Yes, if your computer gets infected by Urausy Lockscreen, it will get locked. Luckily, not forever! Avast protects you against it. In this blogpost we will introduce an infamous lockscreen called Urausy. We will look at its special anti-debugging and anti-reverse engineering tricks, at its communication protocol, and determine what the conditions (if any) are […]
デジタル署名を無効化することなく攻撃者が正規の Android アプリに悪質なコードをインジェクトできるマスターキー脆弱性が発見されたことは、今月の初めにお伝えしたとおりです。シマンテックは、悪用が容易であることから、この脆弱性がすぐに利用されるだろうと予測していましたが、残念ながらその予測のとおりになっています。
ノートン モバイルインサイト（何百というマーケットプレイスから Android アプリを採取して自動的に解析するシマンテックのシステム）によって、この脆弱性が実際に悪用されている初めての例が検出されたのです。シマンテックは、問題のあるアプリを Android.Skullkey として検出します。
今回、2 つのアプリが悪質な処理に感染していることが確認されました。どちらも、病院を検索して予約できる正規のアプリであり、中国の Android マーケットプレイスで公開されているものです。
図 1. 感染した 2 つのアプリのスクリーンショット
攻撃者は両方のアプリを取得して、デバイスのリモート制御、IMEI や電話番号といった重要な情報の窃盗、プレミアム SMS メッセージの送信などを可能にするコードを追加しています。また、いくつかの中国製モバイルセキュリティソフトウェアアプリがインストールされている場合には、ルートコマンドを使ってそれを無効にします。
図 2. インジェクトされるコードのスニペット
攻撃者は、この脆弱性を悪用して元の Android アプリを改変し、新しい classes.dex ファイル（Android アプリのコードを含むファイル）と、新しい Android マニフェストファイル（許可を指定しているファイル）を追加しています。
図 3. Android アプリのパッケージに含まれるファイル
攻撃者は今後も、この脆弱性を悪用して無防備なユーザーのデバイスへの感染を続けると予測されます。アプリは、信頼できる Android アプリマーケットプレイスからのみダウンロードするようにしてください。ノートン モバイルセキュリティを使用すると、他の脅威と同様にこの脅威からも保護することができます。また、Norton Halt（英語版）を使用すると、モバイルデバイスがこの脆弱性の影響を受けやすくなっている場合に警告が表示されます。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
Earlier this month, we discussed the discovery of the Master Key vulnerability that allows attackers to inject malicious code into legitimate Android applications without invalidating the digital signature. We expected the vulnerability to be leveraged…
Last weekend I made the unfortunate decision to purchase a turkey sandwich from a well-known sandwich shop. Five hours later I wasn’t feeling so well. In fact, I was violently ill for the entire weekend. I missed one of my son’s football games, a family gathering and the house went to absolute rack and ruin! Read more…
Nothing in life is free, and that’s especially true when it comes to mobile apps. Thousands of free apps are flooding the marketplace—most are legitimate and available at no initial cost. But they often come at the price of offering up data from your smartphone or tablet that you might not be aware of or Read more…
Q: I overheard my son telling his friend to message him on Path. What is Path and should I be concerned? A: Good question and hats off to you for paying attention to what your kids are doing online. Path is a new(er) social network app specifically designed for smart phones. It allows users to keep Read more…
Whether it is called a keylogger, spyware or monitoring software, it can be the equivalent of digital surveillance, revealing every click and touch, every download and conversation. A keylogger (short for keystroke logger) is software that tracks or logs the keys struck on your keyboard, typically in a covert manner so that you don’t know Read more…
For the last few months, Symantec has been observing pharmacy related spam attacks where spammers are using the legitimate Google Translate service to avoid anti spam filters.
Most of the samples received were sent from hijacked email addresses from popular free mail services.
The majority of the messages’ subject lines were promoting either online pharmacies or well-known tablets such as Viagra, Cialis and others. Furthermore, in an effort to make the spam immune to filters, several observed subject lines contained randomized non-English characters or words inserted at the beginning or end of the subject line.
Figure 1. Sample subject lines
The body of the spam message contains a Google Translate link as well as promotional text explaining the advantages of ordering medicines from online websites, there’s even a discount code included for the reader.
Figure 2. Sample spam message
The mechanism of the redirection is quite complex. After clicking the link, Google Translate is meant to get a second address embedded in the link, which then redirects to a pharmacy website.
In our sample the final destination was the following pharmacy site:
It is worth noting that previously spammers mostly used freewebs or URL shortening services in the second part of the link (redirection link), but recently they’ve taken advantage of country IDN top-level domains, especially Cyrillic .рф domains. In redirection links, Cyrillic domains are represented in Punycode.
The following is an example of a link as it presented in a spam mail:
Output from win-1251 decoding:
With Punycode decoding:
Symantec is successfully blocking the majority of variations of Google Translate redirection spam and is closely monitoring for any other inappropriate use of Google Translate services in spam email. This exploit is used in spam campaigns and has not, as yet, been observed being used in the distribution of malware.
For the last few months, Symantec has been observing pharmacy related spam attacks where spammers are using the legitimate Google Translate service to avoid anti spam filters.
Most of the samples received were sent from hijacked email addresses from popular free mail services.
The majority of the messages’ subject lines were promoting either online pharmacies or well-known tablets such as Viagra, Cialis and others. Furthermore, in an effort to make the spam immune to filters, several observed subject lines contained randomized non-English characters or words inserted at the beginning or end of the subject line.
Figure 1. Sample subject lines
The body of the spam message contains a Google Translate link as well as promotional text explaining the advantages of ordering medicines from online websites, there’s even a discount code included for the reader.
Figure 2. Sample spam message
The mechanism of the redirection is quite complex. After clicking the link, Google Translate is meant to get a second address embedded in the link, which then redirects to a pharmacy website.
In our sample the final destination was the following pharmacy site:
It is worth noting that previously spammers mostly used freewebs or URL shortening services in the second part of the link (redirection link), but recently they’ve taken advantage of country IDN top-level domains, especially Cyrillic .рф domains. In redirection links, Cyrillic domains are represented in Punycode.
The following is an example of a link as it presented in a spam mail:
Output from win-1251 decoding:
With Punycode decoding:
Symantec is successfully blocking the majority of variations of Google Translate redirection spam and is closely monitoring for any other inappropriate use of Google Translate services in spam email. This exploit is used in spam campaigns and has not, as yet, been observed being used in the distribution of malware.
After being in oblivion for a while, the Xpiro family of file infectors is back with a bang—and this time with some notorious capabilities. Not only does the new variant infect 32-bit files, it also has broadened its scope of infection to 64-bit …