Android Ransomware

These days, fake Antivirus programs that run under Windows look just as good as real, valid antivirus tools. They'll run a scan for free—a fast one, since there's no actual scanning going on. However, to remove the imaginary malware found by the scan, you'll have to pay up. In a recent blog post, Symantec researcher Joji Hamada reported that this type of malware has come to Android, and it's even more aggressive than the typical Windows fake antivirus. Symantec calls the malware sample featured in this post Android.Fakedefender, because it installs as a trial version calling itself Android Defender.

The typical Windows-based fake antivirus programs attempt to scare the user into paying for a registered version by displaying frightening scan results, hence the name scareware. They work hard to look just like a valid antivirus, to the point that some even offer tech support. It's not uncommon for victims to express outrage when a legitimate security product removes the fake one: "Hey, that's my antivirus! I paid for that!"
  
Porn Discovered :
 
In what may be an attempt to discourage you from seeking help, the fake antivirus reports that it has detected malware attempting to steal pornographic content from the phone. How embarrassing! At this point, you can't delete the fake antivirus and can't launch any other apps. The only way to recover, short of a hard reset, is to purchase the full version. It's effectively holding your phone for ransom. Hamada didn't state whether paying the ransom actually unlocks the phone.

F-Secure's Mikko Hypponen has gone on record stating that the biggest threat for Android users is losing your phone, not malware. Hamada begs to differ, pointing out that malware like this is really, really hard to remove once it gets a foothold. He advises running mobile security software to keep threats like this from installing in the first place.

Read more

Sendrawpdu iPhone SMS spoofing tool

A French hacker has released a tool capable of sending SMSes with spoofed sender details on the iPhone 4. The sendrawpdu command line interface tool allows users to customise the reply number on SMSes and could be ideal for phishing attacks. Researcher revealed an SMS spoofing flaw that affects every version of Apple’s mobile OS. Using the flaw, hackers could spoof their identities via text and send messages asking for private information (by pretending to be from a users’ bank, for example), or direct users to phishing sites.
pod2g highlights several ways in which malicious parties could take advantage of this flaw, including phishing attempts linking users to sites collecting personal information or spoofing messages for the purposes of creating false evidence or gaining a recipient’s trust to enable further nefarious action.
In many cases the malicious party would need to know the name and number of a trusted contact of the recipient in order for their efforts to be effective, but the phishing example shows how malicious parties could cast broad nets hoping to snare users by pretending to be a common bank or other institution.
French hacker has published on his blog that he developed iPhone SMS security app and called it Sendrawpdu. The tool is designed for iPhone 4, and can be downloaded free of charge from the service repository Github where you can find the app.

Download

https://github.com/pod2g/sendrawpdu

Read more

Telecom/Mobile Network Attacks

Main types of known  Attacks :-

Rogue Base station Attacks

• GSM standards mandate authentication of mobile devices by the network but not vice-versa.
• Attackers run their own BSS with powerful radio antennas and using proximity, fools a mobile device into attaching to itself instead of a legitimate BSS.
• Base Station hardware and Open Source software (e.g. OpenBTS, OpenBSC) are available in public.
• Allows an attacker to intercept outbound voice, identify subscriber’s geo-location and capture a subscriber’s IMSI.

Track Location Attacks

• An attacker’s objective is to identify a subscriber’s geo-location.
• For attacking wider areas, MSC information can be leaked from HLR. For local area attacks, a rogue BSS can be used.
• Obfuscated MSC code is stored inside the HLR, each of which has mapping to a physical area.
• Rogue BSS can be used to launch active or passive attacks for the purpose of knowing subscriber’s geo-location
  • Active Attack: a rogue BSS can send RRLP (Radio Resource Location services Protocol) request and the phone will return the geo-location. Also the BSS can force a handset into a higher power level and can calculate the location from its electro-magnetic signature.
  • Passive: by intercepting TA (Timing Advance) and Power Level data send from mobile phone. In GSM, TA is the length of time a signal takes to reach from a mobile device to the BSS. Each mobile device transmits periodically less than 1/8th of the eight TDMA time slots.  Since each device is at a different distance and the signal travels at a finite speed, the precise arrival time within a time slot allows BSS to determine the distance of the device.

Attacks on Subscriber Information

• An attacker’s objective is to know the billing entity name for a given MSISDN number.
• Caller ID query on CNAM can reveal the organization, individual and business details.
• Caller ID databases are generally accessible through VoIP.

 

Encryption Attacks

• Mobile networks communicate with mobile devices with TMSI. A TMSI is mapped to MSISDN.
• An attacker’s objective is to find the MSISDN, then read the traffic and decrypt.
• TMSI can be discovered by a number of techniques. Two of the common known techniques are: Silent Paging and Silent SMS:
  • Silent Paging: to Page a device silently, an adversary calls the target MSISDN and hangs up before the BSS initiates the process to alert the called device. Then the adversary scans the PCH (Paging Channel) for incoming call broadcasts. From that, it retrieves the TMSI or IMSI.
  • Silent SMS: the adversary sends a specially crafted silent SMS which is acknowledged by the device without displaying it. This is possible by changing the “data_coding”  attribute of GSM 03.38 to ’0xC0′. When the mobile device receives an SMS with data_coding set to the value, it sends a delivery notification but discards the message and hence it is never displayed. The adversary then scans the PCH and captures the TMSI or IMSI.
  • Knowing TMSI allows an adversary to monitor specific target MSISDN. Then using cryptanalysis the adversary cracks the session key and records the call content.
  • The adversary typically requires a set of RF equipment and a cracking infrastructure:
    • RF Equipments: Universal Software Radio Peripheral, Wide-band receiver and low-cost mobile phone with custom firmware (e.g. OsmocomBB).
    • Cracking Infrastructure: FPGAs (Field Programmable Gate Arrays), low cost PCs and Rainbow table.

Attacks on Mobile Devices

• Compromising a targeted mobile device gives an adversary easy access to user information.
• Typically, the following types of attacks are known to be successfully used: Baseband Attack, Messaging Attack, Application Attack and a Mixed Attack.
• A Baseband Attack targets the underlying RTOS operating system of a device. Most of them are written in C and Assembly language for which an adversary has access to publicly available vulnerability information and exploits. Many of the RTOS lack security features like stack protection, address space layout randomization etc.
• A Messaging Attack targets protocol and/or architectural vulnerabilities and implementation vulnerabilities.
• WAP and OTA push enables delivering unsolicited data to mobiles. This can be and had been the source of some attacks e.g. DoS attack using malformed WAP payload (ref: MSL-2008-001).
• MMS Spoofing can be achieved for example, by using vulnerabilities in a web application’s session management. The adversary attempts to illegitimately charge a victim for MMS sent.
• A number of vulnerabilities occur due to faulty implementation of a protocol or technology standard.  Some of the known examples are iPhone SMS attack  (by Collin Mulliner and Charlie Miller),  SMS curse of silence (by Tobias Engel)
• With increasingly powerful smart phones, mobile applications are becoming attack vectors (Pwn2Own attack on iPhone Safari browser by Ralf- Philipp Weinmann and Vicenzo Lozzo)
• There are other types of known attacks e.g. iPhone PHP Perl Compatibility Regular Expression vulnerability (for iPhone 1.x) discovered by Charlie Miller.

Denial-of-Service Attacks

• DoS can be launched against network or a targeted mobile device.
• BSS has a limited number of control channels (RACH- Random Access Channel). By flooding the channels, the services in an area can be rendered unusable.
• IMSI Detach message is used to tear down a mobile device call from the network. An adversary spoofs a detach message by using the IMSI of a target device which will disconnect the device from the network making the device useless for telephony activities.

Read more

Location Tracking of a Mobile Device Via Silent SMS

SMS (Short Message Services) has become an extended part of modern day life. Initially created to send non-sensitive information using spare space in signaling channels, it has now evolved into a feature-rich service.

How SMS is used to track the location of a mobile device

The law enforcement agencies used the basic principle that every time a mobile device performs any activity, it exposes its presence to the Cell tower. If the mobile network can force the mobile device to some very short activity without making it perceptible to the user, then using Radiolocation technologies, the mobile device can be tracked.  To do that, a special type of SMS known as “Silent SMS” is used. Every time a silent SMS is delivered, the mobile silently acknowledges. This creates activities for a mobile which is tracked by a LMU (Location Measurement Unit) at BTS (Base Transceiver Station) by using a variety of multilateration methods.

A commonly used technique for tracking location in GSM network is called E-OTD (Enhanced-Observed Time Difference of arrival) . This is a network-based location tracking method. In this technique, the signal arrival time from the mobile device is measured from 3 BTS/LMUs’. The position of the ME (Mobile Equipment) is determined by comparing the time differences between two sets of timing measurements. The accuracy is between 50 – 200 meters. More accurate location measurement is possible using A-GPS (Assisted GPS) based systems.

In the past using Cell Tower log generated by forcing the target mobile device into some activities, a target’s locations and movements were accurately reconstructed and identified.  In the USA vs. Forrest case, police used similar techniques

The SMS message is specified by the ETSI in documents GSM 03.38  and GSM 03.40. It can be up to 160 characters long, where each character is 7 bits. Eight-bit messages can contain up to 140 characters and are usually not viewable by the phones as text messages. Instead they are used for data in e.g. smart messaging (images and ringing tones) and Over The Air (OTA) provisioning of Wireless Application Protocol (WAP) settings.
Silent messages, often referred to as  “Silent SMS” or “Stealth SMS” is a type of SMS message which when received by a mobile device does not notify either by the display or by a sound. GSM 03.40  describes a Short Message of type 0 which indicates that the mobile equipment must acknowledge receipt of the short message but may discard its contents.

How to create Silent SMS

To create Silent SMS, the SMS PDU (Protocol Data Unit) needs to be manipulated. It is best done from an application that communicates with SMSC (SMS Center) using a protocol called SMPP. To send a SMS, the application need to send SMPP GSM 03.38 encoded Submit_Sm PDU.  A sample Submit_Sm PDU is shown below:

Encoding PDU Header . .’ command length ’ , ( 7 1 ) . . . 00 00 00 47
’ command id ’ , ( 4 ) . . . 00 00 00 04
’ command s t a tus ’ , ( 0 ) . . . 00 00 00 00
’ sequence number ’ , ( 1 ) . . . 00 00 00 01
Encoding PDU Body . .
’ service type ’ , ( 0 ) . . . 30 00
’ source_add r_ t o n ’ , ( 1 ) . . . 01 __ ’ source_ addr_ npi ’ , ( 1 ) . . . 01 **
‘source_ addr ’ , (27829239812) . . . 32 37 38 32 39 32 33 39 38 31 32 00
’dest_addr_ton ’ , ( 1 ) . . . 01 **
’dest_addr_npi ’ , ( 1 ) . . . 01 **
’dest_ addr’ , (27829239812) . . . 32 37 38 32 39 32 33 39 38 31 32 00
’esm_ class ’ , ( 0 ) . . . 00
’protocol_ id ’ , ( 0 ) . . . 00
’priority_flag ’ , ( 0 ) . . . 00
’schedule_delivery_time ’ , ( 0 ) . . . 30 00
’validity_period ’ , ( 0 ) . . . 30 00
’registered_delivery ’ , ( 1 ) . . . 01
’replace_ if_ present_fl ag ’ , ( 0 ) . . . 00
’data_coding ’ , ( 0 ) . . . 00
’sm_default_msg_ id ’ , ( 0 ) . . . 00
’sm_length ’ , ( 0 ) . . . 00
’short_message ’ , ( xyz..etc ) . . . 69 76 69 7A 73 65 63 75 72 69 74 79 2E 63 6F 6D
Full PDU ( 70 o c t e t s + + ) . . 00 00 00 47 00 00 00 04 00 00 00 00 00 00
00 01 30 00 01 01 32 37 38 32 39 32 33 39 38 31 32 00 01 01 32 37 38
32 39 32 33 39 38 31 32 00 00 00 00 30 00 30 00 01 00 00 00 00 73 61
74 6E 61 63 2E 6F 72 67 2E 7A
** ( 0 )  indicates local numeric numbering formatting
( 1 ) indicates international numeric number formatting
++ Octet is a group of 8 bits , often referred to as a byte

There are many different ways to manipulate SMS PDU but many of them may cause mobile device malfunctioning. The two techniques described by N.J Croft and M.S Olivier ["A silent SMS denial of service (DoS) attack," Proceedings of the Southern African Telecommunication Networks and Applications Conference 2007 (SATNAC 2007), Sugar Beach Resort, Mauritius, September 2007 (Published electronically)]  were used and found working are: Manipulating Data Encoding Scheme and Manipulating Timing in a WAP Push Message.

In the first technique, the data_encoding attribute of SMS PDU was set to 0xC0. This sets the MWIG (Message Waiting Indication Group) identifier that as per GSM 03.38 translates to “Discard Message”. The mobile device on receiving the message discards it after sending delivery acknowledgement.
In the second technique, the scheduled_delivery_time   is set to a date and time before today in the format “YYMMDDhhmmsstnn”. It was observed that the message was delivered, delivery acknowledgement was sent by the mobile device but the message was never displayed.

Read more

Tips for Better Mobile Security

"You need to take mobile device security just as seriously as you do for your PCs and laptops."

The more you do on your mobile device, the more you should be concerned about its security. This is especially true if you use it for work. Keep in mind, if your device is configured with your employer’s email or messaging server, they may already be implementing some of the security tips we’re going to discuss.

Tip No. 1 - Choose a mobile OS that supports encryption, oh, and use it: If you are truly concerned about the security of your mobile phone or device you should use a mobile operating system (OS) and device that supports hardware-based encryption, such as Apple’s iOS or RIM’s BlackBerry, for both internal and external storage. This means the data stored on it is protected even from the most advanced hacker. Without encryption it’s possible that someone could recover the data on the device even without your lock pin or password.

Full device encryption on current Android devices is limited and varies between manufactures. Motorola Mobility's business-oriented smartphones offers encryption capabilities on Android 2.3. Android 3.x includes an API to help developers offer encryption on tablets, which some currently implement. And in the next year, we should see Android 4.x tablets and smartphones support encryption. WhisperCore is a third-party encryption solution you may want to also keep your eye on. Beta versions are currently available for Nexus S and Nexus One.

Tip No. 2 - Set a lock pin or password: Enabling a password, whether it’s called a pin, passcode, or passphrase, is the first line of defense in protecting your privacy and security. It helps prevent others from picking up your phone or device and snooping around if it becomes lost, stolen, or just left unattended. It’s also usually required if encryption is enabled on the device.

If encryption isn’t supported by the OS you should still definitely require yourself to set a password. Though your data can possibly be recovered by determined individuals without them knowing the password, you’ll at least protect it from the causal snoopers.

Tip No. 3 - Enable auto-wiping of data: Most mobile OSes support automatic wiping of the device’s data after a certain number of incorrect passwords attempts. This is great if encryption isn’t supported by the device but it can actually be just as beneficial for encrypted devices. Because giving others unlimited guesses to your password makes it much more possible that they could get it right, and once that happens the data is decrypted.

Auto-wiping is natively supported by iOS, Windows Phone 7, and BlackBerry.

Android requires the use of a third party app, such as Autowipe or a security app as in the last tip.

Just remember to keep all your data regularly backed up and use a solution that lets you restore the data to a new device in case you can’t find the one you wiped.

Tip No. 4 - Setup remote tracking and management: Before your phone or device gets misplaced or stolen you ought to setup a remote tracking and management solution. Most let you see the device’s GPS location on a map, send audible alerts to help you find it, and display a visual message to tell others how to return it. They typically also let you remotely lock and/or wipe it before someone else gets their hands on it.

For iOS 4.2 or later, Apple provides a free service. For earlier iOS versions there’s the MobileMe service from Apple at $99 a year after the 60 day free trial.

For Android you have to use a third-party app, such as the security apps mentioned in the last tip.

For Windows Phone 7 Microsoft provides the free Windows Live for Mobile service.

For BlackBerry, RIM provides the free BlackBerry Protect service.

Tip No. 5 - Limit Wi-Fi hotspot usage: When you use public Wi-Fi hotspots that aren’t encrypted, all your Internet traffic is transmitted through the air and can be easily intercepted. The most important sites and services, such as banking websites, usually implement their own (HTTPS/SSL) encryption that protects their individual traffic. But most email providers and many social networking sites don’t; thus eavesdroppers can likely capture their passwords and traffic.

On the other hand most 3G, 4G, and other cellular data connections are usually encrypted by the carriers. Plus eavesdropping on these types of connections isn’t as popular. Therefore, when you’re out and about you should try to use the data connection rather unsecured Wi-Fi hotspots.

If you insist on using Wi-Fi hotspots, use those that provide enterprise encryption and 802.1X authentication, such as from T-Mobile and iBahn. Alternatively, consider using a VPN connection to secure your traffic from local eavesdroppers.

Tip No. 6 - Use an antivirus or security app: Viruses, malware, and hacking on mobile devices aren’t a huge issue now but they are becoming more of an issue. You should consider installing a security app to help prevent infections and intrusions. Most AV solutions also offer additional features, such as remote wiping, backup and locating.

AVG and NetQin provide free security apps for Android.

LookOut offers free apps for Android, BlackBerry and Windows Mobile.

Some paid options include McAfee WaveSecure, Kaspersky Mobile Security and Trend Micro Mobile Security.

Read more