News

Joker Malware Found In 24 Apps In Google Play Store

Posted on by Andy Miller

Security researcher Aleksejs Kuprins of CSIS cybersecurity services company has discovered 24 apps which have been available for download in the Google Play Store that contain ‘Joker’ malware.

What Is Joker Malware?

Joker malware is a spy and premium subscription bot that makes money by simulating clicks. If, for example, a Joker infected app is downloaded, the malware delivers a second-stage component which silently simulates the interaction with advertisement websites, and steals the victim’s SMS messages, their contact list and their device information.

One of the silent automated interactions with advertisement websites includes simulation of clicks and entering of the authorisation codes for premium service subscriptions.

One specific example of what Joker can do, given by Mr Kuprins on the CSIS tech blog is that in in Denmark, Joker can silently sign a victim up for a 50 DKK (6,71 EUR) per week service by automating interaction with a premium offer’s webpage, entering the offer code, waiting for a SMS message with a confirmation code and extracting it, and finally submitting the code to the offer’s webpage to authorise the premium subscription.

Which Apps?

The 24 apps harbouring the ‘Joker’ malware, which have been installed more than 472,000 times are: Advocate Wallpaper, Age Face, Altar Message, Antivirus Security – Security Scan, Beach Camera, Board picture editing, Certain Wallpaper, Climate SMS, Collate Face Scanner, Cute Camera, Dazzle Wallpaper, Declare Message, Display Camera, Great VPN, Humour Camera, Ignite Clean, Leaf Face Scanner, Mini Camera, Print Plant scan, Rapid Face Scanner, Reward Clean, Ruddy SMS, Soby Camera and Spark Wallpaper.

Only Targets Certain Countries

The good news is that ‘Joker’ malware only attacks targeted countries and that most of the infected apps contain a list of these targeted Mobile Country Codes (MCC) meaning that the victim has to be using a SIM card from one of these countries to receive the second stage payload.  The bad news is that the UK is one of those targeted countries.

Google On Top Of Things

Despite there being 24 apps identified so far, Mr Kuprins has reported that Google has stayed on top of things during his investigation and has been removing all the offending apps without the need for prompting.

Not The First Time

Back in January last year, Security researchers discovered 36 fake and malicious apps for Android that could harvest data and track a victim’s location, masquerading as security tools in the trusted Google Play Store.

What Does This Mean For Your Business?

Google Play is a trusted source for apps, and it’s worrying that hundreds of thousands of customers may have the affected apps from Google Play.  In this case, Google has responded relatively quickly and has deleted infected apps where they have been found.

The obvious advice to android phone users is to check the list of infected apps and delete any on your phone that match. If you think you may have been affected by Joker via an app it may be a good idea to check your Google Play account for any unauthorised subscriptions, check your credit card or bank statements as far back as June of this year, and let your contacts know that you may have been infected (because Joker steals your phone’s contact list).

To minimise the risk of falling victim to damage caused by fake apps, users should check the publisher of an app, check which permissions the app requests when you install it, delete apps from your phone that you no longer use, and contact your phone’s service provider or visit the high street store if you think you’ve downloaded a malicious/suspect app.

This latest discovery of infected apps on Google’s Play Store should prompt the company to make even greater efforts to police the apps that it offers there.

France Says ‘Non’ To Facebook’s Libra Cryptocurrency

Posted on by Andy Miller

France’s finance minister, Bruno Le Maire has said that the development of Facebook’s new Libra cryptocurrency will be blocked in Europe unless concerns over risks to consumers and to the monetary systems of countries can be addressed.

Libra – Announced in June

Announced in June this year and due to be launched in 2020, Libra is Facebook’s cryptocurrency which will enable payments to be made by a special phone app and by messaging services such as WhatsApp so that spending the new currency could be as easy and fast as texting.  Management of the currency, units of which can be purchased via Libra’s platforms and stored it in a digital wallet called “Calibra”.

In addition to Facebook, the Association has 27 other members/partners, all of whom will most likely have to accept Libra, including Mastercard, PayPal, eBay, Spotify, Uber, Vodafone, and a variety of charities such as Women’s World Banking.

For Use By The ‘Unbanked’

Facebook has promoted Libra as being targeted mainly at the 1.7 billion adults worldwide who do not have a bank account, and who use services such as payday loans although 1 million plus of these already have a smartphone, thereby enabling them to use the apps through which Libra can be operated.  This “unbanked” segment of the potential market contains mainly people from developing countries, a large proportion of which are women.

Why Does France Object?

In Bruno Le Maire’s speech at the OECD Global Blockchain Policy Forum 2019 he identified several reasons why France would consider blocking Libra in Europe, the main one being that monetary sovereignty of countries may be at stake from a possible privatisation of money e.g. because Facebook is a sole actor (company) with more than 2 billion users on the planet. Mr Le Maire also expressed concern that Libra’s digital credits could facilitate money laundering and terrorism.

Other concerns about Libra’s introduction include:

  • Possible risks to consumers (their personal data) in the light of Facebook’s sharing of user data with Cambridge Analytica.
  • Consumers may turn to cryptocurrencies like Libra during a time of national crisis, which could make it more difficult for governments to stabilise their economies, thereby making matters worse.
  • The need for Libra to meet regulations for consumer protection, money laundering and financing terrorism.
  • Libra uses blockchain, which many banks still consider to be an emerging technology that should be approached with caution.

Highlights The Need To Work Together

According to the head of policy and communications at the Libra Association, the concerns expressed by Bruno Le Maire highlight the need for the project’s backers to work together with regulators to make the implementation of the Libra project safe, transparent and consumer focused.

What Does This Mean For Your Business?

For Facebook, Libra is an opportunity to monetise another of its services, and an opportunity to diversify.  Even though Facebook has promoted Libra as a currency for use by the 1.7 billion people without bank accounts, it is more likely that Libra will gain more users with bank accounts in developed countries more quickly.  Also, some more sceptical commentators have noted that Libra may be less about money and blockchain but more about gathering more information about the identity of clients.

Even though Libra users are not intended to be businesses, if Libra does help the ‘unbanked’ this could have a knock-on effect in helping that segment of society to buy more goods and services, thereby helping businesses and the economy.

Libra looks set to face more scrutiny and attempts to make sure that it meets the regulation of countries that are worried by the possible shift in control from governments and central banks to big business that Libra could bring. This shift in control could have a number of effects on the business environment and the economies of countries if Libra proves to be popular.

Tech Tip – Canva

Posted on by Andy Miller

If you’d like a free, graphic design app that can help you to improve your business and social media communications then Canva may be the app for you.

Canva is a versatile graphic design app: full editor, Instagram story maker, video maker, video editor, logo maker and poster maker, enabling you to easily stay on brand and create some very professional logo and poster designs with your photos and videos.

Canva also provides a great way to design your Instagram Highlight cover and create a logo and banner for social networks (Facebook, Pinterest and Twitter).

You can get Canva on the Google Play Store and Apple’s App Store.

Report Shows That 99% of Cyber Attacks Now Involve Social Engineering

Posted on by Andy Miller

The Human Factor report from Proofpoint shows that almost all cyber-attacks, at some stage, involve the exploitation of human error in the form of social engineering.

What Are Social Engineering Attacks?

Social engineering attacks involve the manipulation and deception of people into performing actions such as transferring money to criminal accounts or divulging confidential information.

What Kind of Attacks?

The Proofpoint Human Factor report makes the point that as many as 99% of cyber-attacks now involve social engineering through cloud applications, email or social media.  Social engineering attacks can also involve cybercriminals making phone calls to key persons in an organisation.

Easier and More Profitable

These attacks are designed to enable a macro, or trick people into opening a malicious file or follow a malicious link through human error, rather than the cyber attacker having to face the considerable and time-consuming challenge of trying to hack into the (often well-defended) systems and infrastructure of enterprises and other organisations. Social engineering attacks are, therefore, easier, less costly, more profitable, and more likely to be successful than having to create an exploit to try and gain access to company systems.

Targets – “Very Attacked People”

Cybercriminals are looking for money and valuable data and information. The Proofpoint report, which was based on 18 months of data analysis collated from across the company’s global customer base, highlights the fact that the gatekeepers of money and data in target organisations become the “very attacked people” (VAP) i.e. the most often approached targets. These VAPs are often identified by attackers using information from sources such as corporate websites, social media, trade publications, and search engines.

Patterns & Routines

The report also revealed how attacks involving email messages can be made to mimic standard business routines and legitimate email traffic patterns e.g. downtime at weekends and spikes on Mondays.  Also, malware tends to be evenly distributed over the first three days of the working week, and attacks in the Middle East and Europe appear to be more likely to succeed after lunch.

What Does This Mean For Your Business?

The fact that many businesses and organisations are taking cyber defence seriously and have improved their system defences means that cybercriminals are moving into social engineering attacks.

Businesses and organisations can protect themselves against such attacks through staff training (particularly for guardians of funds and data), keeping anti-virus and online filtering up to date, using encryption e.g. VPNs for certain employees, having clear policies and procedures in place with built-in verification and authorisation for money and data requests, and being careful about publicly-visible employee information that could be used to target key staff members.

AI Mimics CEO’s Voice To Steal Over £200,000

Posted on by Andy Miller

A recent Wall Street Journal report has highlighted how, in March this year, a group of hackers were able to use AI software to mimic an energy company CEO’s voice in order to steal £201,000.

What Happened?

Reports indicate that the CEO of an unnamed UK-based energy company received a phone call from someone that he believed to be the German chief executive of the parent company.  The person on the end of the phone ordered the CEO of the UK-based energy company to immediately transfer €220,000 (£201,000) into the bank account of a Hungarian supplier.

The voice was reported to have been so accurate in its sound, that the CEO of the energy company even recognised what he thought was the subtleties of the German accent of his boss, and even “melody” of the accent.

The call was so convincing that the energy company made the transfer of funds as requested.

Fraudster Using AI Software

The caller, who was later discovered to have been a fraudster using AI-base voice-altering software to simulate the voice of the German boss, called 3 times.  In the first call, the fraudster requested the transfer, in the second call they (falsely) claimed that the transfer had been reimbursed, and in the third call the fraudster requested an additional payment. It was this third call that aroused suspicion, partly based on the fact that the telephone number appeared to indicate that the caller was in Austria and not Hungary.

Money To Hungary, Mexico and Beyond

Unfortunately, the money had already been transferred to a Hungarian account after the first call, and it has since been discovered that money was immediately transferred from the alleged supplier’s Hungarian bank account to an account in Mexico, and then further disbursed to accounts in other locations, thereby making it very difficult for authorities to follow the trail.

What Sort of Software?

The kind of software used in this attack may have been similar in its output to that demonstrated by researchers from Dessa, an AI company based in Toronto.  Dessa has produced a video of how this kind of software has been able to produce a relatively accurate simulation of the voice of popular podcaster and comedian Joe Rogan – see: https://www.youtube.com/watch?time_continue=1&v=DWK_iYBl8cA

What Does This Mean For Your Business?

It is known that cybercriminals, deterred by improved and more robust enterprise security practices have decided to look for human error and concentrate more on social engineering attacks, a category that this voice simulation attack (via phone calls) fits into. The fact that this attack has taken place and been successful shows that some cybercriminals are already equipped with the computing power and most up-to-date machine-learning AI technology that they are clearly capable of using.

This means that companies and organisations (particularly larger ones), may now be at risk of facing more sophisticated deception and phishing attacks. The AI company Dessa has suggested that organisations and even individuals could expect to face future threats such as  spam callers impersonating relatives or spouses to obtain personal information, impersonations intended to bully or harass, persons trying to gain entrance to high security clearance areas by impersonating a government officials, and even an ‘audio deepfake’ of a politician being used to manipulate election results or cause a social uprising.

Companies should try to guard against social engineering attacks by educating all staff to the risks and having clear verification procedures (and not just relying on phone calls), tests, and chain of command authorisation in place for any requests for funds.

Record Levels of Investment in UK AI

Posted on by Andy Miller

A Tech Nation Report has shown that AI investment in the UK reached record levels in the first six months of the year making it the third biggest market in the world for AI investment, just behind the US and China.

Surge

Crunchbase figures show that AI investment in the UK reached £859.29m in just the first six months of this year, compared to £825.85m for the whole of last year.

This latest surge in AI investment marks five years of consecutive growth and a massive six-fold increase between 2014 and 2018.

Also, AI start-ups in the UK raised almost double the amount of those in the rest of Europe combined.

Why The High Investment Levels?

The AI investment growth can be attributed to several factors, not least:

  • A rise in the number of start-ups with 50 or fewer employees.  These account for 89% of the UK’s AI companies.
  • The Department for Digital, Culture, Media and Sport (DCMS) £1bn AI sector deal to put the UK at the forefront of the AI industry, including almost £300m of new private sector investment, as part of the UK government’s Industrial Strategy (announced November 2017).  This initiative was intended to establish partnerships between government and industry in order to increase productivity.

Challenges

Even though the figures show that the investment trend is going in the right direction, UK-based companies hoping to make the most of AI face some clear challenges including:

  • A tech skills shortage and a so-called “brain drain” in the UK and across Europe as top university tech students are tempted to work further afield e.g. in the U.S.  Also, Brexit fears in the UK have deterred some European specialist tech workers from staying.
  • Challenges in scaling up their businesses so that they can become competitive in the global market.

Small Pool

These challenges to the growth of AI companies mean that there is only a relatively small pool of UK AI-focused companies that have been able to make the step to scaling-up and competing on the world stage.  AI companies in other countries such as China, by contrast, tend to have larger workforces e.g. 53% have more than 50 employees.

There is also a relatively small pool of people in the world who can contribute to cutting-edge AI research.

Benefits and Threats of AI

AI offers many benefits to businesses such as cost and time savings (greater productivity and reduction in errors), the ability to make better use of resources (AI handles repetitive jobs and bots handle common questions).

Many people are, however, concerned that the growth in AI will mean a loss of jobs e.g. Gartner figures show that AI could eliminate 1.8 million jobs.  It should also be remembered that AI could create 2.3 million jobs by 2020 (Gartner) and that if the large-scale introduction of AI follows the pattern of temporary job losses followed by recovery and business transformation, the combination of human and artificial intelligence could provide exciting news competitive advantages for businesses.

What Does This Mean For Your Business?

The investment in AI within the UK is promising for the tech sector, the economy, and for the future of the UK in the global tech market, provided that UK-based AI companies can tackle the challenges of being able to scale-up and successfully find the human tech talent at a time of skills shortages.

AI may cost jobs in the shorter term, but it may also bring new strengths and opportunities to businesses and could transform the way we are able to work for the better.

Microsoft’s Phone App Challenge to iMessage and FaceTime

Posted on by Andy Miller

Reports from online tech commentators indicate that Microsoft will soon be enhancing its Your Phone app with the ability to make phone calls from a desktop PC, thereby making the app a serious challenger to Apple’s iMessage and FaceTime.

The Your Phone App

Microsoft’s Your Phone desktop App connects your phone to your PC thereby giving you access to your phone’s notifications, photos and texts while working on your PC. Giving the desktop Phone App the details of your phone (Android or Apple, phone number) means that you receive a download link to the ‘Phone Companion’ via SMS text.

Installing the Phone Companion on your mobile enables you to sync your phone with your PC e.g. an Android phone with Windows 10 PC.  This gives instant access to your phone on your PC so that you can reply to texts at your PC and instantly receive photos on your PC that have been taken on the phone.

Making Calls – Challenging Apple’s iCloud Integrations

The addition of being able to dial a number, search your phone contacts and make a call directly from your PC is an important enhancement that could make Microsoft’s Your Phone desktop App a serious challenger to Apple’s iCloud integrations on macOS.

Apple Mac users can currently use these to send messages from their desktop using iMessage and can also make voice and video calls using FaceTime.

‘Use Phone’ Button

The enhanced Your Phone App from Microsoft will include a ‘Use Phone’ button that can send a call back from the PC (microphone and speakers) to the handset,  thereby enabling more privacy and/or shutting out any distracting background noise e.g. keyboard noises and noises from home working.

Who?

A full-feature Your Phone App would most likely be of maximum value to those workers who need to be in front of the desktop for long periods of time with minimal distractions although, arguably, messages and notifications popping up on the screen could be less easy to ignore than if they’d been quietly arriving on the phone in corner.

The Your Phone app could also be of use to workers in a situation where too much obvious interaction with their handset in the workplace is frowned upon and where visual monitoring and supervision is particularly intense.

What Does This Mean For Your Business?

For Microsoft, this improvement to the Your Phone desktop App, which has been around for some time, gives it much greater potential value to users and gives Microsoft another way to seriously compete with its rival Apple.

For any business users who are typically tied to the PC for most of the time the ability to handle all phone matters on the desktop adds value in terms of convenience, possible time savings, and fewer distractions.

Leaving Your Job? Don’t Take Personal Data With You Warns ICO

Posted on by Andy Miller

The Information Commissioner’s Office (ICO) has warned those retiring or taking a new job that under the Data Protection Act 2018, employees can face regulatory action if they are found to have retained information collected as part of their previous employment.

Old Investigation

The renewed warning was issued following the regulator concluding its dealings in an old investigation of two (former) police officers interviewed (by the media) about an historic case they’d worked on as serving officers involving an MP, and had been accused of disclosing details about the case to the media.

In this case, the investigation appears to have related to police handling of personal data such as notebooks and the fact that measures need to be put in place to ensure that these are not retained when officers leave the service.

The ICO investigation, brought about under the previous Data Protection Act 1998 legislation (because the alleged disclosure occurred before the DPA 2018 and GDPR’s introduction) may have resulted in no enforcement action being taken against the two officers, but prompted the ICO to issue a reminder that data protection laws have been toughened in this area.

“Knowingly or Recklessly Retaining Personal Data”

The warning in the ICO’s recent statement is that the Data Protection Act 1998 has since been strengthened through the Data Protection Act 2018, to include a new element of knowingly or recklessly retaining personal data without the consent of the data controller (see section 170 of the DPA 2018).

The only exceptions to this new part of the new Act are when it is necessary for the purposes of preventing or detecting crime, is required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or whether it is justified as being in the public interest.

Retiring or Taking a New Job

The ICO has warned that anyone who deals with the personal details of others in the course of their work, private or public sector, should take note of this update to the law, especially when employees are retiring or taking on a new job. Those leaving or retiring should also take note that they will be held responsible if the breach of personal data from their previous employer can be traced to their individual actions.

Examples

Examples of where the ICO has prosecuted for this type of breach of the law include a charity worker who, without the knowledge of the data controller, Rochdale Connections Trust, sent emails from his work email account (in February 2017) containing sensitive personal information of 183 people.  Also, a former Council schools admission department apprentice was found guilty of screen-shotting a spreadsheet that contained information about children and eligibility for free school meals and then sending it to a parent via Snapchat.

What Does This Mean For Your Business?

This latest statement from the ICO should remind all businesses and organisations, whether in the private or public sectors, that reasonable measures or procedures need to be put in place to ensure that anyone retiring or leaving for another job cannot take personal details with them that should be under the care of the data controller i.e. you and your company/organisation.

Failure to take this facet of current data law into account could result in fines from the regulator for those individuals responsible, potential legal action from the victims of any breach against your organisation, some bad and potentially damaging publicity, and costly and long-lasting damage to reputation.

Tech Tip – WiFiAnalyzer

Posted on by Andy Miller

If you’d like to optimise your Wi-Fi signal by being able to quickly analyse Wi-Fi networks directly from your Android device, measure signal strength and identify crowded channels, Wi-Fi Analyzer may be the app for you.

This open-source, free app, which has no-adverts and claims not to collect any personal information, uses as few permissions as possible to perform the analysis and does not require access to the Internet.

WiFiAnalyzer is available from the Google Play store.

Student Textbooks Malware Threat

Posted on by Andy Miller

Kaspersky’s blog is warning students who are about to go back after the summer holidays to beware of the risk of malware that’s masked as textbooks and essays online.

Students Targeted

According to Kaspersky, K-12 and college students who may want to save money on textbooks by seeking online essays and study materials may end up unwittingly downloading malware instead.

A study by the security company of school and student-related filenames over the past academic year has revealed that out of 356,000 attempted attacks on Kaspersky users, 233,000 cases involved malicious essays that were downloaded to computers owned by more than 74,000 people (which the company claims its software blocked).

Kaspersky’s figures indicate that 122,000 of those attacks were by malware disguised as textbooks which more than 30,000 users tried to open.

Targeted Popular and Less Popular Subjects

The study revealed that cybercriminals haven’t just been focusing on popular subjects for attacks. For example, even though English textbooks hiding malware had 2,080 attempted downloads and maths textbooks hiding malware had 1,213 downloads, malicious textbooks for natural sciences also manage to fool 18 users.

The Four Most Popular Types of Malware

Kaspersky lists the four most popular types of Malware attacks disguised as online study materials as:

1. School spamming using the Stalk worm

This has claimed the greatest number of victims and is the preferred method by which the Worm.Win32 Stalk.a worm is spread.  Once downloaded to a school computer Stalk penetrates all devices that are connected to it, will infect USB sticks used by students, will spread across the whole network, can spread to the email contacts of students, and can download other malicious applications to the infected device

2. Win32.Agent.ifdx malware downloader

This downloader program is disguised as textbooks or essays in DOC, DOCX or PDF formats. Once launched it opens a text file so that the victim does not realise that anything suspicious is going on, but it is designed to download many other bad things onto the victim’s computer which can be modified to become cryptominers, banking trojans (to steal; bank details) and ransomware.

3. The WinLNK.Agent.gen downloader

WinLNK.Agent.gen downloader is hidden in archives e.g. zip or rar files and uses a shortcut to a text file to open the document itself and launch the attached malware components. This can result in cryptominers, adware, and more damaging programs being loaded onto and slowing down the victim’s computer.

4. The MediaGet torrent application downloader

This is disguised by ‘Free Download’ buttons and will download a torrent client that the user does not need.

What Does This Mean For Your Business?

Colleges and schools are known to be popular targets for cybercriminals because they have large numbers of users spread across many different departments, and sometimes across different facilities, making admin and IT security very complicated.  Also, valuable intellectual property, student and staff personal data, and the chance to use the processing power of many computers within their systems can make schools and colleges tempting targets for cybercriminals.

Part of the prevention of the kinds of attacks identified by Kaspersky can be achieved by educating students (and staff) about threats, and how to spot them and deal with them, as well as making sure that antivirus protection and patches are all up to date across school and college systems.

Kaspersky’s advice to students for avoiding the malware threat includes searching for in books you need in physical or online libraries, paying attention to what type of site is hosting the textbook download, not using outdated versions of operating systems and other software, being wary of email attachments (even those sent from acquaintances), and paying attention to the download file extensions e.g. don’t open .exe files.