Traditionally, the barriers of entry for developers in the Android ecosystem have been low to get their apps placed in the official Market. This was by design, allowing Android to sprint past other smartphone platforms in adoption rates, since many apps that users wanted were likely to be there before they hit other platforms. The downside is that app authors choosing to bundle malicious, or borderline malicious apps had an easier time with distribution.

By contrast, the iPhone ecosystem represented a more closed, vetted, and more expensive environment for developers to launch their apps. This resulted in steady growth, but the more rigid process of an app making it to their official App Store deterred the more unsavory app developers from spending the extra effort to circumvent controls. In short, it was easier to spread bad things, or borderline bad things on the Android smartphones.

The new effort, called Bouncer, aims to silently scan the marketplace for rogue and borderline apps, largely transparently to the user. When a new app upload is attempted by the developer, Bouncer will do a preliminary scan to determine whether it acts malicious, or borderline.

Hiroshi Lockheimer, VP of Engineering, Android, explains in his blog on the subject that the effort “provides automated scanning of Android Market for potentially malicious software without disrupting the user experience of Android Market or requiring developers to go through an application approval process.”

Bouncer aims to run each app in a simulated cloud-base environment to watch for malicious activity. It will also scan for changes in existing apps. If it detects an app has changed, it will red flag it for scanning, keeping existing apps (hopefully) more malware-free. Additionally, developers exhibiting a pattern publishing malicious apps may be blacklisted. Is it working? In the second half of 2011, Mr. Lockheimer says “we saw a 40% decrease in the number of potentially-malicious downloads from Android Market,” so progress seems positive.

With an estimated 11 million apps available for Android, and a year-over-year growth rate of 250% according to Mr. Lockheimer, there’s a lot of scanning to be done. But this also speaks toward the success and ubiquity of the platform, and perceived value to users. In that department, Android has done quite well indeed.

Update 2: just to clarify, Aleksandr and Eugene should get the credit for the analysis, as is usual with our collaborations. I'm just the scribe/editor round here.

Update 3: you can get ESET's stand-alone cleaner for Win32/Olmarik here.

[ New data from my colleagues in Moscow.]

This week we received an untypical sample of Win32/Olmarik.AYD (TDL4) from Mila (of the contagiodump blog). We have already spent a long time tracking TDL4 bootkit family (The Evolution of TDL: Conquering x64) and this time we are seeing key modifications to the dropper and hidden file system. In the dropper we find some interesting mechanisms for privilege escalation: this is something we haven’t seen before in Win32/Olmarik droppers. The first interesting discovery is that the dropper downloads and executes a legitimate Adobe Flash Player installer to be launched in the context of the “trusted” application. In the November of the last year Win32/Sirefef (ZeroAccess) used the same technique to implement a DLL hijacking attack with the msimg32.dll module.

This time TDL4 uses the ncrypt.dll module for implementing the attack and to install a bootkit on the system with trusted process privileges. We wonder how long this bug will be on our tail?

The next interesting finding is its mechanism for escalating privilege using a COM Elevation technique trick on 64-bit systems.

Everyone remembers the trick for bypassing HIPS with the AddPrintProvidor() WinAPI function, but this time the technique relies on a new function AddMonitor() for loading the malicious module in the address space of the trusted system process.

The names of all stored modules have been changed in the hidden file system. The hidden container is now stored without encryption. This modification may have been made in order to bypass cleaning and detection algorithms in security software.

Next, some small changes have been made to the fake kdcom.dll module (Win32/Olmarik.AWO): before this update the malicious driver was loaded in a modified KdDebuggerInitialize1() using the ExQueueWorkItem() system function, in order to create the system worker thread and give control to the malicious routine.

In the latest version the modified KdDebuggerInitialize1()function call straightaway sets a notify routine. It’s possible that this modification is also intended to bypass static signature detection by security software.

The new name for the configuration file is “Purple Haze”, on account of the  inclusion of a header string from of the song same name by Jimi Hendrix. :)  

Only one encrypted file is stored in the hidden file system, the file containing C&C domain names. The encryption algorithm used is RC4 with the constant key “phs [file name of encrypted file]”.

And finally, we would like to mention a string constant applied to the pdb file path within compiled modules. We have already written (Evolution of Win32Carberp: going deeper) about how this string can disclose some information about the projects path on the developer’s computers. J This time, however, the developer has used randomly generated names for his projects.

I foresee a whole bunch of Hendrix song titles in forthcoming security blogs. ..

Aleksandr Matrosov
Eugene Rodionov
David Harley

You may recall that a company called CarrierIQ recently became the center of attention after a user found their application quietly installed on his Android, seemingly behind the scenes. He characterized the software as a rootkit, because it seemed to be capturing low-level information as it was being entered by the user, and was there without his knowledge. The story grabbed its share of the headlines. Later, as CarrierIQ explained in more detail what their software did and for whom–gathered diagnostic data for mobile carriers–some of the headlines subsided.

But the whole CarrierIQ incident raised concerns among the public about what else might be going on behind the scenes on their Androids, iPhones, and other mobile devices. Naturally, users want to know and understand what is being collected, by whom, and what was being done with Personally Identifiable Information (PII) often found on mobile devices. And a lot of people want a requirement in place that capture and/or transfer of such data only happens with their explicit consent.

This has prompted lawmakers to take note. Now Democratic Representative Edward Markey has drafted a “Mobile Device Privacy Act” and placed it before the House, where it will begin the protracted journey toward becoming law. This can be a lengthy process, but it sends a signal to the industry that legislation may be coming. Whether this particular iteration of the bill becomes a law remains to be seen, but expect more activity surrounding privacy protection and security for the smartphone ecosystem going forward.

In the meantime, it’s a good idea to take your smartphone security into your own hands by being careful what apps you install, and where they came from. Since your Android (or other smartphone) packs such an amazing amount of processing power, it acts more and more like the traditional OS you have on your laptop. Because malware authoring is a numbers game, expect more malware to be released as the platform’s adoption increases in the coming months. Also, some security vendors are releasing security suites for various smartphone platforms (ESET included), for those who prefer an always-on solution to keep an eye on the security of their devices. In the end, though, there’s no substitute for keeping your eyes open for scams and protecting yourself through your own awareness.

When you activate Login Approvals and Login Notifications on your Facebook account–using the steps listed below–you are required to give a name to any device you use to access Facebook. This enables Facebook to notify you whenever a new device logs into your Facebook account, using an email like this:

In this case, I was setting up Facebook access on my new Kindle Fire tablet. As you can see, I was doing this in San Diego on New Year's Day. Note that Facebook provides a link to click if you do not recognize the device as one you have approved. The approval of a new device requires a one-time security code that Facebook sends to your mobile phone as a text mesage. Here's what that looked like on my iPhone (yes, that's my dog in the background).

To register the Kindle Fire as an approved device on my Facebook account I had to enter the code from the SMS message when prompted to do so by Facebook on the Kindle.

In computer security we call this technique "out of band authentication" because credentials are supplied through a different communication channel or band from the system to which you are authenticating. While out of band authentication is not impossible to defeat, it adds a significant hurdle to someone trying to compromise your acount.

Suppose I had received the email above but did not recognize the device name and/or location. I would then be able to investigate what was happening and take steps to protect my account (you can choose to get notifications via email or SMS or both).

Setting up Login Approval on Facebook is relatively straighforward once you know it is there. The only prerequisite is that you have a mobile phone registered to your Facebook account (something you can do in your Account Settings). The following diagram shows you the steps required to activate Login Approvals. After activation you will be prompted to approve each of your devices the next time you use them to access Facebook. You should also make sure that the Login Notifications setting is also enabled.  

Overview

Passwords have become a way of life for every computer user. They are one of the most popular methods of user authentication on the Internet. They are used to check emails, access bank accounts, watch movies, play games, and a lot more.

The world would be lot simpler if we could safely use the exact same password across all Web sites. Unfortunately with the rise of phishing attacks, having a single password is very dangerous. In a phishing attack, a fake Web site can impersonate your email provider. If you provide your password thinking that it’s business as usual, you have just given your email password to a hacker . If that password is also your bank password it can be used tocause financial damage. Another way hackers get your passwords is to use a lot of computing power to guess it--a brute force method of trying out various combinations of letters and numbers.

Web sites that realize these risks have deployed measures to protect their users from such attacks. The use of a strong password is encouraged, and is in some cases mandatory. Typically Web sites define strong passwords as having a certain length and a mix of upper- and lowercase letters and special characters. Some Web sites force users to change their passwords on a periodic basis. A few deploy methods where you have to select a picture that you recognize, so that you can ensure you are really on the correct Web site. These are very good measures that help protect their users.

The challenge with such efforts is there are no standards rules across Web sites. Users are left with trying to figure out how to cope with the variety of rules and may feel forced to take a few shortcuts, like using the same strong password on several Web sites. Another challenge with strong passwords is actually remembering them. Lots of users actually write down the passwords on a sticky note and keep it around their computers for easy access. This obviously is not a safe practice, but is understandable.

At Norton we have been helping users solve this exact challenge with our Norton Identity Safe feature. Users of Norton Internet Security and Norton 360 have been using this feature on their PCs to keep their passwords and identity safe.

With the introduction of the standalone version of Norton Identity Safe, we are not only providing a way to access your securely stored passwords and personal information from any computer, but are providing a means to do so from your tablets and mobile phones. The mission of Norton Identity Safe is to travel with you and continuously remember complicated passwords whenever and wherever you need them.

How does it work?

As you are browsing the Internet on your PC, tablet, or mobile phone, Norton Identity Safe will automatically fill in your user name and password to log you in to your email, bank, etc. Here are few details of how Norton Identity Safe works internally.

On a PC, browser plugins/extensions for Internet Explorer, Firefox and Chrome are installed. This browser presence allows Identity Safe to see what website users go to & help fill the passwords automatically. When a user logs into a website for first time after installing Norton Identity Safe, these plugins/extensions detect that and prompt the user to save the login information into the database (aka vault).

Mobile Apps are able to download the vault and make them available to the users. In the current incarnation, Mobile Apps will not beable to capture any new logins. You need to setup the product on a PC and then use the product on Mobile Apps.

It’s all about the vault

The vault is a database where all your passwords and confidential information and notes are securely stored. With Norton Identity Safe Standalone, your vault is created in the cloud and automatically made available on mobile devices. Once you have a vault created, you have password freedom.

Getting Started

Getting password freedom starts with installing NortonIdentity Safe on your PC and creating a vault. It’s a simple process of providing a Norton Account and creating a strong password for access to your stored passwords.

1. Download the PC software from https://identitysafe-beta.norton.com/ and start the Install.

2. Provide the email address you use for your Norton Account. If you don’t have a Norton Account, enter the email address you want to use to create one.

a. If you already have Norton Account, the installer will ask for your password.

b. If you don’t have a Norton Account, to the installer will provide a screen where you can create one.

3. Create a strong vault password. A simple list shows if you have met the criteria.

When you first get started, you will not have any passwords stored into your vault. As you normally visit Web sites where you log in, Norton Identity Safe will ask your permission to save your user names and passwords in your vault. Once they are saved in the vault, you will not have to remember them anymore. Let’s look at a scenario:

1. User visits gmail.com on a PC and provides a user name and password.

2. Norton Identity Safe asks the user if they want to save the user name and password for gmail.com.

3. If the user says Yes, Norton Identity Safe saves them securely in the vault.

4. The next time the user goes to gmail.com, Norton Identity Safe fills in the user name and password for gmail.com automatically.

5. The user never has to remember their gmail.com login again.

Passwords anytime, anywhere

Once you are have your passwords saved by Norton Identity Safe, you can fully realize the convenience it provides when you browse on your mobile devices.

I want my passwords on my phone and tablet

Norton Identity Safe provides an App for the Apple iPhone and iPad as well as for Android phones and tablets. All you have to do is download them from the Apple or Android App store and set them up using thesame account you used on your PC. This links the App with the vault that you have created and immediately downloads all the passwords to your mobile device. You can start using them without typing a single additional password.

I am at my friend’s place

Say you are visiting a friend and you need to check your emails; you are not carrying a device that has Norton Identity Safe installed on it. No reason to worry because Norton Identity Safe travels with you. All you have to do is log on to https://identitysafe-beta.norton.com/ and you will be able to access your passwords.

Other important features

Home Page

Your Norton Identity Safe home page is where all of your logins, cards, and notes are visually represented. It’s a good place to see what you have saved and change any settings to the product. It’s recommended that you set this as your browser’s home page so that your logins are readily available every time you open the browser. If you choose not to make it your homepage, it can be easily accessed from the Norton Toolbar menu.

Additionally, the home page has quick links to get to the sites from which you can download the mobile Apps. It’s highly recommended that you download these Apps if you own an iPhone, iPad, or Android device.

Safe Web – Safe browsing

Norton Identity Safe also includes Safe Web--a feature that protects you from going to malicious Web sites. As you are browsing, it shows you whether the Web site is safe or not. This protects you from phishing attacks and Web sites that might be trying to steal your passwords.

iOS and Android Apps provide a full blown browser. It provides a safe browsing environment making sure users are protected from malicious websites and makes sure that the search results show the safety rating so users know if a site is bad even before they visit it.

Share Via

If you share URLs, you can use Share Via to do so with the confidence that you are not accidently sharing something with your friends and family that will potentially infect their computers. With one click you canshare a Web site via popular social networks and email providers right from the toolbar.

Norton Internet Security Customers

Norton Internet Security 2012 customers have access to the cloud-based Norton Identity Safe and which means you already have the PC client of Norton Identity Safe already installed. If you do not have the 2012 version installed, you can download it from http://updatecenter.norton.com/ManualUpdate/Index?&NUCSID=2&NUCVER=2011. You can immediately take advantage of the mobile Apps and access all the logins that you saved on your PC from your mobile devices.

We are looking forward to your feedback. You can post it on the Norton Forum. You can download the product from https://identitysafe-beta.norton.com/.

This month we discovered some new facts relating to Win32/Carberp trojan activity. We have spent a lot of time writing about Carberp already, but interesting information is still coming to light. The first interesting information to attract our attention recently concerned stealing money from Facebook users. Before then we hadn’t seen Carberp activity targeting social network users. The scheme used here for financial fraud is simple: if the victim attempts to log in to Facebook, he sees instead a fake Facebook page displaying the message “Your Facebook account is temporary locked!”

Figure 1: Fake Facebook Lockout

The fine print tells the victim to enter details of a "20 euro Ukash voucher" which can be purchased at ukash.com, assuring the victim that "20 euro will be added to your Facebook main account balance." If the victim enters  information considered to be invalid – i.e. doesn’t take the hint and supply details for a 20 Euro Ukash voucher to “confirm verification” – then the following warning message is displayed, insisting that a valid Ukash voucher number be entered:

Figure 2: Demanding e-Cash

This sample of Carberp doesn’t include bootkit code, but in user-mode the injected module looks the same as the latest sample that does include the bootkit (http://blog.eset.com/2011/12/04/carberp-blackhole-growing-fraud-incidents). The most interesting detail of this behavior is that this is not a new version/modification of the Carberp trojan, but simply a special configuration file that contains the full html code for the fake Facebook page. The decrypted configuration file contains only one web-injection rule for Facebook: *//*facebook.com/*

Figure 3: Faking Facebook

According to our data Carberp’s main activity is confined to the region of Russia and the former Soviet republics, and this activity centered on fraud targeting the major Russian banks and stealing money from RBS (Remote Banking Service) systems. Figure 4 shows the directory loaded with fresh files to introduce web-injects into online banking systems from the C&C panel:

Figure 4: Web-Injects

Up to now we hadn’t seen Carberp activity targeting the users of social networks, but it’s not so hard to add this functionality by introducing changes into the updated configuration file. Carberp intercepts many system functions and fraud functionality depend only on the rules for web-injects run from the configuration file or from special plugins. The Russian Federation is not the only country where this malware family is active. Up to now, we have seen instances of fraud attempts apparently related to the following banks based in non-Russian regions: Bank of America, CityBank, HSBC, CHASE, Nordea. But as before, the Russian Federation is the main region targeted by the Carberp attacks.

In early December, we noted an increase in the number of detections in the territory of Russia and the former Soviet republics (http://blog.eset.com/2011/11/21/evolution-of-win32carberp-going-deeper). But this trend can be seen in the statistics for December 2011 and late January 2012:

Figure 5: Carberp Detection in Russia

The Russian Federation is the country where the largest number of installations of Carberp has been seen, as confirmed by the statistics below:

Figure 6: Global Infection Statistics

Another interesting fact concerns a new DDoS plugin (Win32/Mishigy.AB) for Carberp. This DDoS plugin was developed in Delphi 7 and based on the network components from the Synapse TCP/IP library. Synapse components are very popular among cybercriminals for the creation of DDoS bots. A memorable example of a popular DDoS bot family based on this component is Win32/Delf.PYI (also known as a Dirt Jumper bot). The DDoS module provides the following types of attacks:

• HTTP/HTTPS attacks
• GET/POST attacks
• download flood attacks

In order to bypass DDoS prevention systems multiple types of user-agents and legitimate web resources are used in the referrer string.

Figure 7: Bypassing DDoS Prevention Systems

Carberp is one of the biggest botnets in Russian Federation and total number of active bots is estimated to number millions of infected hosts. In the hands of the Carberp cybercrime group the DDoS module will be an effective means of attacking cybercrime groups, competing for the profits from malicious exploitation of online banking.

Our research continues …

Aleksandr Matrosov
David Harley

In the past, the 5th Amendment defense has been a standard response to law enforcement requests to decrypt devices. Apparently, PGP Destop Encryption has proven more than trivial to decrypt without the passphrase, much to the chagrin of law enforcement bodies throughout the U.S. (and world). If a forced decryption ruling does prevail, the court will have more latitude to compel decryption of devices and data by an accused person, providing a stronger precedent for less fettered access to protected data, to the chagrin of many privacy pundits.

At its core, the argument harkens back to the “Lock vs. Safe” argument, where a strongbox key can be considered physical evidence, and therefore is subject to subpoena, but a combination to a safe can be considered a “product of the mind” and is, therefore, exempt from subpoena. In this case, Ms. Fricosu’s passphrase might be found to be a “product of the mind”, making it difficult to compel her to produce it.

It will also be interesting to note whether Ms. Fricosu will be “able to remember” the passphrase. If she were not, it would be difficult to determine whether or not she had simply forgotten, or only claimed to.

The Electronic Frontier Foundation (EFF) has spoken vociferously in the past about the issue, and can be expected to weigh in as the case progresses.

The case also speaks to the high level of security provided by PGP. We frequenty read news stories of organizations being hacked, but PGP protection seems to make data access – good or bad – much more difficult.

Protecting your digital information with strong encryption will make it much more difficult for bad guys to get at. Also, encrypting your data erects an additional barrier to unauthorized access. If someone gains access to your encrypted media you may be alerted to attempts to access it, since they would need the passphrase to do so.

Note that there are ways to avoid getting hurt by these scams, including the blocking of forged and malicous websites by your web browser (a good reason to use a current, up-to-date browser). Of course, attempts to infect your computer should be prevented by your antivirus software (sometimes called anti-malware).

If you see examples of this type of scam, please forward them to askESET@eset.com so that we can investigate further. Thank you!

For further coverage of this topic, check out this NBC story.

Of course, it's up to you whether you actually report it, but it's evidently a bad idea to click on links in messages along the lines of this one:

wooow now I have seen how many hours I spend on Facebook…to find your time click here >

Evidently a far more effective hook than I'd have thought,…

According to the detailed Facecrooks description, the link leads to a malicious Facebook page that exposes you to several rogue Facebook apps and Profile Peeker scams. Going along with it will not only result in your friends being spammed with scam messages, but expose your FB data to other misuse. If you've already been bitten by one of these, the Facecrooks article makes some suggestions as regards how to fix it.

David Harley CITP FBCS CISSP
ESET Senior Research Fellow

According to Justice Commissioner Viviane Reding, “Companies that suffer a data leak must inform the data protection authorities and the individuals concerned, and they must do so without undue delay,” and she hopes breach notifications will occur within 24 hours. The new bill also hopes to bring increased sanctions with it for reporting delays, though exact details remain to be sorted out during the next week.

The U.S has a patchwork of notification legislation that varies state-by-state, with some states like Massachusetts taking a very strong stance. Expect other states to beef up their reporting requirements in the near future, in response from consumers and lawmakers alike.

In the meantime, it’s a good exercise to plan for data breach drills at your organization. Internally it will help highlight potential weak links in the security chain long before potentially being trotted out to the press and customers as an uncomfortable spectacle. If you set aside a certain evening to run a drill every 6 months or so you’ll be far more prepared than your competition, and will have a much higher chance of staying out of the headlines altogether for data breaches. Setting aside a couple nights a year for your staff will cost far less than the cheapest data breach recovery, so it’s money well spent. It will also help both your organization and its customers sleep more soundly at night, knowing the steps you are taking to protect both groups.