FBI issues warning to smartphone users regarding Android malware
The FBI's Internet Crime Complaint Center has issued a warning alerting users about malware that targets the Android mobile operating system.
The intelligence note from the IC3 was issued last week, and highlighted on Monday by Apple 2.0. It noted there are various forms of malware out in the wild that attack Android devices.
Two forms of malware cited by the IC3 are Loozfon, which steals information from users, and FinFisher, which can give nefarious hackers control over a user's device.
Loozfon can lure in victims by promising users a work-at-home opportunity in exchange for sending out an e-mail. Visiting a link in the e-mail will push Loozfon to the user's device, allowing the malware to steal contact details from the device's address book.
The FinFisher spyware highlighted by the IC3 allows for a mobile device to be remotely controlled and monitored from anywhere. FinFisher is installed by simply visiting a Web link or opening a text message that disguises itself as a system update.
IN addition to highlighting Loozfon and FinFisher, the IC3 intelligence note also offers users a number of safety tips to help protect their mobile device. They are:
The intelligence note from the IC3 was issued last week, and highlighted on Monday by Apple 2.0. It noted there are various forms of malware out in the wild that attack Android devices.
Two forms of malware cited by the IC3 are Loozfon, which steals information from users, and FinFisher, which can give nefarious hackers control over a user's device.
Loozfon can lure in victims by promising users a work-at-home opportunity in exchange for sending out an e-mail. Visiting a link in the e-mail will push Loozfon to the user's device, allowing the malware to steal contact details from the device's address book.
The FinFisher spyware highlighted by the IC3 allows for a mobile device to be remotely controlled and monitored from anywhere. FinFisher is installed by simply visiting a Web link or opening a text message that disguises itself as a system update.
IN addition to highlighting Loozfon and FinFisher, the IC3 intelligence note also offers users a number of safety tips to help protect their mobile device. They are:
- When purchasing a Smartphone, know the features of the device, including the default settings. Turn off features of the device not needed to minimize the attack surface of the device.
- Depending on the type of phone, the operating system may have encryption available. This can be used to protect the user's personal data in the case of loss or theft.
- With the growth of the application market for mobile devices, users should look at the reviews of the developer/company who published the application.
- Review and understand the permissions you are giving when you download applications.
- Passcode protect your mobile device. This is the first layer of physical security to protect the contents of the device. In conjunction with the passcode, enable the screen lock feature after a few minutes of inactivity.
- Obtain malware protection for your mobile device. Look for applications that specialize in antivirus or file integrity that helps protect your device from rogue applications and malware.
- Be aware of applications that enable Geo-location. The application will track the user's location anywhere. This application can be used for marketing, but can be used by malicious actors raising concerns of assisting a possible stalker and/or burglaries.
- Jailbreak or rooting is used to remove certain restrictions imposed by the device manufacturer or cell phone carrier. This allows the user nearly unregulated control over what programs can be installed and how the device can be used. However, this procedure often involves exploiting significant security vulnerabilities and increases the attack surface of the device. Anytime a user, application or service runs in "unrestricted" or "system" level within an operation system, it allows any compromise to take full control of the device.
- Do not allow your device to connect to unknown wireless networks. These networks could be rogue access points that capture information passed between your device and a legitimate server.
- If you decide to sell your device or trade it in, make sure you wipe the device (reset it to factory default) to avoid leaving personal data on the device.
- Smartphones require updates to run applications and firmware. If users neglect this it increases the risk of having their device hacked or compromised.
- Avoid clicking on or otherwise downloading software or links from unknown sources.
- Use the same precautions on your mobile phone as you would on your computer when using the Internet.
Comments
When my friends and associates ask me for advice on their first smartphone, I say the same thing that I've been saying since the iPhone first came out. If you care about safety and security, Apple is the way to go. If you want uncertainty and headaches, Android's your poison.
But..but... Android is "open"!!! Yeah.. it's open all right!! Open for everyone to see!!
I'll take my walled garden any day!
Today 70% of PCs have malware and/or Virus.
And Google uses Linux/Unix. The most secure OS there is.
This is solved in ten minutes by Google, if they wanted it.
They need to certify that the program is malware free to have it on their app store.
The problem is that Google can't do that since they would be open for law suites. Google would be responsible to remove all pirate apps, including emulators/roms and all that fun stuff.
And one of the main selling point of Android for younger users are the free apps. There are pirate app stores on the net. Everything free for Android. And Google approves it. They only want to sell advertising and data mine.
Googles culture is the "new economies". Everything is free. Google have the worlds largest torrent linking service with their search engine. They have the worlds largest collection of pirated movies and videos on youtube. And over 90% of the apps installed on their phones are pirated. (and Android is pirated)
And its the medias job to inform the public about malware on Android and how Google earns money. They have done a real poor job of that so far.
The big question: what is google hiding?
In my country we have a legal right to know everything a company stores on their computers about a customer. I did a legal request a month ago. Google is the only company that refuses give me the data.
I hope I win in court.
Originally Posted by shompa
They have the worlds largest collection of pirated movies and videos on youtube.
I've always been curious how Google is even allowed to operate when they refuse to actually do anything about the illegal stuff on YouTube.
Gee, and you can "tap" your android phone with your best friend, and get more than you bargained for.
By the way, does ANYONE know any actual people who have used this well-advertised "advantage" over iphones? Neither have I.
Do we now need some "safe sex" cellphone ads now?
Quote:
Originally Posted by Bagman
Gee, and you can "tap" your android phone with your best friend, and get more than you bargained for.
We need some "safe sex" ads now, for cellphone use.
By the way, does ANYONE know any actual people who have used this well-advertised "advantage" over iphones? Neither have I.
Yeah, next thing you know the FBI and CDC will tell people to refrain from inappropriate physical contact with their Scamscum phones.
Quote:
Originally Posted by Tallest Skil
I've always been curious how Google is even allowed to operate when they refuse to actually do anything about the illegal stuff on YouTube.
It's funny to me... all the filesharing services (Napster, Audio Galaxy, Kazaa) ran into problems when they were providing a platform for sharing copyright material and the "we don't control the content" defense did not work. Here we have Google making millions by serving ads while providing copyright material. They should be sued over all those music videos, movies, tv shows, etc. that people get to watch for free.
Quote:
Originally Posted by sflocal
Yeah, next thing you know the FBI and CDC will tell people to refrain from inappropriate physical contact with their Scamscum phones.
Actually, the most inappropriate physical activity you can do with an android cellphone is to actually use it.
Then they spend ages trying to delete it and clear out the malware, and end up downloading some other, much worse app instead of the one they wanted. And walk away delighted with all the "choice" they have
(P.S. Really? Curly quotes created automatically by OS X break AI's new forums? I have to paste into TextWrangler to post?)
Stop hating Android. It's year advanced than iOS now. Try getting used to this fact.
Quote:
...They are:
...When purchasing a Smartphone, know the features of the device, including the default settings. Turn off features of the device not needed to minimize the attack surface of the device.
Depending on the type of phone, the operating system may have encryption available. This can be used to protect the user's personal data in the case of loss or theft.
With the growth of the application market for mobile devices, users should look at the reviews of the developer/company who published the application.
Review and understand the permissions you are giving when you download applications.
Passcode protect your mobile device. This is the first layer of physical security to protect the contents of the device. In conjunction with the passcode, enable the screen lock feature after a few minutes of inactivity.
Obtain malware protection for your mobile device. Look for applications that specialize in antivirus or file integrity that helps protect your device from rogue applications and malware.
Be aware of applications that enable Geo-location. The application will track the user's location anywhere. This application can be used for marketing, but can be used by malicious actors raising concerns of assisting a possible stalker and/or burglaries.
Jailbreak or rooting is used to remove certain restrictions imposed by the device manufacturer or cell phone carrier. This allows the user nearly unregulated control over what programs can be installed and how the device can be used. However, this procedure often involves exploiting significant security vulnerabilities and increases the attack surface of the device. Anytime a user, application or service runs in "unrestricted" or "system" level within an operation system, it allows any compromise to take full control of the device.
Do not allow your device to connect to unknown wireless networks. These networks could be rogue access points that capture information passed between your device and a legitimate server.
If you decide to sell your device or trade it in, make sure you wipe the device (reset it to factory default) to avoid leaving personal data on the device.
Smartphones require updates to run applications and firmware. If users neglect this it increases the risk of having their device hacked or compromised.
Avoid clicking on or otherwise downloading software or links from unknown sources.
Use the same precautions on your mobile phone as you would on your computer when using the Internet.
They forgot one....
14: Buy an iPhone instead.
Further, Dilger's claim that "FinFisher is installed by simply visiting a Web link or opening a text message that disguises itself as a system update" is misleading. Android devices block third-party app stores by default. Unless a user has gone into their security settings, they don't be able to install an app that they download from an arbitrary web page. (It's worth noting that Dilger's wording, "installed," is different from the FBI's wording, "transmitted to.")
In other words, nothing to see here, folks.
Quote:
Originally Posted by Tallest Skil
I've always been curious how Google is even allowed to operate when they refuse to actually do anything about the illegal stuff on YouTube.
I'm not sure what you mean by "refuse to actually do anything" -- Google regularly removes content from YouTube when receive they a DMCA notice. In fact, they've been criticized for being too aggressive about pulling content.
Well just as an FYI finfisher actually has an iOS version as well as Blackberry/WinMo/Symbian versions: http://www.h-online.com/security/news/item/FinFisher-trojan-for-iOS-and-Android-sighted-1695754.html
It is actually a commerical "lawful access" trojan marketed by German firm Gamma International.
In both these cases these apps did not get into the Google Play/iOS Apple Store (for finfisher) but rather could only run if you sideload the binary. Loozfon is an Android only piece of malware but did not appear in Google Play. It was actually spread by malicious email links in spam and has thus far only been used in a campaign against female Japanese users: http://www.symantec.com/connect/blogs/loozfon-malware-targets-female-android-users
In the case of Loozfon, the user has to click the apk link in the e-mail, have "accept from any sources" turned on in their options AND click ok when prompted on which permissions the app should have.
edit: why all the talk about "tapping"? NFC was not the vector in any of these and isn't mentioned at all in the article.
Originally Posted by derekmorr
I'm not sure what you mean by "refuse to actually do anything" -- Google regularly removes content from YouTube when receive they a DMCA notice. In fact, they've been criticized for being too aggressive about pulling content.
Yeah, they pull down fair use utilizations while leaving up unedited, unchanged, illegal content.
Quote:
Originally Posted by shompa
This is PC all over again.
Today 70% of PCs have malware and/or Virus.
And Google uses Linux/Unix. The most secure OS there is.
This is solved in ten minutes by Google, if they wanted it.
They need to certify that the program is malware free to have it on their app store.
The problem is that Google can't do that since they would be open for law suites. Google would be responsible to remove all pirate apps, including emulators/roms and all that fun stuff.
And one of the main selling point of Android for younger users are the free apps. There are pirate app stores on the net. Everything free for Android. And Google approves it. They only want to sell advertising and data mine.
Googles culture is the "new economies". Everything is free. Google have the worlds largest torrent linking service with their search engine. They have the worlds largest collection of pirated movies and videos on youtube. And over 90% of the apps installed on their phones are pirated. (and Android is pirated)
And its the medias job to inform the public about malware on Android and how Google earns money. They have done a real poor job of that so far.
The big question: what is google hiding?
In my country we have a legal right to know everything a company stores on their computers about a customer. I did a legal request a month ago. Google is the only company that refuses give me the data.
I hope I win in court.
This isn't malware being delivered via an Appstore
Quote:
Originally Posted by Bagman
Gee, and you can "tap" your android phone with your best friend, and get more than you bargained for.
By the way, does ANYONE know any actual people who have used this well-advertised "advantage" over iphones? Neither have I.
Do we now need some "safe sex" cellphone ads now?
The original iPhone gained this feature (once the App Store was opened) through the App Store a long time ago. I remember downloading the App (Can't remember it's name now, and am at work, so can't look it up), and using it maybe once.
Next time I upgraded my phone, I deleted the app.
The only benefit to this feature in practice I have noticed is sharing Contacts. But it is a clumsy way to do it. Sending contacts via Message is far easier. It helps when you have poor service though, or are sharing your contact with someone whose number you don't have.