A man who had romantic relationships with women and then defrauded them has been jailed. Vimal Popat’s victims were mostly women he met using online dating sites such as Bumble. […]
View full post on National Cyber Security
Insider Intelligence publishes thousands of research reports, charts, and forecasts on the Media, Advertising, and Marketing industry. You can learn more about becoming a client here. The following is a […]
View full post on National Cyber Security
The Pakistan Telecommunication Authority (PTA) has blocked five dating and live streaming applications including the popular Tinder app citing “immoral content”, it said in a statement on Tuesday. The four […]
View full post on National Cyber Security
To better understand the structure of Azure® Active Directory® (AAD or Azure AD), we will be exploring each tier of their services in a four-part series.
This is the second part of that series. Below we explore the full scope of features offered with Azure AD’s Basic/Office 365 apps iteration. Each part will cover the benefits of that particular service, as well as the drawbacks that come with each tier. Click here to read our previous blog on Azure AD Free.
Azure Active Directory Basic/Office365 Apps
Azure AD’s second pricing tier was introduced in 2014 alongside its other services. It was meant to serve as an intermediary step for admins that wanted more out of AAD’s Free version, but weren’t ready to commit to Premium P1 or P2.
Initially referred to as Azure AD Basic, this version of AAD was recently renamed “Azure AD Office 365 apps.” It’s included with the purchase of a subscription to Office 365 E1, E3, E5, and F1.
AAD Office 365 apps is designed to work optimally as a substrate identity solution that’s been paired with a directory service, namely Active Directory. It is meant to provide legacy, on-prem identity management solutions with a bridge to securely connect existing user credentials to select web apps and the Azure infrastructure.
Benefits of Azure AD Office 365 Apps
By itself, AAD O365 apps offers the following features:
Sync Office365 user accounts to an unlimited number of directory objects
Leverage SSO for up to 10 pre-integrated SaaS applications per user
Self-service password changes and resets (for cloud users only)
Sync with Azure AD Connect
Basic reporting on their substrate identity management solution
Service level agreements (SLAs) for Azure infrastructure
Multi-factor authentication (MFA) only for O365 apps
As with all other versions of Azure AD, O365 apps allows admins to sync their AAD instance with AD through Azure AD Connect. By doing so, they can increase the value of AAD O365 apps by enabling admins to implement important Microsoft features like network authentication via RADIUS (this requires an on-prem NPS server to do so), (Read more…)
Google has removed almost 600 Android apps from its Play Store for violating its policy on disruptive advertising.
The tech giant has not only removed the titles from the Android marketplace but also banned them from Google AdMob and Ad Manager, meaning their developers will not be able to monetize them on its platforms.
The disruptive ad practices highlighted by Google included “out of context” advertising, which pops up when the user isn’t even logged into a specific app.
“This is an invasive maneuver that results in poor user experiences that often disrupt key device functions and this approach can lead to unintentional ad clicks that waste advertiser spend,” argued Per Bjorke, senior product manager for Ad Traffic Quality.
“For example, imagine being unexpectedly served a full-screen ad when you attempt to make a phone call, unlock your phone, or while using your favorite map app’s turn-by-turn navigation.”
Bjorke explained that Google had developed machine learning functionality to help detect such “out of context” ads, which led to this enforcement action.
“Mobile ad fraud is an industry-wide challenge that can appear in many different forms with a variety of methods, and it has the potential to harm users, advertisers and publishers,” he added.
Google is also getting better at finding and removing apps on its Play Store that contain malware. Last year, it claimed to have increased rejected app submissions by over 55% and app suspensions by more than 66% in 2018.
That doesn’t stop the black hats trying, however: malicious apps still make their way onto the platform and sometimes are downloaded millions of times before being blocked.
In June last year, adware was found in 238 apps on the Play Store, installed by an estimated 440 million Android users.
However, downloading apps from the official marketplace is still the recommended option: last year, Android malware dubbed “Agent Smith” was downloaded over 25 million times from a popular third-party store.
Consumers love the convenience of paying for goods and services in store by using their NFC enabled smartphones and stored credit cards. This is demonstrated by the fact that you can download retailer specific apps for your smartphone to pay for everything from coffee, to movie tickets, to poutine using a retailer specific mobile app.
As more and more retailers embrace this technology and release their own mobile apps with in-store payment options, the threat of fraudsters looking to benefit from flaws in the implementation, or by exploiting the human component must be carefully considered. The following are a few example Card Not Present (CNP) fraud schemes that retailers who offer in-store purchasing using a store branded mobile app should be aware of.
In these scenarios, we will use the imaginary retailer Smoothie Shop. Smoothie Shop has a mobile app that allows customers to save their credit card in the app in order to facilitate easy in-store purchases. Consumers log into their Smoothie Shop account using an email address and password. Smoothie Shop has recently seen an increase in CNP fraud and chargebacks, but is unable to pinpoint the root cause.
(Smoothie Shop mobile app login)
CNP Fraud Scheme #1 – Fraudster takes over a Smoothie Shop account that has a Credit Card saved in the app
In this scenario, the fraudster has to take over an existing Smoothie Shop account. This is known in the industry as Account Takeover (ATO) which is explained here.
In this scenario the fraudster has lucked out! Since the account that was taken over by the fraudster already has a credit card saved in the app, the fraudster can simply walk over to a Smoothie Shop, present the mobile app with the saved credit card information and enjoy a refreshing smoothie that was paid for via some other Smoothie Shop customer’s stored credit card.
CNP Fraud Scheme #2 – Fraudster takes over a Smoothie Shop account that does not have a Credit Card saved in the app
Again this scenario requires the Frauster to take over an existing Smoothie Shop account, however this scenario requires a little bit more legwork, and is less profitable as Fraud Scheme #1 above. Since the Smoothie Shop account that was taken over does not have a credit card saved in the app, the fraudster will instead need to buy a stolen credit card off the Dark Web or some other electronic market*, and then add the freshly purchased credit card to the Smoothie Shop account and app. Once this is done, the fraudster proceeds in-store to obtain smoothies using the stolen credit card.
Why would the fraudster go through the trouble of taking over an existing Smoothie Shop account you ask? Good question! Fraudsters are aware that aged accounts (e.g. accounts more than 3-6 months old) with a good transaction history are usually given more leeway and transactions from these accounts are less closely scrutinized when compared to a brand new account with no transaction history.
*Stolen credit cards can be acquired for as little as $3 or as much as several hundred dollars depending on the credit limit, zip/postal code, issuing bank, etc.
(screenshot from Dark Web Credit Card market)
CNP Fraud Scheme #3 – Fraudster creates a brand new Smoothie Shop account
This scheme doesn’t require taking over an existing account, but instead requires the fraudster to use a bot tool or a human clickfarm to create hundreds of “fake” Smoothie Shop accounts. Once the fraudster has access to multiple Smoothie Shop fake accounts, he can then add in as many stolen credit cards as he pleases in order to make in-store purchases at Smoothie Shop, each one being a unique incident of CNP fraud.
(In-store payment via Smoothie Shop mobile app and stored credit card)
What can Retailers and Consumers do to protect themselves?
Prevention Methods for Retailers
1) Prevent Account Takeover. This is easier said than done. There are many ways to prevent or at least significantly reduce the amount of ATO, such as by eliminating Credential Stuffing. The goal of the organization should be to eliminate the economic advantage that fraudsters obtain from taking over an account. If the cost/effort of taking over an account outweighs the value of said account, there will be no incentive for the fraudster and he/she will likely go elsewhere to commit fraud.
2) Maintain control of Account Creation process. Creation of accounts by bots and scripts can be limited by using a CAPTCHA, however captchas can be bypassed by mid-level sophistication fraudsters, and consumers generally dislike captchas. Preventing bulk creation of accounts requires collecting device level information in order to restrict the number of new accounts that can be created by a single device. There are device farms available for rent, but forcing the fraudster to leverage a device farm could make their rate of return less desirable and push the fraudster elsewhere.
3) Ensure your customers are not logging into your site/mobile app with credentials that have been compromised in 3rd party data breaches. This is a NIST recommendation that makes a lot of sense in today’s world of daily breaches. The customers that are logging in to your website or mobile app with compromised credentials are most likely the accounts that will be taken over and defrauded first.
4) Build controls around misuse of credit cards in the mobile app. Legitimate customers will likely need to add 1, maybe 2 unique credit cards to their account/device. Any account/device trying to add 3, 4, 5, or more credit cards to an account should be closely inspected and possibly restricted from adding any more. The stored credit card should also be tied to the device, rather than the account. That way, if an account is taken over from a new device, there will be no stored credit card information available for the fraudster to use. Both of these require a strong and unique identifier on the device level.
Prevention Methods for Consumers
1) Don’t reuse passwords across multiple sites! – This is the single most important piece of advice consumers should follow. If you reuse the same password across multiple sites, it is no longer a question of if, but rather when you will become a victim of Account Takeover and fraud. Using a Password Manager to create strong and unique passwords will greatly improve your personal security posture.
2) Be mindful of the sites and apps that you enter your username and password in to. Many fraudsters are now relying on phishing scam sites that look eerily similar to the real retailer/airline/bank site but are in fact under the control of the fraudster and are meant to harvest credentials in order to commit fraud.
3) Make sure you have a reputable antivirus on your Smartphone and uninstall any apps that are flagged as suspicious or malicious.
4) Use a virtual credit card. Virtual credit cards are now available from a number of organizations. These are beneficial as you can create a single use virtual credit card with a credit limit for a specific retailer. That way if the retailer suffers a data breach, or your account is taken over, your fraud exposure is contained and your real credit card is still secure.
5) Ask the retailer about their security controls and practices, and how they prevent Account Takeover. If they give you a sub-par canned answer, maybe you should think twice before saving your credit card information in their app.
*** This is a Security Bloggers Network syndicated blog from Shape Security Blog authored by Carlos Asuncion. Read the original post at: https://blog.shapesecurity.com/2020/02/13/in-store-payments-via-mobile-apps-can-lead-to-increase-in-card-not-present-cnp-fraud/
Google Online Security Blog: How we fought bad apps and malicious developers in 2019
Posted by Andrew Ahn, Product Manager, Google Play + Android App Safety
[Cross-posted from the Android Developers Blog]
Google Play connects users with great digital experiences to help them be more productive and entertained, as well as providing app developers with tools to reach billions of users around the globe. Such a thriving ecosystem can only be achieved and sustained when trust and safety is one of its key foundations. Over the last few years we’ve made the trust and safety of Google Play a top priority, and have continued our investments and improvements in our abuse detection systems, policies, and teams to fight against bad apps and malicious actors.
In 2019, we continued to strengthen our policies (especially to better protect kids and families), continued to improve our developer approval process, initiated a deeper collaboration with security industry partners through the App Defense Alliance, enhanced our machine learning detection systems analyzing an app’s code, metadata, and user engagement signals for any suspicious content or behaviors, as well as scaling the number and the depth of manual reviews. The combination of these efforts have resulted in a much cleaner Play Store:
Google Play released a new policy in 2018 to stop apps from unnecessarily accessing privacy-sensitive SMS and Call Log data. We saw a significant, 98% decrease in apps accessing SMS and Call Log data as developers partnered with us to update their apps and protect users. The remaining 2% are comprised of apps that require SMS and Call Log data to perform their core function.
One of the best ways to protect users from bad apps is to keep those apps out of the Play Store in the first place. Our improved vetting mechanisms stopped over 790,000 policy-violating app submissions before they were ever published to the Play Store.
Similarly to our SMS and Call Log policy, we also enacted a policy to better protect families in May 2019. After putting this in place, we worked with developers to update or remove tens of thousands of apps, making the Play Store a safer place for everyone.
In addition we’ve launched a refreshed Google Play Protect experience, our built-in malware protection for Android devices. Google Play Protect scans over 100B apps everyday, providing users with information about potential security issues and actions they can take to keep their devices safe and secure. Last year, Google Play Protect also prevented more than 1.9B malware installs from non-Google Play sources.
While we are proud of what we were able to achieve in partnership with our developer community, we know there is more work to be done. Adversarial bad actors will continue to devise new ways to evade our detection systems and put users in harm’s way for their own gains. Our commitment in building the world’s safest and most helpful app platform will continue in 2020, and we will continue to invest in the key app safety areas mentioned in last year’s blog post:
Strengthening app safety policies to protect user privacy
Faster detection of bad actors and blocking repeat offenders
Detecting and removing apps with harmful content and behaviors
Our teams of passionate product managers, engineers, policy experts, and operations leaders will continue to work with the developer community to accelerate the pace of innovation, and deliver a safer app store to billions of Android users worldwide.
Good news as volumes of attacks drop, but bad as attackers turn to stealthier attacks on softer targets
Global malware attacks fell for only the second time in five years, dropping six percent to 9.9 billion, down from 10.5 billion, according to a new report.
This seeming good news is not all it seems however, with attackers eschewing large volume attacks in favour of more evasive and targeted attacks on soft targets. In other ‘good’ news, ransomware attacks also dropped nine percent to almost 188 million, while the volume of cryptojacking incidents plummeted 78 percent in the second half of 2019. This last is probably due to the volatile crypto market directly impacting revenues for hackers, as well as the shuttering of browser-based Monero-mining service Coinhive in March 2019.
However, the bad news is that hackers have turned their attention to more lucrative targets, with web apps such as Dropbox and Slack seeing a huge uptick in attacks, up 52 percent in the past year to 40.8 million. According to the 2020 SonicWall Cyber Threat Report the overall internet trend towards encrypting traffic has been reflected in hacking too, with a rise in encrypted threats of 27 percent, totalling up to almost four million.
In addition, fileless malware and a range of new techniques (including code obfuscation, sandbox detection and bypass) saw a rise in popularity, with new threats hiding in common and trusted file types such as Office (20.3 percent) and PDFs (17.4 percent). Indeed, these two file types represented 38 percent of new threats detected by SonicWall.
Terry Greer-King, VP EMEA at SonicWall told SC Media UK that cyber-criminals are becoming smarter and more ambitious than ever before: “They now spend more time honing their craft, targeting vulnerable IoT devices and aiming ransomware at the highest-value targets most likely to payout. With hackers doubling their attacks on popular web apps used for work and everyday needs, financial and personal information within those services is now more vulnerable than ever. Sold on the dark web for a profit, there’s no telling where these details will end up.”
Interestingly, another trend highlighted by the report is a rise in IoT attacks, which saw a moderate five percent increase, with a total volume of 34.3 million attacks in 2019. With IoT Devices widely tipped for an exponential rise (one industry study predicts the global IoT security market will to reach or exceed £27 billion by 2023, a spike of 33.7 percent), the stage is set for increased volumes of IoT attack traffic as device penetration and deployment increases.
“Total end-to-end security is key, including a layered approach to security across wired, wireless, mobile and cloud networks. It will continue to be crucial to secure and manage IoT devices to prevent tampering and unauthorised access. As the report testifies, data will continue to be put under threat by malicious actors, often across changing vectors, and so it is hugely important that businesses and governments are proactive in protecting this.”, summarised Greer-King.
The report found that the most popular ransomware family of 2019 (making up 33 percent of all ransomware attacks), was Cerber, also boasting four of the top 10 ransomware signatures of the year, including the top two spots totaling more than 77 million hits.
The active attack involving three malicious Android applications is the first exploiting CVE-2019-2215, Trend Micro researchers report.
Researchers have discovered an attack exploiting CVE-2019-2215, which leverages three malicious apps in the Google Play store to compromise a target device and collect users’ data.
This threat is linked to the SideWinder advanced persistent threat (APT) group, report Trend Micro’s Ecular Xu and Joseph Chen in a blog post. Sidewinder, a group detected by Kaspersky Labs in the first quarter of 2018, primarily targets Pakistani military infrastructure and has been active since at least 2012. Security researchers believe the threat group is associated with Indian espionage interests and has a history of targeting both Windows and Android devices.
CVE-2019-2215 was disclosed in October 2019 by Maddie Stone of Google’s Project Zero. The zero-day local privilege escalation vulnerability affected hundreds of millions of Android phones at the time it was published. A patch was released in December 2017 for earlier Android versions; however, new source code review indicated newer versions of the software were vulnerable.
The use-after-free vulnerability is considered “high severity” and requires a target to download a malicious application for potential exploitation. An attacker would have to chain CVE-2019-2215 with another exploit to remotely infect and control a device via the browser or another attack vector. The bug allows for a “full compromise” of a vulnerable device, Stone explained.
While it was “highly likely” the bug was being used in attacks last October, this marks the first known active campaign using it in the wild, Xu and Chen report. This particular vulnerability exists in Binder, the main interprocess communication system that exists in Android, and the three malicious apps used in the attack were disguised as photography and file manager tools.
Android apps Camero, FileCrypt Manager, and callCam are believed to be related to the SideWinder group and have been active on Google Play since March 2019, based on one of the apps’ certificate information. All have since been removed from the Play store.
CallCam is the payload app and is installed in two stages, the researchers explain. First a DEX file — an Android file format — is downloaded from the command-and-control server. The downloaded DEX file downloads an APK file and installs it after exploiting the device or employing accessibility. Camero and FileCrypt Manager both act as droppers. After downloading the DEX file from the C2 server, they call extra code to download, install, and launch the callCam app.
Researchers note the C2 servers used are suspected to be part of SideWinder’s infrastructure. Further, a URL linking to one of the apps’ Google Play pages is on one of the C2 servers.
SideWinder relies on device rooting as one of its tactics to deploy callCam without alerting the victim. The malware retrieves a specific exploit from the C2 server depending on the DEX the dropper downloads. This approach only works on Google Pixel (Pixel 2 and Pixel 2 XL), Nokia 3 (TA-1032), LG V20 (LG-H990), Oppo F0 (CPH1881), and Redmi 6A devices.
Over the course of its investigation, Trend Micro was able to download five exploits from the C2 server and found they used CVE-2019-2215 and MediaTek-SU to gain root privileges. Once they achieve this, the malware installs callCam, enables accessibility permissions, and launches.
Another approach is using the accessibility permission, a technique used by the FileCrypt Manager on Android phones running Android 1.6 or higher. After launch, FileCrypt asks the user to enable accessibility. When granted, this displays a full-screen overlay that says it requires further setup. In the background, the app is calling code from the DEX file so it can download more apps and install callCam. It enables the accessibility permission and launches the payload.
“All of this happens behind the overlay screen, unbeknownst to the user,” Xu and Chen write.
After launch, the callCam icon is hidden on the target device and collects data in the background to send to the C2 server. This information includes location, battery status, files stored on the device, list of installed apps, account data, Wi-Fi data, and information related to the device, sensor, and camera. It also pulls data from WeChat, Outlook, Twitter, Yahoo Mail, Facebook, Gmail, and Chrome. CallCam encrypts all of this stolen data using RSA and AES encryption, and uses SHA256 to verify the data’s integrity and customize the encoding routine.
Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial … View Full Bio