Google Removes Around 500 Malicious Apps From Play Store

Google Removes Around 500 Malicious Apps From Play Store

CyberSecurity Company Lookout researched on Android Apps and found around 500 Malicious apps on Google Play store. Theses apps are being used to Spy on users.

Security research company Lookout said, The Lookout Security Intelligence team has discovered an advertising software development kit (SDK) called Igexin that had the capability of spying on victims through otherwise benign apps by downloading malicious plugins. Over 500 apps available on Google Play used the Igexin ad SDK. While not all of these applications have been confirmed to download the malicious spying capability, Igexin could have introduced that functionality at their convenience. Apps containing the affected SDK were downloaded over 100 million times across the Android ecosystem.

Company observed an app downloading large, encrypted files after making a series of initial requests to a REST API at http://sdk[.]open[.]phone[.]igexin.com/api.php, which is an endpoint used by the Igexin ad SDK.

This sort of traffic is often the result of malware that downloads and executes code after an initially "clean" app is installed, in order to evade detection. The encrypted file downloads and the presence of calls within the com.igexin namespace to Android's dalvik.system.DexClassLoader(used to load classes from a .jar or .apk file) were enough to warrant more in-depth analysis for possible malware hiding in its payload.  

Not all versions of the Igexin ad SDK deliver malicious functionality. The malicious versions implement a plugin framework that allows the client to load arbitrary code, as directed by responses to requests made to a REST API endpoint hosted at http://sdk[.]open[.]phone[.]igexin[.]com/api.php.

By using this SDK, Cybercriminals are developing Malwares to spy on mobile users and other devices by injecting the malicious code into Vulnerable apps.

As soon as Google got to know about these Malicious Apps, Google instantly removed it from Play Store.

And one major issue here was users were not able to identify that they have become victims of this Malvertising.

Company introduced Google Play Protect to secure an Android Application that automatically scans APK before users install it into their devices. Google always keeps trying to keep malicious apps out of the Play Store. Hope the upcoming Google Android Oreo will offer more protection to its users.

New Android Malware GhostCtrl Can Take Full Control Of Your Phone

New Android Malware GhostCtrl Can Take Full Control Of Your Phone

• This Malware infects Android devices and it spreads via Apps like Whatsapp, MMS and even Pokeman GO. 
• It steals Call Logs, SMS, Contacts, Location and more Mobile activities.
• It can access your Phone Camera or record Audio. 

The Trend Micro security researchers warns of New Android Malware called GhostCtrl and its variant of the OmniRAT was found in year of 2015 which was known for remotely taking control of many OS including Linux, Mac and Windows with the touch of an Android device’s button.

How it Infects?

The APK forces the user to install the malicious app, when user tries to cancel the installation, the APK will keep displaying the prompt. According to report, When the app is launched, its base64-decodes a string from the resource file and writes it down, which is actually the malicious Android Application Package (APK).

How To Protect?

• Always Keep the device updated: Android patching is fragmented and organizations may have custom requirements or configurations needed to keep the device updated, so enterprises need to balance productivity and security
• Apply the principle of least privilege—restrict user permissions for BYOD devices to prevent unauthorized access and installation of dubious apps
• Implement an app reputation system that can detect and block malicious and suspicious apps
• Deploy firewalls, intrusion detection, and prevention systems at both the endpoint and mobile device levels to preempt the malware’s malicious network activities
• Enforce and strengthen your mobile device management policies to further reduce potential security risks
• Employ encryption, network segmentation and data segregation to limit further exposure or damage to data
• Regularly back up data in case of device loss, theft, or malicious encryption.

Nathan: Android Emulator for Mobile Security Testing Tool

Nathan: Android Emulator for Mobile Security Testing Tool

Nathan is a 5.1.1 SDK 22 AOSP Android emulator customized to perform mobile security assessment.

Supported architectures:

• x86
• arm (soon)

The emulator is equipped with the Xposed Framework and the following pre-installed modules:

• SSLUnpinning, to bypass SSL Certificate pinning.
• Inspeckage, to perform the dynamic analysis of an application.
• RootCloak, to bypass root detection.

The following tools are already installed:

• #SuperSU: Superuser access management tool
• Drozer: Comprehensive security and attack framework for Android

Features

• Only python 2.7.x required
• Hooking ready with Xposed
• Pre-installed tools for application analysis
• Fully customizable
• Snapshot and restore of user data

Installation

Download Nathan core scripts from git:

$ git clone https://github.com/mseclab/nathan/
$ cd nathan

Init Nathan for the first time (for downloading firmware files)

$ ./nathan.py init 

If a proxy is required to download files, the parameter -dp is available :

$ ./nathan.py init -dp 127.0.0.1:3128

The init command downloads all the files required to run use Nathan Emulator.

Usage

To start Nathan:

$ ./nathan.py start

To redirect the traffic through a proxy (es. http://127.0.0.1:3128), the parameter -p can be used:

$ ./nathan.py start -p http://127.0.0.1:3128

To create a snapshot of current user image data with a label (current in this case):

$ ./nathan.py snapshot -sl current 

To restore the emulator to the snapshot with label current:

$ ./nathan.py restore --rl current

To get a list of available snapshots to restore:

$ ./nathan.py restore --ll  

Every time the emulator is started, a temporary copy of system image is created and each changes made to system data is lost when the emulator is powered off.

To keep permanent the changes, the command freeze is available:

$ ./nathan.py freeze  

To push files from a folder to a running Nathan emulator, the command push is available:

$ ./nathan.py push -f folder  

The complete list of command is:

usage: nathan.py [-h] [-v] [-a ARCH]
{init,start,snapshot,restore,freeze,push} ...
 
Optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         Show emulator/kernel logs
  -a ARCH, --arch ARCH  Select architecture (arm/x86) - Default = x86

Command to run:
         {init,start,snapshot,restore,freeze,push}
    init                Download and init Nathan emulator
    start               Start Nathan emulator
    snapshot            Create userdata image snapshot
    restore             Restore userdata image snapshot
    freeze              Freeze temporary system image
    push                Push files to Nathan emulator 

The parameter -h for each command shows specific options.

Download 

Top five (5) apps that's turns your Android device into hacking phone

zANTI - Mobile Security Rise Assessment: zANTI is a penetration testing toolkit for cyber security professionals.its
also allows you to simulate malicious attacks on a network.you can use zANTI
in creating a malicious WiFi hotpot,Hijacking HTTP sessions,Modifying HTTP requests and responses.
Exploiting routers,checking a device for shell shock and SSL poodle vulnerability,capturing downloads,changing
device's MAC address etc

Download ZAnti

WiFi Kill: this another powerful tool,basically its controls the WiFi network,it can also disable
the internet connection of other devices connected to same WiFi network...it is a useful tool for
WiFi internet users, using the powerful tool can prevent others off from a common WiFi network and set aside all the bandwidth
to yourself.this very up is for rooted Android app only.to use this app
mark the tic on "unknown source" in settings of the phone and open the downloaded app and install it,ready to use

Download WiFiKill

Whats-app Sniffer: Whats-app Sniffer is an Android app that allows you to receive the conversations from whats-app application from
phones that uses the same WiFi  with you with this app you can receive text messages , videos pictures as well this app only works with rooted phones its a free app you can download from place-store it used be use for educational and personal use only.
Download WhatsAppSniffer

cSploit: is an Android app that opens Android network analysis and penetration suite,it is the best and advanced professional toolkit for internet
security assess in mobile phones. it works rooted Android version 2.4 or newer vision with this app you can

•  map your local network
•  integrated trace rout
•  adjust exploit settings,lunch and create shell console on exploited system
• capturing pcap network  traffic files etc

Download cSploit-release

Face Niff : is an Android app for hackers (newbies) who wants to sniff and 

analyse web session profiles over WiFi connection.which simply means you

can use this app only when you are on the same WiFi connection

Download FaceNiff

NOTE: there are thousands of hacking app out there but we have only worked on this five app for now......