Mobile and China Telecom, after uncovering “many problems” in their respective app stores. Globally too, Android continues to be a favourite with cyber criminals.

So…if you live in China, and use an Android handset – be extremely careful! If not, you should be pretty safe, we aren’t seeing much of this type of malware outside of China – or any kind of Android malware really.

Even though there have been some serious flaws like – Critical Zero Day Abobe Flash Flaw Puts Android Phones At Risk.

The scariest part for me is how smartly this trojan has been developed, it can place orders, intercept the verification SMS and provide it back to the app store – that’s pretty impressive!

Source: The Register


Posted in: Malware, Spammers & Scammers

Tags: , , , , , , , , , ,

Posted in: Malware, Spammers & Scammers | Add a Comment
Recent in Malware:
- PEiD – Detect PE Packers, Cryptors & Compilers
- Mac OS X Ransomware KeRanger Is Linux Encoder Trojan
- Veil Framework – Antivirus Evasion Framework

Related Posts:

Most Read in Malware:
- Nasty Trojan Zeus Evades Antivirus Software - 77,474 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,594 views
- US considers banning DRM rootkits – Sony BMG - 44,979 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95