Android Phone Tips And Tutorial

NC State researchers worked with mobile security vendor NetQin and discovered that Ginger Master wrapped malicious code around a jailbreak exploit for Android 2.3 devices. The information stolen includes the user identifier, SIM card number, telephone number, IMEI number, IMSI number screen resolution and local time, according to Vanja Svajcer, a principal virus researcher in SophosLabs. 

“The GingerMaster malware is repackaged into legitimate apps,” said Jiang. The applications masquerade as popular applications to encourage users to download it. It can download and install applications on its own without the user's permission, Jiang found. 

It's "exceptionally difficult" to gauge the impact of Android malware distributed outside the official Android market, Tim Armstrong, a malware researcher at Kaspersky Lab, told eWEEK. Users should avoid alternative Android Marketplaces unless they have "strong evidence" the applications are trustworthy, Svajcer recommended. GingerMaster may compromise Android 2.2 and earlier devices with some adjustments, Jiang said. Jiang's team also found other DroidKungFu variants in alternate Android application stores that used similar root exploits for earlier versions of Android.

Jiang named the malware "GingerMaster." Like most Android malware, GingerMaster hides inside legitimate Android applications that attackers have pirated, added malware to, then re-released onto popular download markets.

The malware waits for further instructions from the C&C server, which can tell jacked phones to download even more malware or other apps, said Jiang. In a post to the Sophos security blog Monday, Svajcer said he had downloaded the infected app from a Chinese-language site that caters to Android owners.

Although some infected apps have slipped into Google's official Android Market, a larger number are distributed through alternate sites, including several popular Chinese app marts. Last month, for instance, Jiang warned Android users of a then-new threat, called "HippoSMS," that his group had found on unauthorized Chinese app stores.

According to several antivirus vendors, the volume of Android malware has jumped this year. NC State's Jiang stressed that the newest Android malware is a significant threat, and urged smartphone owners to watch where they download apps and remain vigilant when an app requests a large number of permissions. 

By. Android Phone Tips

Symantec announced on Thursday the release of its Norton Mobile Security app for Android devices, giving mobile users a free lite version of the company’s popular security suite. The new app called Norton Mobile Security LITE for Android has several antitheft and antimalware features required for protection, but is only a free and stripped version of the more robust Norton Security Suite.

The mobile app allows Android users to remotely lock lost or stolen phones via SMS, scan files and updates for malware, and run Norton’s LiveUpdate in the background for automatic downloads and installations of security updates.

To further protect its users against cybercrime and infected Android apps, the anti-virus app includes several aftermarket features that allow users to lock their smartphones via text message, remotely locate stolen or misplaced phones and remotely wipe the contents of their phone. Along with Symantec, AT&T and security firm Juniper Networks are getting into the mobile security game. 

Security firm Symantec is only too aware of this and has released a beta version of Norton Mobile Security that includes not only virus protection, but also other security features such as location locating and remote wiping. Users may resent having security software installed, but it could prove invaluable if you manage to mislay your mobile.

By. Android Phone Tips

The app is called Anti, short for Android NetworkToolkit. With Anti, a user can infiltrate Windows machines, devices running an unspecified older version of Android and yes, even iPhones. Anti will debut at the Android Market next week as a free app that can be upgraded for $10 (USD).

I’m sure you’re wondering why Google would approve such an app. The answer lies in zImperium’s trade – security.  Called Android Network Toolkit, or Anti for short, the app basically allows anyone using it to gain access to other devices such as Windows computers, Android phones and even iOS devices as well.

If you’re wondering how can such an app be legal, it’s because the company behind it, Zimperium, specializes in security and the app was designed to be used by companies or individuals who wanted to test out the security on their networks, machines and even software which could be outdated, thus causing security vulnerabilities.

In a note left in the app by Zimperium, “Please remember, with great power comes great responsibility. The AndroidNetwork Toolkit app could be a script-kiddies’ dream come true. The app, released by Zimperium, has functionality the includes the ability to spy on a machine, take remote screenshots, and eject the CD tray. Well, Zimperium is actually in the security business and the app is intended for use in sniffing out security holes. 

By. Android Phone Tips

Android malware may be transmitting personal user data to unauthorized computers, indicating increasing security vulnerabilities in the OS and drawing criticism and concern, especially as Android devices grow in business and government usage.

Researchers at Calif.-based security firm Dasient looked at 10,000 applications for Android smartphones in a random sampling, and discovered more than eight percent of the apps transmit personal user data to unauthorized computers.

Called “drive-By downloads,” this category of malware infects a smartphone when its user simply visits a malicious site. The implications of these weaknesses are potentially alarming, especially as smartphone usage grows into businesses. Several businesses, like Deutsche Bank, are moving away from the BlackBerry devices and towards employee’s personal smartphones and devices. But incidents of increasing malware on Google’s OS may have a negative impact, causing the Android OS to lose out in the corporate game.

It’s also possible that users are unknowingly installing malware when visiting a site. Beyond personal user data, the malware often leaks the IMEI number (specific to the phone) and the IMSI number (specific to the subscriber). 

While we did not observe any outwardly malicious text messages in our sample of 10K apps from the Android Market, we did observe 11 applications that sent text messages that could be considered spam-like. More than 800 Android apps "leaked private information, such as IMEI and IMSIs," the firm said. 

There are now more than 235,000 programs in the Android Market, according to AppBrain, a website for discovering Android apps. The apps studied by Dasient "were chosen at random from 30 different categories of apps in the Android Market," the firm said in its report. 

The site's "low quality app detection filter detects automatically which apps are unlikely to be useful," AppBrain notes. "Google seems to remove apps from the market roughly once a quarter, in which case the total number of available Android apps goes down. The removed apps are almost always classified by our system as low quality apps."

By. Android Phone Tips

To all the Angry Birds fans playing the extremely popular game on your Android phone, beware of any Angry Birdsapplication add-ons. Google has removed at least 10 apps from the Android Market which contain malicious code. The malware was found in apps pretending to be cheats or add-ons for Angry Birds.

The problem with Android apps, unlike with iPhone apps, is that the Android Market doesn’t vet its apps. Xuxian Jiang, an assistant professor of computer science at North Carolina State University, found the malicious apps last week. Some of those apps were infected with the spyware program Plankton. Webroot analysts Andrew Brandt and Amanda Orozco found Plankton was zeroing in on Angry Birds. 

Some of the apps in question were Angry Birds Rio Unlocker v1.0, Angry Birds Multi User v1.00 and Angry Birds Cheater Trainer Helper V2.0. The apps actually install additional code onto your phone which gives remote access and control of the handset to whoever created the malicious apps. Back in March, Google removed about 60 apps from the Android Market for malware concerns. 

Some users are shocked that Google can remove stuff from your Android phone remotely. I'm more alarmed at the ridiculous ease with which malicious coders can create Trojans for Android. At last week's Next@Norton event, Symantec researchers presented a dazzling array of information about the current state of mobile security and the mobile malware landscape. 

Here are the five simple steps Chien demonstrated:

One. Start by downloading a free app. You can choose any app at all, but of course you'll want to pick something that will draw plenty of downloads.

Two. The language compilers that create applications on your PC take textual source code and convert it into assembly language that the CPU can read and process. It's a one-way translation; there's no way to go from the final executable file back to the source code. Androidapps are written in Java, though, and that means that you can decompile them back to the original source code using simple, easily-available tools. For the next step, decompile your target app.

Three. The third step is a little tricky. You'll need to obtain Java source code that does something nasty, like sending personal information from the device to a third party. For the demonstration, Chien used a known threat called Android.Geinimi.

Four. Adding the Trojan code is absurdly simple. You copy it into the folder containing the existing source code, make a small change in the manifest to run the Trojan code before the rest of the app, and edit the permissions to give the Trojanized app free access to the entire device. While you're at it, tweak the app's name. Chien added "FREE!" to the name for his demo.

Five. Compile the modified app and upload it to the market. You're done!

Of course, malicious apps don't last long in the Android Market. If you really want to spread a dangerous program, you're better off uploading it in China, where there is no official Android market. It's time to look into mobile security for your Android device. Google recently removed at least 10 applications from the Android Market, all of which contained malicious code disguised as add-ons to one of the most popular apps of all time.

Google suspended the questionable applications the same day, “pending further investigation.”Jiang found malicious programs other than Plankton in his research. Jiang says apps containing the virus were available on the Android Market for at least three months before Google pulled them.

Jiang found a similar application, DroidKungFu, circulating Chinese application markets before YZHCSMS made its way to the Android Market. For many app developers, the Android Market offers a freedom not found in other application retail outlets. Unlike Apple’s strict application review process, apps submitted to the Android Market are published almost instantaneously. 

Google’s lack of vetting applications lends the Market to security vulnerabilities like these. Going outside of the official Android Market for apps can be even riskier. Without Google’s moderation capabilities in these outside markets, users are more susceptible to downloading malicious apps.

By. Android Phone Tips

Android enthusiasts have long championed Google’s “open” philosophy towards the smartphone platform. The app in question, Android.Walkinwat, appears to be a free, pirated version of another app, “Walk and Text.” The real version is available for purchase in Google’s official Android Market for a low price ($1.54).

If you download the fake app (from unofficial markets for Android apps) and install it, it redirects you to the actual app on the Android marketplace — but in the background, it sends the following embarrassing message to your entire phonebook via SMS:

Hey,just downlaoded [sic] a pirated app off the internet, Walk and Text for Android. Whenever an app in clear violation of Google’s policies shows up in the Market — like, say, a piece of malware — Google’s Android engineers are often quick to quash it.

In order to install Amazon’s App Store on an Android device, you first must uncheck that permissions box. While there may be no immediate risks associated with downloading apps from Amazon’s App Store, it opens the door for users to allow other unofficial — and therefore riskier — apps to be installed on their devices, from other sources.

“Android users enabling sideloading doesn’t necessarily lead to piracy or installation of apps from unsafe sources,” says Alicia diVittorio, a spokesperson for Lookout Mobile Security. Essentially, there’s an inherent risk that comes with downloading apps for a device with an attitude of openness like the Android. 

With a slew of Android mobile devices streaming into the market, there is a lot of excitement around Google's Android OS and its market. Until recently the only way to access Android Market was to do so directly from an Android device using the Android market app on the device. But recently Google launched the Android Market website that allowed users to choose the apps and automatically download them to their Android devices over the air.

What the user has to do, is to go to the Android Market website  and sign in using his Google credentials and the application immediately retrieves information of Android devices registered in the person's name and also the data about market apps that have been already installed.

Sophos, a developer and vendor of security software and hardware, had recommended that Android Market's instant-download feature could open up Android devices to malicious downloads from attackers. There have been issues in the past with many malware apps being discovered in the Android market which were then banned by Google. Google doesn't minutely examine apps for approval and not only this, Android apps can also be obtained from a developer's website.

Once the app goes live, it is the Android market community which has the responsibility of flagging apps that do not abide by their policies. When an app is repeatedly flagged, it is being reviewed by Google and if it is found violating Google's policies, then it is banned. The app would present the new users with a limited list of banks that were complete with company logos. This led to suspicion about the app being a phishing app and was banned from Android Market.

A malware that was said to possess Botnet like capabilities, Geinimi was attached by hackers to legitimate apps like Monkey Jump 2, and the corrupted app was redistributed in the third-party Chinese Android app market. When users download the 'seemingly-legitimate' app the Trojan gets to work. Tap Snake, was a free gaming application available for the Android OS. Download apps only from trusted sources and avoid using third-party apps. Take into consideration, the developer of the particular app and check the ratings and user reviews. Also deploy a mobile security solution on devices to ensure that downloaded apps are not malicious.

The success of the Android platform is obvious from the number of applications, now over 300000, now available from the Android Market. Yesterday, we discovered a new malicious Android application which purports to be a non-existent version 1.3.7 of the application Walk and Text created by Incorporateapps. The application has been distributed on several forums and file sharing sites. 

By. Android Phone Tips

Google's latest update for its Android mobile OS appears to already have been subverted by hackers, according to the security vendor Symantec. Symantec found an application called the "Android Market Security Tool" that is a repackaged version of the legitimate update by the same name that removed the DroidDream malware from infected devices.

Google took the rare step last week of forcing the "Android Market Security Tool March 2011" onto devices to remove DroidDream. DroidDream could also download other code to a person's mobile phone. Google has patched the vulnerabilities in Android versions above 2.2.2, but many Android users do not have the latest version of the software.

Google released an application this week to remove malicious applications for Android phones that were found in Google’s Android Market. Researchers at Symantec Corp. now are reporting that they have found copies of the Android Market Security Tool that contain suspicious code.

“The technique employs nothing new,” said Joe Chen, director of engineering for Symantec Security Response. Malware writers routinely sail under false colors. The malware took advantage of known vulnerabilities which do not affect versions 2.2.2 or higher of the Android software. 

Google removed the malicious applications from Android Market March 1, and this week released the security tool, which was pushed to affected users. The Android.Rootcager malware was found in versions of the security tool on an unregulated third-party Chinese marketplace. Thanks Android team!!” to “Why are people thanking Android/Google? 

Following the DroidDream Android malware scare, Google announced that they had removed the malicious applications from the Android Market, suspended the developer accounts, and contacted law enforcement, in addition to using its remote application removal feature (Android's so-called "kill switch") on affected phones.

Google automatically pushed out "Android Market Security Tool March 2011," and notified users via e-mail about the installation and removal of apps, whereas this "trojanized" version asks users to install it. 

In total, 58 malicious apps were found in the Android Market and downloaded 260,000 times. The attacks affected phones running on versions before 2.2.2.  Mobile users who search for [poison control], [suicide], and common emergency numbers already receive a result showing the relevant emergency phone number. 

By. Android Phone Tips

If you've read much news lately, you know it's that time of year again -- time for the semiannual Android malware freakout show. You know what I'm talking about: Some company, usually one that happens to sell a virus protection program for Android, comes out with a slew of blogs and press releases warning us of a super-duper-scary virus monster just waiting to attack vulnerable Android phones. 

Our latest Android malware episode started a few days ago when Lookout, a company that -- wait for it -- sells a virus protection program for Android, posted a blog and sent out a press release warning of a newly found threat. Called "DroidDream," the threat lurked in about 50 apps within the Android Market, Lookout said. 

If installed on your phone, those apps could potentially let an attacker install additional programs and ultimately access some of your device's data. Long story short, Google axed the infected apps from the Market, remotely removed any traces of the programs from users' phones, and released a patch that'd prevent the apps from doing any more harm. 

There's even (gasp!) porn. We're used to this when surfing the Web, right? We evaluate programs before we download them. If something seems shady, we click away. Google removed 21 popular free apps from the Android Market that secretly stole available data on users' smart phones and allowed for more malware to be unknowingly downloaded.

Malware or Android virus is often irritating, because in addition to damaging the operating system or applications android we also create files or data that we can be stolen without us. Therefore we have a antivirus and also tips for android we stay safe from Android viruses. The following are tips that we collect from pc-world and hopefully useful for all of us especially android users. Following are five quick tips to help you keep your Android handset free of malware :

The key part of Google's latest reaction, announced in a blog post Saturday night by Android security head Rich Cannings, is the remote removal from users' phones of applications identified as malware. These rogue applications were offered through Google's Android Market under such sketchy names as "Hilton Sex Sound" but also more-serious monikers such "Scientific Calculator.

" Google will also send a software update called "Android Market Security Tool March 2011" to infected phones over the next day or two that will close the security vulnerabilities exploited by this malware. You're better off inspecting a new app's critiques in the Web version of the Market that Google introduced last month.) 

I've heard similar thoughts from Android developers who like not having to wonder if each new release--and each patch to an existing release--will get held up in app store review limbo. Although the current version of Android, 2.3, doesn't have the vulnerability exploited by this malware, most Android phones don't run it.

And Google can't make them offer updates to 2.3. Others, such as Vaughan-Nichols, advise getting anti-virus software for the phone. But no matter what, Google needs to improve its management of its Market.

Given that the malware was designed to download additional malicious software, it's not immediately clear whether affected devices lost sensitive information as a result of this secondary malware. Larimer advises resetting affected phones to their factory state. Google is distributing a specific piece of security software to affected users, the Android Market Security Tool. Cannings says that Google is working on a number of additional security measures to make Android Market more secure and is working with partners to improve software security. 

By. Android Phone Tips

I prefer Google’s Android over Apple’s iOS for smartphones. On Saturday, Google’s Rich Cannings, the Android Security Lead, announced that:

1. We removed the malicious applications from Android Market, suspended the associated developer accounts, and contacted law enforcement about the attack.

2. We are remotely removing the malicious applications from affected devices. This remote application removal feature is one of many security controls the Android team can use to help protect users from malicious applications.

3. We are pushing an Android Market security update to all affected devices that undoes the exploits to prevent the attacker(s) from accessing any more information from affected devices.

If your device has been affected, you will receive an email from android-market-support@google.com over the next 72 hours. You will also receive a notification on your device that “Android Market Security Tool March 2011″ has been installed. At least Google will be telling users what’s going on, so that’s something anyway.

This malware only worked on versions of Android that were 2.2.2 or lower. So, how about making almost every Android user in the world happy—not to mention developers-and get the phone original equipment manufacturers (OEMs)–to update all their Android devices to 2.3, the latest major version? There’s a host of Android A/V programs on their way. 

There are many mobile security products available including offerings from BullGuard, AVG and Trend Micro. Gartner recently revealed Google Android is now the second largest mobile phone operating system, with 67.2 million handsets sold last year.

By. Android Phone Tips

DroidDream fires sensitive data, such as a phone's unique ID number, to a remote server. If it hasn't the program bypasses security controls and hands its creator access to the handset. Lompolo discovered that the application was a carbon-copy of the original, however it had a name change and virus code added to is. more than 50 applications available via the official Android Marketplace have been found to contain a virus.

The apps, according to analysts, may have been downloaded up to 200,000 times before they were found.

The apps were not newly developed ones. The malicious apps were just a bunch of existing applications that had been repackaged to include the virus code. Google has reportedly removed the apps from the Android Marketplace.

The virus in the apps, known as DroidDream, would send sensitive data such as a phone’s unique ID number, to a remote server once it had been installed. Before installing itself, it first checks to see if a phone has already been infected or not. If not, it will then install itself and use known exploits to bypass security controls and give the virus creator access to the handset.

The latest version of the Android operating system, Gingerbread, is not vulnerable to the exploits DroidDream uses. Anyone who believed that their phone had been infected should get a new handset or re-install its operating system.