A new Android malware toolkit called Dendroid is being offered for sale by its creators, and at least one of the malicious APKs created with it has managed to fool Google Play's Bouncer...
The malicious APKs can purportedly intercept, block, and send out SMSes; record ongoing phone calls; take pictures, record video and audio by using the device's camera and microphone; download pictures the device owner has already made, as well as his or her browser history and bookmarks; and extract saved login credentials and passwords for a variety of accounts.
"Dendroid also comes bundled with a universal 'binder application.' This is a point-and-click tool that a customer can use to inject (or bind) Dendroid into any innocent target application that they choose with minimal effort," the researchers added.
"This means that all a wannabee malware author needs in order to start pumping out infected applications is to choose a carrier app, download it and then let Dendroid’s toolkit take care of the rest."
Sold for $300 (in crypto currencies), the toolkit comes with a warranty that the malware created with it will remain undetected.
The researchers have discovered one app created with Dendroid that managed to get included and offered on Google Play by leveraging anti-emulation detection code that fools Google Play's Bouncer, the automated app scanning service that analyzes apps by running them on Google’s cloud infrastructure and simulating how they will run on an Android device. The app has since been removed from the market. (more)
Why this is important...
It means that any jerk with $300 and some computer skills can turn any other app into your worst nightmare. BTW, it can be detected. q.v. SpyWarn™ — coming soon.
Americans have good reason to wonder if there is such a thing as privacy anymore. After former National Security Agency contractor Edward Snowden revealed that the U.S. government monitors calls, emails and texts, many people might think twice about what they share online. But that same technology is being used for another purpose: “There are a growing number of apps that will spy on your husband or wife and keep tabs on your kids,” says Theodore Claypoole, privacy attorney and co-author of “Privacy in the Age of Big Data: Recognizing Threats, Defending Your Rights, and Protecting Your Family.”
These apps may raise moral and legal questions too. The most invasive can be downloaded onto a phone and will quietly forward emails, calls and texts.
It’s a criminal offense under the Computer Fraud and Abuse Act of 1965 to access a computer—including modern computers like tablets and smartphones—without authorization. But if ownership of the smartphone in question is under someone else’s name—say, a spouse, a parent or an employer—it’s a legal gray area, Claypoole says. “That raises the question of whether the user has a reasonable expectation of privacy,” he says. “If you own your husband or wife’s smartphone and you’re paying your child’s phone bill, it could be a moral issue rather than a legal one.” (more)
Latvia - The wire-tapping scandal at Riga International airport is being investigated by Security Police. This whole situation has created a great deal of concern for Latvian politicians. During a recent closed meeting of the Saeima National Security Committee, they attempted to determine if there are any recordings of conversations that could compromise officials and sponsors of political parties whose names have surfaced during the investigation...
Even though the actual meeting was closed and information classified, Pietiek managed to uncover that politicians are concerned over the news that Riga airport’s VIP lounge was being monitored as well. Officials often use this are of the airport to meet in an informal environment to discuss matters away from prying eyes. (more)
The German parliament building may be soon checked for bugs and eavesdropping landlines to ensure privacy. Berlin is ramping up security amid a scandal over electronic surveillance by the US National Security Agency.
A plan to secure the Bundestag complex was prepared by the Federal Office for Information Security (BSI) and approved by the IuK, the parliamentary commission on information technology and communications, Der Spiegel magazine reported on Monday citing its sources. It is to be presented to MPs later this week.
One of the prime areas of interest for the BSI is posed by supposedly secure rooms, which are meant to be used for negotiations of officials related to confidential matters. The office wants to ensure that they are actually free of bugs, the report says.
They also want to check landlines in the building, because they can be used for remote eavesdropping on the parliament. (more)
The amazing part of the story is that TSCM inspections are apparently not routine.
Ireland - MCDONALD’S has defended the use of a hidden camera in the bathroom of a Dublin restaurant.
The primitive device, hidden in a smoke alarm in men’s bathroom in its Temple Bar branch, is pointed towards the sink area.
This leaves urinals and cubicles out of view.
A statement from McDonald’s noted that means the camera is “fully compliant with all appropriate legislation and guidelines in this area”.
Data Protection laws state that there are circumstances in which a camera can be installed in a bathroom. (more)
Chinese cybercriminals are increasingly targeting mobile users as they develop ever more sophisticated hacking tools, according to new research from security firm Trend Micro.
Its Mobile Cybercriminal Underground Market report revealed that Chinese hackers are using a variety of in-depth malware and malicious code programs to target users both at home and in the West, with mobile malware kits available to buy from as little as 100 yuan (around £10) on the black market.
“The barriers to launching cybercriminal operations are less in number than ever,” the report stated. “Toolkits are becoming more available and cheaper; some are even offered free of charge.” (more)
Turkey’s Prime Minister Recep Tayyip Erdogan, whose government has been ensnared by a series of anonymously leaked audio tapes of purported corruption, said his administration may face a new threat from covertly recorded video recordings.
“In these incidents, there is not just wiretapping, there is also filming,” Erdogan said in Ankara yesterday, according to state-run Anatolia news agency. “It’s even been stretched to the extreme of filming extramarital affairs, invading a family’s privacy and totally ignoring moral values.”
Speaking to local reporters after the release of audio tapes that the opposition said placed Erdogan at the center of a bribery scheme, the premier lashed out at the tactics. (more)
KUWAIT -- Maximum penalties will be taken against any
telecommunication company trading in eavesdropping devices, warned Minister of
Communications Essa Al-Kanderi on Wednesday. Offenders will be referred to the public prosecution, the minister warned
further, during a debate at the National Assembly. Some MPs charged during the discussions that a number of companies
"possess" listening bugs, in violation of the Constitution and State Laws. (more)
NJ - The deputy director of the Hudson County jail, who is facing federal charges he used a website to illegally wiretap fellow employees, has put in his retirement papers, officials said.
The retirement papers of Kirk Eady, 45, of East Brunswick, are dated retroactively to Feb. 1, Hudson County spokesman Jim Kennelly said.
Eady turned himself in to federal authorities on Feb. 15 after being charged with intentionally intercepting the wire, oral or electronic communications of others, according to a criminal complaint. (more)
Australia - Former Perth barrister Lloyd Rayney will be making an application to put a permanent hold on charges of bugging his wife's phone, a court has heard. Rayney is accused of intercepting the calls of his wife Corryn in the lead up to her death in 2007. (more)
Previously reported in 2007...
She bootscoots. He taps. What could possibly go wrong?
The Continuing Saga of the Rayney Wiretap
Update - Rayney ‘phone’ man in key talks
Android phones and tablets from four different manufacturers are arriving with malware “pre-installed” – a bogus version of Netflix which sends password and credit card information to Russia, according to app security specialist Marble Security.
David Jevans, CTO and founder of the company said that he was alerted to the problem by a company testing his product, software to help organizations manage mobile devices, after it repeatedly flagged Netflix as malicious, according to PC World’s report.
Jevans’ team analysed the app, and found that it was bogus, using tools including one that analyzed the app’s network traffic for signs of communication with known malicious servers. Jevans says, “This isn’t the real Netflix. You’ve got one that has been tampered with, and is sending passwords and credit card information to Russia.” (more)
Australian law enforcement agencies are increasingly unable to monitor the communications of some of the country's most powerful criminals due to the rising prevalence of uncrackable encrypted phones.
The phones are linked to a series of the underworld killings that rocked Sydney, several senior law enforcement officials told the ABC on condition of anonymity.
The phones are sold by dozens of companies worldwide and have legitimate uses.
But the law enforcement officials say thousands of the phones have been obtained by Australian criminals and they are using them to commit serious crimes, including murder. (more) (video report)
Interesting article, but... one half of my brain is saying wouldn't the LE's want criminals to think these phones are secure? And, once the general public views encryption as a criminal tool, the politicians would be free to pass laws restricting communications encryption so then only the outlaws (and selected others) would use it... kind-of-like gun silencers.
Or, maybe I've been "Snowed-in" over the long winter and have become cynical.
Hundreds of open source packages, including the Red Hat, Ubuntu, and Debian distributions of Linux, are susceptible to attacks that circumvent the most widely used technology to prevent eavesdropping on the Internet, thanks to an extremely critical vulnerability in a widely used cryptographic code library.
The bug in the GnuTLS library makes it trivial for attackers to bypass secure sockets layer (SSL) and Transport Layer Security (TLS) protections available on websites that depend on the open source package. Initial estimates ... indicate that more than 200 different operating systems or applications rely on GnuTLS to implement crucial SSL and TLS operations, but it wouldn't be surprising if the actual number is much higher.
Web applications, e-mail programs, and other code that use the library are vulnerable to exploits that allow attackers monitoring connections to silently decode encrypted traffic passing between end users and servers. (more)
Back in 2009, I posted this: Spy Pen May Kill $27 Billion Lawsuit. A little later: The Chevron Secret Recordings Case Continues. Chevron claimed that the Ecuadorian legal system was corrupt and they were not getting a fair hearing.
They backed up their claim with covert videos showing the bribery and corruption. For a while they hosted the videos on their website, while saying they had nothing to do with the making of them.
The videos were made with nothing more than a cheap spy pen and video wristwatch bought from a SkyMall catalog.
Now, a $9.5 Billion lawsuit is $0.00. If this doesn't prove the power of spy gadgets, nothing does.
Got any cheap spy gadgets hanging around your offices? You don't know, do you? Call me.
Here is how the lawsuit ended today...
A federal judge ruled in favor of Chevron Corp. on Tuesday in a civil racketeering case, saying a record $9.5 billion environmental judgment in Ecuador against the oil giant was "obtained by corrupt means."
U.S. District Judge Lewis Kaplan found that New York lawyer Steven Donziger and his litigation team engaged in coercion, bribery, money laundering and other criminal conduct in pursuit of the 2011 verdict.
The decision barred Mr. Donziger and his two Ecuadorean co-defendants from profiting from the verdict.
The case in New York stems from a 2003 lawsuit filed by a group of Ecuadorean villagers from the Lago Agrio region over decades-old pollution from oil exploration in the Amazon rain forest by Texaco Inc., which Chevron acquired in 2001. The decision could hamper efforts to enforce the 2011 judgment by pursuing Chevron's assets in Canada and elsewhere. (more)
Sprint Corp. overcharged the Federal Bureau of Investigation, the Drug Enforcement Administration and other law-enforcement agencies by more than 50% to facilitate eavesdropping on phone calls, the U.S. Justice Department alleged in a lawsuit filed Monday.
The suit accuses Sprint of inflating the bills it submitted to federal law-enforcement agencies for wiretaps and other surveillance services to cover capital expenditures necessary to respond to the requests—something prohibited by federal law and Federal Communications Commission rules, according to the complaint filed in federal court in San Francisco.
Sprint covered up the fact that the extra charges were included in the bills paid by the FBI and others by disguising them as regular surveillance costs, the suit alleges. As a result, the federal government overpaid Sprint by $21 million over a period of three and a half years.
Sprint said it didn't break the law and will fight the charges. (more)
