Tag Archive for: silently

I’m a security expert – delete ‘invasive’ apps silently spying on your iPhone and Android using my settings trick

/in


CYBERSECURITY experts have warned about invasive apps that can infiltrate your phone and steal your data.

Malicious invasive apps can easily compromise both Android and iOS devices.

Cybersecurity experts have warned about invasive appsCredit: Getty

WHAT ARE INVASIVE APPS?

Invasive apps are software that use a phone’s permission settings to spy on its user by accessing the phone’s camera, microphone, and more.

What’s more, these apps look like legitimate apps, “yet they have an ulterior motive,” security software company McAfee said in a blog post.

They are similar to spyware, except that spyware is malware that enables a hacker to obtain information about another’s computer activities.

“Both invasive apps and mobile spyware snoop on you and your phone, yet invasive apps work differently than mobile spyware. Invasive apps use a phone’s built-in functionality to spy and gather information on you,” McAfee explained.

A telltale sign of an invasive app is when the app asks for permissions it doesn’t need.

For example, if a flashlight app wants access to your microphone, that’s probably a red flag.

“The tricky bit with invasive apps is that many people quickly click through the user agreements and permission screens when they get a new app,” McAfee said.

HOW TO STAY SAFE

There are a number of ways to protect your device from invasive apps.

For starters, check your mobile device’s permission settings and manage anything that looks fishy.

For iPhone, go to Settings > Privacy & Security, then tap Safety Check > sift through apps’ permissions.

On your Android device, open Settings > select apps > tap the app you want to change > tap Permissions.

You can also run an antivirus or antimalware software on your device to run a security check.

Along with enabling security software, keeping your phone’s operating system up to date can help keep it protected.

You should also avoid downloading any suspicious-looking apps – especially if they’re only available outside of your device’s official app store.

Source…

Gitpaste-12: A dozen exploits that silently lived on GitHub, attacked Linux servers

/in


Just months after Octopus Scanner was caught infecting 26 open-source projects on GitHub, new reports have already surfaced of another, new sophisticated malware infection. Gitpaste-12, a worming botnet, is extremely versatile in its advanced capabilities and the fact it leverages trustworthy sites like GitHub and Pastebin to host itself.

The name Gitpaste-12 stems from the 12 known vulnerability exploits within the worm, much like a “swiss-army knife.” Two of these exploits target 2 popular open source components, Apache Struts and mongoDB.

Remained undetected on GitHub for over 3 months

By hosting its malicious payload on sites like GitHub and Pastebin, the Command and Control (C2) infrastructure now becomes incredibly hard to block using simple IOC-blocks at enterprises, because there are legitimate use-cases of these websites.

In fact, Gitpaste-12 has been silently sitting on GitHub since July 2020.

Gitpaste1

It wasn’t until Juniper Threat Labs spotted the botnet on October 15th, and had GitHub shut it down roughly two weeks later.

“The malware begins by preparing the environment. This means stripping the system of its defenses, including firewall rules, selinux, apparmor, as well as common attack prevention and monitoring software,” said Juniper Threat Labs researchers Alex Burt and Trevor Pott.

Gitpaste2

The worm provides attackers reverse shells. The researchers observed some infected systems using TCP ports 30004 and 30005 open to listen for shell commands.

Furthermore, Gitpaste-12 is loaded with a Monero cryptocurrency miner with additional code to hide it from process monitors, a Telnet-based script to breach Linux servers, and IoT devices via brute force, a cronjob that paves way for the worm to gain persistence, and so on.

“The Gitpaste-12 malware also contains a script that launches attacks against other machines, in an attempt to replicate and spread. It chooses a random /8 CIDR for attack and will try (Read more…)

Source…

>4,000 Android apps silently access your installed software

/in
Closeup photograph of hands holding an Android phone.

Enlarge (credit: Mike MacKenzie / Flickr)

More than 4,000 Google Play apps silently collect a list of all other installed apps in a data grab that allows developers and advertisers to build detailed profiles of users, a recently published research paper found.

The apps use an Android-provided programming interface that scans a phone for details about all other apps installed on the phone. The app details—which include names, dates they were first installed and most recently updated, and more than three-dozen other categories—are uploaded to remote servers without permission and no notification.

IAM what IAM

Android’s installed application methods, or IAMs, are application programming interfaces that allow apps to silently interact with other programs on a device. They use two methods to retrieve various kinds of information related to installed apps, neither of which is classified by Google as a sensitive API. The lack of such a designation allows the methods to be used in a way that’s invisible to users.

Read 12 remaining paragraphs | Comments

Biz & IT – Ars Technica

Apple Silently Updates Millions Of Macs To Prevent Dangerous Webcam Hack

/in

After news of the exposure broke, Zoom told me that “we do not currently have an easy way to help a user delete both the Zoom client and also the Zoom local web server app on Mac that launches our …
mac hacker – read more