Categories
Uncategorized

Taxi Trojans are on the way: Beware of Banking Apps

Add Your Heading Text Here

Share it:
 
 
The Faketoken Trojan has existed for a long time, and it has been upgraded for many years. Our experts named the current version “Faketoken.q,” and by now it has learned a significant number of tricks.
 
After getting onto a smartphone (judging by the malware icon, Faketoken infiltrates smartphones through bulk SMS messages with a prompt to download some picture) and installing the necessary modules, the Trojan hides its shortcut icon and starts background monitoring of everything that happens in the system.
 
First, the Trojan is interested in the user’s calls. As soon as it detects a call, it starts recording. When the call is finished, Faketoken sends the recording to the criminal’s server. Second, the Trojan also checks which apps the smartphone’s owner uses.
 
When Faketoken detects the launch of an app whose interface it can simulate, the Trojan immediately overlays the app with its own screen. To achieve that, it uses a standard Android feature that supports showing screen overlays on top of all other apps. A whole bunch of legitimate apps, such as messengers, window managers, and so on, use this feature.
 
Actually, Faketoken.q is after a huge variety of apps that have one thing in common: in them, a request to enter payment data looks normal enough not to arouse suspicion. Among the attacked apps are a number of mobile banking apps, Android Pay, the Google Play Store, apps for booking flights and hotel rooms, and apps for paying traffic tickets — as well as apps for booking taxis.
 
Below you can find several pieces of advice on how to protect yourself against Faketoken and similar mobile Trojans that steal card numbers and intercept SMS messages with one-time passwords used to confirm payments.
 
  • It is imperative that you go into Android’s settings and prohibit the installation of apps from unknown sources. To block installation from unknown sources, go to Settings -> Security and uncheck Unknown sources.
  •         Always pay attention to what access permissions an app requests during installation, even if you downloaded it from Google Play (there might be Trojans in the official app store as well).
  •        It is a good idea to protect your smartphone by installing antivirus, which can find infections hiding in an app such as basic Kaspersky Internet Security for Android,  

source: Kaspersky Lab.

  • Growth through innovation/creativity:
    Rather than be constrained by ideas for new products, services and new markets coming from just a few people, a Thinking Corporation can tap into the employees.
  • Increased profits:
    The corporation will experience an increase in profits due to savings in operating costs as well as sales from new products, services and ventures.
  • Higher business values:
    The link between profits and business value means that the moment a corporation creates a new sustainable level of profit, the business value is adjusted accordingly.
  • Lower staff turnover:
    This, combined with the culture that must exist for innovation and creativity to flourish, means that new employees will be attracted to the organization.
Categories
Apps Mobile Phones

10 Faqs About Android Application Security.

Add Your Heading Text Here

Share it:

Today our cybersecurity team reveals 10 common questions bothering android developers interested in securing their android applications.


Q1: How can i protect my android app from software pirates? I mean how can i obfuscate my source code?
Ans: You can choose to use DexGuard or DashO to make it difficult for software pirates, reverse engineers or intruders to pirate your source code.


Q2: I heard you can also use ProGuard to obfuscate source code?
Ans: Yes! But it is not effective. Practically not effective.


Q3: Do you think it is quite safer to save users data on their own device?
Ans: Yes and No. Yes- It is quite safer to save non-sensitive data on users devices. No- It is not safe to save sensitive data on users’ devices even if you intend to protect using strong encryption.


Q4: I heard hackers can intercept data in transit using a proxy such as Burpsuite?
Ans: Yes. They can intercept data in transit.


Q5: So is there any defense mechanism against this form of attack?
Ans: Yes. Ensure that the same validation method implemented on the client side is exactly implemented on the server-side.


Q6: Although I have implemented HTTPS to protect data in transit, i find it difficult to stop “csrf” attacks?
Ans: Okay. You can create tokens for each registered or authenticated user. In addition, ensure that tokens are available temporarily and re-created after a specific period.


Q7: Yes. I have done that but hackers still by-pass csrf protection.
Ans: Ensure that csrf tokens are validated at the server-side. Also make tokens random.


Q8: I want my android app to share data with other app but with some form of restriction. How can I achieve that?
Ans: Okay. You can use content provider which allows apps to share data with other apps. Moreover, with content provider, you can specify read and write permissions. Thus, some apps may have read and write permissions whilst others may have read -only permissions or write-only permissions


Q9: Could I also save data in shared_pref file? I heard it is not safe to do so.
Ans: It is safe to do so when data is not sensitive. It is not safe to do so when data is sensitive. So move all users’ data such as password, userid, and account number to your web server.


Q10: Is it advisable to hire android security researchers or pentesters to audit my apps?
Ans: Yes. We recommend you to do so.
Although these are other common faqs related to android security, at least, you can rely on some of our answers to make your android app secure.

#ISA_informs  #ISA_ltd

Categories
Apps Internet Security Mobile Phones

Four Ways to Infect Your Android Devices with Malware.

Add Your Heading Text Here

Share it:

Although we often blame exploit writers for developing malicious code for malicious purposes such as reading of one’s credentials, spying on a users’ communication and so on, we ought to blame ourselves periodically for allowing our android devices to be pregnant with malware.

This article briefly exposes four ways  how users/employees unknowingly infect their android devices with malware.

  • Sideloading apps:

Sideloading is a term referring to an android user intention to download apps from third-party stores instead of  ”pulling” it from Google’s playstore. Most of these third-party store apps are infected with malware because there is no proper protection  for apps installed on these stores. Thus, we recommend you download apps from Google’s playstore.

  •  Installing apps with numerous permissions:

Most users/employees often fail too observe the list of permissions an app requires in order to function on android devices. Before an android app is installed on your android device, it declares a list of permissions that a user must accept if he/she is interested in the app. Malware take interest in loosely protected apps to retrieve users’ data back to a remote server.

  •      Confirming to flashy updates from random websites:

“something-xxx antivirus is outdated. please download the current version” from  xyz.com .   We often see flashy updates on our mobile screens in a form of ‘Toast’ messages informing us about software expiration. Yes! software expires. But we advise users to download software directly from software vendors’ website.

  •   Clicking links on online forums:

This is one of the easiest ways even script kiddies could use to embedded malware into apps installed on your android devices. If a link on a particular topics interest you, just copy the link and paste it in the url section. It is quite safer than clicking on the link directly.

Avoiding these user-behaviors could save your android devices from malware lurking in the cyber world.

#ISA_informs    #ISA_Ltd

Categories
Internet Security

Five Ways To Battle E-Mail Attacks

Add Your Heading Text Here

Share it:

StopLook, Think‘ is the principle we rely on when accessing mails of all sort from different sources. Indeed, we have benefited from this S-L-T principle. Hence, we want to show you how you can use this principle to battle email attacks targeted at your staff.

Stop & Read Mail Thoroughly: Usually, phishers who are in a haste to retrieve personal information via deceptive tend to make grammatical errors. A careful look and a thorough read could save you from being  deceived by a amateur phisher.  

Verify from the Company: Now after you have read the message, you can verify from the company informing them of a message in your inbox sent by them. It is plausible to do so just to be sure you are reading a message from a legitimate company or not.   

Observe again and again: U.S navy seals are noted for observing target for a longer period before moving on the target physically. You can employ this technique just to understand the concept of the message. For instance, you have received a message from a sender informing you of a prize you have won. In reality, you have not even applied for a competition. How much more win a prize!

Analyze links embedded in messages: You need to analyze links in messages sent into your inbox. Nowadays, phishers careful create links almost similar to that of a legitimate company.

For instance: www.support.klm.de  . Be mindful that this link is not a subdomain nor does it belong it klm. You can analyze links by hovering your mouse over or by observing the final destination of the link in the url bar.   

Think deeper enough: Finally,  think deeper enough about the link. Some phishers are quite clever they could create a similar link to do that of a legitimate company. Let’s analyze this two links:  www.isa.com.gh   ||    www.isa.com   Which one is the legitimate link of cybersecurity company in Ghana?   Thus, it is worth it when you think deeper before clicking on a link.

You can employ these techniques to ward off any email attacks or phishing against your employees or clients. Moreover, you can contact us  for practical user awareness training based on social engineering attacks and prevention.