Spyhide stalkerware is spying on tens of thousands of phones

 

Image Credits: TechCrunch

Aphone surveillance app called Spyhide is stealthily collecting private phone data from tens of thousands of Android devices around the world, new data shows.

Spyhide is a widely-used stalkerware (or spouseware) app that is planted on a victim’s phone, often by someone with knowledge of their passcode. The app is designed to stay hidden on a victim’s phone’s home screen, making it difficult to detect and remove. Once planted, Spyhide silently and continually uploads the phone’s contacts, messages, photos, call logs and recordings, and granular location in real-time.

Despite their stealth and broad access to a victim’s phone data, stalkerware apps are notoriously buggy and are known to spill, leak, or otherwise put victims’ stolen private data at further risk of exposure, underlying the risks that phone surveillance apps pose.

Now, Spyhide is the latest spyware operation added to that growing list.

Switzerland-based hacker maia arson crimew said in a blog post that the spyware maker exposed a portion of its development environment, allowing access to the source code of the web-based dashboard that abusers use to view the stolen phone data of their victims. By exploiting a vulnerability in the dashboard’s shoddy code, crimew gained access to the back-end databases, exposing the inner workings of the secretive spyware operation and its suspected administrators.

Crimew provided TechCrunch with a copy of Spyhide’s text-only database for verification and analysis.

Years of stolen phone data

Spyhide’s database contained detailed records of about 60,000 compromised Android devices, dating back to 2016 up to the date of exfiltration in mid-July. These records included call logs, text messages, and precise location history dating back years, as well as information about each file, such as when a photo or video was taken and uploaded, and when calls were recorded and for how long.

TechCrunch fed close to two million location data points into an offline geospatial and mapping software, allowing us to visualize and understand the spyware’s global reach.

Our analysis shows Spyhide’s surveillance network spans every continent, with clusters of thousands of victims in Europe and Brazil. The U.S. has more than 3,100 compromised devices, a fraction of the total number worldwide, yet these U.S. victims are still some of the most surveilled victims on the network by the quantity of location data alone. One U.S. device compromised by Spyhide had quietly uploaded more than 100,000 location data points.

Image Credits: TechCrunch

Spyhide’s database also contained records on 750,000 users who signed up to Spyhide with the intention of planting the spyware app on a victim’s device.

Although the high number of users suggests an unhealthy appetite for using surveillance apps, most users who signed up did not go on to compromise a phone or pay for the spyware, the records show.

That said, while most of the compromised Android devices were controlled by a single user, our analysis showed that more than 4,000 users were in control of more than one compromised device. A smaller number of user accounts were in control of dozens of compromised devices.

The data also included 3.29 million text messages containing highly personal information, such as two-factor codes and password reset links; more than 1.2 million call logs containing the phone numbers of the receiver and the length of the call, plus about 312,000 call recording files; more than 925,000 contact lists containing names and phone numbers; and records for 382,000 photos and images. The data also had details on close to 6,000 ambient recordings stealthily recorded from the microphone from the victim’s phone.

Made in Iran, hosted in Germany

On its website, Spyhide makes no reference to who runs the operation or where it was developed. Given the legal and reputational risks associated with selling spyware and facilitating the surveillance of others, it’s not uncommon for spyware administrators to try to keep their identities hidden.

But while Spyhide tried to conceal the administrator’s involvement, the source code contained the name of two Iranian developers who profit from the operation. One of the developers, Mostafa M., whose LinkedIn profile says he is currently located in Dubai, previously lived in the same northeastern Iranian city as the other Spyhide developer, Mohammad A., according to registration records associated with Spyhide’s domains.

The developers did not respond to several emails requesting comment.

Stalkerware apps like Spyhide, which explicitly advertise and encourage secret spousal surveillance, are banned from Google’s app store. Instead, users have to download the spyware app from Spyhide’s website.

TechCrunch installed the spyware app on a virtual device and used a network traffic analysis tool to understand what data was flowing in and out of the device. This virtual device meant we could run the app in a protective sandbox without giving it any real data, including our location. The traffic analysis showed that the app was sending our virtual device’s data to a server hosted by German web hosting giant Hetzner.

When reached for comment, Hetzner spokesperson Christian Fitz told TechCrunch that the web host does not allow the hosting of spyware.

What you can do

Android spyware apps are often disguised as a normal-looking Android app or process, so finding these apps can be tricky. Spyhide masquerades as a Google-themed app called “Google Settings” featuring a cog icon, or a ringtone app called “T.Ringtone” with a musical note icon. Both apps request permission to access a device’s data, and immediately begin sending private data to its servers.

You can check your installed apps through the apps menu in the Settings, even if the app is hidden on the home screen.

Image Credits: TechCrunch

We have a general guide that can help you remove Android spyware, if it’s safe to do so. Remember that switching off spyware will likely alert the person who planted it.

Switching on Google Play Protect is a helpful safeguards that protects against malicious Android apps, like spyware. You can enable it from the settings menu in Google Play.

Read more »

Fake Android apps uploaded to Play store by notorious Sandworm hackers

The Russian ‘Sandworm’ hacking group (not to be confused with the malware of the same name) has been caught repeatedly uploading fake and modified Android apps to Google’s Play store.

They were detected by Google Threat Analysis Group (TAG), making the attacks public during a presentation at the recent CyberwarCon conference.

In a blog on the topic this week, Google says the first attack connected to the group happened in South Korea in December 2017 when the group used bogus developer accounts to upload eight different apps to the Play Store.

On the face of it, the campaign was unsuccessful, garnering fewer than 10 installs per app, but it’s likely that the targets were highly selective.

That came after an attack in September 2017, when TAG detected that Sandworm hackers had uploaded a fake version of the UKR.net email app, downloaded by 1,000 users before it was stopped.

In late 2018, the group switched to inserting backdoors into the apps of legitimate developers in one of its favourite locations, Ukraine.

However, the Google Play Protect team caught the attempt at the time of upload. As a result, no users were infected, and we were able to re-secure the developer’s account.

There’s nothing unusual about this – hackers compromising developer keys to pass their own malware off as legitimate apps has been happening for years.

The significance of the Sandworm (aka Iridium) attacks is that the group is alleged to be connected to the Russian Government – one of a list of hacking entities that also includes Fancy Bear (APT28), Dragonfly, Energetic Bear, Grizzly Steppe, and many others. Sandworm is allegedly behind the NotPetya worm and the cyberattack on the 2018 Winter Olympics.

There are now so many of these that it’s hard to keep up. And it is not helped by the habit of the security industry of giving them different, proprietary names.

Google also reveals that it has detected alleged Russian disinformation campaigns in African countries such as Central African Republic, Sudan, Madagascar, and South Africa.

We terminated the associated Google accounts and 15 YouTube channels, and we continue to monitor this space.

Similar campaigns were uncovered in the Indonesian provinces Papua and West Papua “with messaging in opposition to the Free Papua Movement.”

Sandworm itself has been around since at least 2014, which makes it middle-aged by the standards of Russian hacking groups.

However, it would be a mistake to see this phenomenon as a uniquely Russian affair. Russian groups are highly active, as are ones connected to countries such as China and Iran, but the popularity of nation state-backed hacking and disinformation is spreading across the globe.

This might one day become ubiquitous. If that happens, it will not only be another bad day for the internet but could eventually rebound on its perpetrators too.

The significance of the Sandworm (aka Iridium) attacks is that the group is alleged to be connected to the Russian Government – one of a list of hacking entities that also includes Fancy Bear (APT28), Dragonfly, Energetic Bear, Grizzly Steppe, and many others. Sandworm is allegedly behind the NotPetya worm and the cyberattack on the 2018 Winter Olympics.

There are now so many of these that it’s hard to keep up. And it is not helped by the habit of the security industry of giving them different, proprietary names.

Google also reveals that it has detected alleged Russian disinformation campaigns in African countries such as Central African Republic, Sudan, Madagascar, and South Africa.

We terminated the associated Google accounts and 15 YouTube channels, and we continue to monitor this space.

Similar campaigns were uncovered in the Indonesian provinces Papua and West Papua “with messaging in opposition to the Free Papua Movement.”

Sandworm itself has been around since at least 2014, which makes it middle-aged by the standards of Russian hacking groups.

However, it would be a mistake to see this phenomenon as a uniquely Russian affair. Russian groups are highly active, as are ones connected to countries such as China and Iran, but the popularity of nation state-backed hacking and disinformation is spreading across the globe.

This might one day become ubiquitous. If that happens, it will not only be another bad day for the internet but could eventually rebound on its perpetrators too.

The significance of the Sandworm (aka Iridium) attacks is that the group is alleged to be connected to the Russian Government – one of a list of hacking entities that also includes Fancy Bear (APT28), Dragonfly, Energetic Bear, Grizzly Steppe, and many others. Sandworm is allegedly behind the NotPetya worm and the cyberattack on the 2018 Winter Olympics.

There are now so many of these that it’s hard to keep up. And it is not helped by the habit of the security industry of giving them different, proprietary names.

Google also reveals that it has detected alleged Russian disinformation campaigns in African countries such as Central African Republic, Sudan, Madagascar, and South Africa.

We terminated the associated Google accounts and 15 YouTube channels, and we continue to monitor this space.

Similar campaigns were uncovered in the Indonesian provinces Papua and West Papua “with messaging in opposition to the Free Papua Movement.”

Sandworm itself has been around since at least 2014, which makes it middle-aged by the standards of Russian hacking groups.

However, it would be a mistake to see this phenomenon as a uniquely Russian affair. Russian groups are highly active, as are ones connected to countries such as China and Iran, but the popularity of nation state-backed hacking and disinformation is spreading across the globe.

This might one day become ubiquitous. If that happens, it will not only be another bad day for the internet but could eventually rebound on its perpetrators too.

Read more »

How to scan router for malware

Consumer router security is pretty bad. Attackers are taking advantage of lackadaisical manufacturers and attacking large amounts of routers. Here’s how to check if your router’s been compromised.

The home router market is a lot like the Android smartphone market. Manufacturers are producing large numbers of different devices and not bothering updating them, leaving them open to attack.

How to Increase Battery Life

Volume 0%

 

How Your Router Can Join the Dark Side

RELATED: What Is DNS, and Should I Use Another DNS Server?

Attackers often seek to change the DNS server setting on your router, pointing it at a malicious DNS server. When you try to connect to a website — for example, your bank’s website — the malicious DNS server tells you to go to a phishing site instead. It may still say bankofamerica.com in your address bar, but you’ll be at a phishing site. The malicious DNS server doesn’t necessarily respond to all queries. It may simply time out on most requests and then redirect queries to your ISP’s default DNS server. Unusually slow DNS requests are a sign you may have an infection.

Sharp-eyed people may notice that such a phishing site won’t have HTTPS encryption, but many people wouldn’t notice. SSL-stripping attacks can even remove the encryption in transit.

Attackers may also just inject advertisements, redirect search results, or attempt to install drive-by downloads. They can capture requests for Google Analytics or other scripts almost every website use and redirect them to a server providing a script that instead injects ads. If you see pornographic advertisements on a legitimate website like How-To Geek or the New York Times, you’re almost certainly infected with something — either on your router or your computer itself.

Many attacks make use of cross-site request forgery (CSRF) attacks. An attacker embeds malicious JavaScript onto a web page, and that JavaScript attempts to load the router’s web-based administration page and change settings. As the JavaScript is running on a device inside your local network, the code can access the web interface that’s only available inside your network.

Some routers may have their remote administration interfaces activated along with default usernames and passwords — bots can scan for such routers on the Internet and gain access. Other exploits can take advantage of other router problems. UPnP seems to be vulnerable on many routers, for example.

How to Check

RELATED: 10 Useful Options You Can Configure In Your Router’s Web Interface

The one telltale sign that a router has been compromised is that its DNS server has been changed. You’ll want to visit your router’s web-based interface and check its DNS server setting.

First, you’ll need to access your router’s web-based setup page. Check your network connection’s gateway address or consult your router’s documentation to find out how.

Sign in with your router’s username and password, if necessary. Look for a “DNS” setting somewhere, often in the WAN or Internet connection settings screen. If it’s set to “Automatic,” that’s fine — it’s getting it from your ISP. If it’s set to “Manual” and there are custom DNS servers entered there, that could very well be a problem.

It’s no problem if you’ve configured your router to use good alternative DNS servers — for example, 8.8.8.8 and 8.8.4.4 for Google DNS or 208.67.222.222 and 208.67.220.220 for OpenDNS. But, if there are DNS servers there you don’t recognize, that’s a sign malware has changed your router to use DNS servers. If in doubt, perform a web search for the DNS server addresses and see whether they’re legitimate or not. Something like “0.0.0.0” is fine and often just means the field is empty and the router is automatically getting a DNS server instead.

Experts advise checking this setting occasionally to see whether your router has been compromised or not.

Help, There’ a Malicious DNS Server!

If there is a malicious DNS server configured here, you can disable it and tell your router to use the automatic DNS server from your ISP or enter the addresses of legitimate DNS servers like Google DNS or OpenDNS here.

If there is a malicious DNS server entered here, you may want to wipe all your router’s settings and factory-reset it before setting it back up again — just to be safe. Then, use the tricks below to help secure the router against further attacks.

Hardening Your Router Against Attacks

RELATED: Secure Your Wireless Router: 8 Things You Can Do Right Now

You can certainly harden your router against these attacks — somewhat. If the router has security holes the manufacturer hasn’t patched, you can’t completely secure it.

• Install Firmware Updates: Ensure the latest firmware for your router is installed. Enable automatic firmware updates if the router offers it — unfortunately, most routers don’t. This at least ensures you’re protected from any flaws that have been patched.
• Disable Remote Access: Disable remote access to the router’s web-based administration pages.
• Change the Password: Change the password to the router’s web-based administration interface so attackers can’t just get in with the default one.
• Turn Off UPnP: UPnP has been particularly vulnerable. Even if UPnP isn’t vulnerable on your router, a piece of malware running somewhere inside your local network can use UPnP to change your DNS server. That’s just how UPnP works — it trusts all requests coming from within your local network.

---

DNSSEC is supposed to provide additional security, but it’s no panacea here. In the real world, every client operating system just trusts the configured DNS server. The malicious DNS server could claim a DNS record has no DNSSEC information, or that it does have DNSSEC information and the IP address being passed along is the real one.

Image Credit: nrkbeta on Flickr

Read more »

scan router for malware

Read more »

Among smartphones, Android devices are the most commonly targeted by malware, finds report

(Last Updated On: December 7, 2018)

According to the latest Nokia Threat Intelligence Report 2019, Android devices are the most commonly targeted by malware. In mobile networks, Android devices were responsible for 47.15% of the observed malware infections, Windows©/ PCs for 35.82%, IoT for 16.17% and Apple’s iPhones for less than 1%.

Malware, Device breakdown 2018, source Nokia Threat Intelligence Report 2019

In the smartphone sector, the vast majority of malware is currently distributed as trojanized applications. The user is tricked by phishing, advertising or other social engineering into downloading and installing the application. The main reason that the Android platform is targeted, is the fact that once side-loading is enabled, Android applications can be downloaded from just about anywhere. In contrast, iPhone applications are for the most part limited to one source, the Apple Store.

Report also noted that Windows/PCs continue to be a target for malware infection. These Windows/PCs are connected to the mobile network using USB dongles and mobile Wi-Fi devices or simply tethered through smartphones. They are responsible for 36% of the malware infections observed. This is because these devices are still a popular target for professional cybercriminals who have a huge investment in the Windows malware ecosystem.

According to the report, IoT devices now make up 16% of the infected devices observed. This is mostly the result of IoT botnet activity. These bots actively scan for vulnerable victims using an increasingly rich suite of attacks. In networks where devices are routinely assigned public facing internet IP addresses we find a high IoT infection rate. In networks where carrier grade NAT is used, the infection rate is considerably reduced, because the vulnerable devices are not visible to network scanning.

The report also found that Android malware samples continue to grow in 2018. Nokia Threat Intelligence Lab now has close to 20 million Android malware samples. This is an increase of 31% since last year.

Of the top 20 malware infections detected in fixed residential networks in 2018, the majority still focus on the traditional Windows/PC platform, however 5 of the top 20 target IoT and 3 target Android.

In 2018 the average percentage of devices infected each month was 0.31%. The peak month was June with 0.46% due to an increase in activity of Android.Adware.Adultswine, malware that displays ads from the web that are often highly inappropriate and pornographic, attempts to trick users into installing fake “security apps” that also serve ads and entices users to register for premium services with hiddenexpenses. It is very persistent and difficult to uninstall.

The report also stessed the emergence of new IoT botnet variants in 2018. In particular – Fbot, which is a Satori related botnet that has two major distinguishing features. It spreads by scanning for devices that have the default Android Debug Bridge (ADB) port open. Very few Androids phones have this port open, but apparently some smart TVs and other Android based IoT devices have been deployed accidentally with this debug port open.

via droidmen

Read more »