Report: China clamps down on...

Reports indicate that Beijing's local government has introduced new rules to force people on social networks to use their real names, in a move that could make it harder to organise protests

(ZDNet UK - Security Management)

Facebook moves to fix photo...

The social-networking site is working to fix a bug that allowed users to see thumbnails of photos that had been set to private

(ZDNet UK - Security Management)

Report details extent of...

Analysts find that the AntiSec hack reported Christmas Day against the security think tank affected some 50,000 people, and more files are expected to be released in the coming days.

New Year's Wishes - with...

It's almost the end of 2011. What with Christmas recently passed, and the New Year coming up, there's naturally a lot of well wishes and holiday greetings being messaged around. Looks like somebody's decided to join in (a little late) — and also do a bit of data harvesting at the same time.

Spyware:Android/AdBoo.A appears to be one of those programs that lets you send witty/sweet/funny messages to your contacts. On execution, it displays a list of text messages that fall into different categories: new year wishes, friendship, love and jokes:



When the user selects one of these messages, the app prompts a dialog box asking for the next action: Contact, Edit or Cancel:



If Contact is chosen, the app tries to read the stored contact data. Presumably, it needs to know to whom to send the message:



During our initial analysis, because the test phone didn't have any stored contacts, the app didn't retrieve anything at this point.

However, when AdBoo was retested with (bogus) contacts present, no text message was sent then either — AdBoo only produces a dialog box with the message "Sending fail":



We noticed that the app did do something else though. On selecting the Contacts options, it silently obtained the following information from the device:

1) Phone Model
2) Android Version
3) Phone number
4) International Mobile Equipment Identity (IMEI) number

The harvested details are then forwarded to remote server.

Incidentally, looking at the certificate for this variant of AdBoo, it appears to be from the same developer as Zsone.A:

AdBoo:



Zsone:



Threat Solutions post by — Irene

On 29/12/11 At 10:12 AM

Trojan:Android/FakeNotify...

Earlier this month, we did a post about a family of premium rate SMS Trojans, which we detected as Trojan:Android/FakeNotify.A. Now we've found that the trojan has been updated, with changes to make analysis and detection more troublesome.

The new version comes from the same developer, as can be seen from the signing certificate. There's no change in the trojan's overall behavior, but the coding approach has changed significantly enough to foil static analysis tools and such.

For example, while analyzing, I compared the SMS sending routine from both the original and the current versions, and observed a change from the earlier simpler coding approach to a more dynamic one.

In the original version of FakeNotify, the routine was implemented in a straightforward manner that makes it is very easy to "read" what it does:


FakeNotify.A

The new version however takes advantage of the Reflection/Dynamic Invocation feature in the Java language to accomplish the same purpose, while making it harder for analysts to "read" the code.

The developer even goes one step further by obfuscating the string arguments with their own encoding/decoding algorithm (though this is just a simple substitution-like cipher). You can see the encoded form below:


FakeNotify.B, SHA1: df866cf4312cf9c929a9a7dc384eebb19d2b2c2d

The change in coding approach could easily defeat most static analysis tools.

Side note: during analysis, I suddenly realized the similarity between Windows LoadLibrary and GetProcAddress combo API functions and some features of Java Reflection. When it comes to dynamic retrieval of other API function addresses (Windows) and classes or method object handles (Java), both will allow the developer to call or invoke a recently acquired method or function.

Anyway, let's go back to Android world. To ease analysis of the new FakeNotify version, I created a simple Python script to replace instances of obfuscated strings with the plaintext ones of all the decompiled Java sources of the malicious application.

After the patching, it became clearer that the SMS sending routine obtains the handle to the class SmsManager and its getDefault method/function, which subsequently needs to be invoked/called or properly initialized in order to use the SmsManager class's sendTextMessage function:



Granted, this is hardly the first time I've seen the Java Reflection feature being used by Android malware, and the string obfuscation is not complex. It is however a pretty clear example of how Android malware developers are continuously adapting and upgrading their techniques to keep their "products" fresh and undetected.

Threat Solutions post by — Jessie

On 28/12/11 At 09:08 AM

Studying Airport Security

Alan A. Kirschenbaum, Michele Mariani, Coen Van Gulijk, Sharon Lubasz, Carmit Rapaport, and Hinke Andriessen, "Airport Security: An Ethnographic Study," Journal of Air Transport Management, 18 (January 2012): 68-73 (full article is behind a paywall). Abstract: This paper employs a behavioral science perspective of airport security to, examine security related decision behaviors using exploratory ethnographic observations. Sampling employees from a...

GoDaddy accused of...

A rival accuses GoDaddy of blocking customers boycotting the registrar because of its support for a drastic copyright bill. GoDaddy denies wrongdoing.

Government calls on Experian...

HM Revenue and Customs and the Department for Work and Pensions will use data from credit reference agency Experian to detect fraud and errors in the tax system

(ZDNet UK - Security Management)