January | 2014 | FireEye Blog

Android.HeHe: Malware Now Disconnects Phone Calls

January 21, 2014 | By Hitesh Dharmdasani | |

Comments

FireEye Labs has recently discovered six variants of a new Android threat that steals text messages and intercepts phone calls. We named this sample set “Android.HeHe” after the name of the activity that is used consistently across all samples.

Here is a list of known bot variants:

MD5	VirusTotal Detection Ratio
1caa31272daabb43180e079bca5e23c1	2/48
8265041aca378d37006799975fa471d9	1/47
2af4de1df7587fa0035dcefededaedae	2/45
2b41fbfb5087f521be193d8c1f5efb4c	2/46
aa0ed04426562df25916ff70258daf6c	1/46
9507f93d9a64d718682c0871bf354e6f	1/47

Summary

The app disguises itself as “android security” (Figure 1), attempting to provide the users what is advertised as an OS Update. It contacts the command-and-control (CnC) server to register itself then goes on to monitor incoming SMS messages. The CnC is expected to respond with a list of phone numbers that are of interest to the malware author. If one of these numbers sends an SMS or makes a call to an infected device, the malware intercepts the message or call, suppresses device notifications from the device, and removes any trace of the message or call from device logs. Any SMS messages from one of these numbers are logged into an internal database and sent to the CnC server. Any phone calls from these numbers are silenced and rejected.

Figure 1

Continue reading »

Notes from the Field: Yahoo Malvertisement Attack

January 16, 2014 | By J. Gomez | |

Comments

Yahoo visitors got a nasty New Year’s surprise when third-party advertisements on the site triggered drive-by malware infections. Around the end of December, Yahoo inadvertently began serving malicious ads, also known as “malvertisements,” that redirected visitors to a site hosting the Magnitude exploit kit. This resulted in drive-by malware downloads for thousands of unsuspecting users who merely visited the Yahoo site — even those who didn’t click on anything.

Yahoo quickly removed the ads and says it is working with law enforcement to investigate.

While we don’t know exactly how the malvertisers infiltrated Yahoo’s advertisement network, we are familiar with this type of attack.

This blog post examines some of technical details of the attack to help security professionals spot and combat this type of threat.

JS-Binding-Over-HTTP Vulnerability and JavaScript Sidedoor: Security Risks Affecting Billions of Android App Downloads

January 16, 2014 | By Yulong Zhang, Hui Xue, Tao Wei and Dawn Song | |

Comments

Third-party libraries, especially ad libraries, are widely used in Android apps. Unfortunately, many of them have security and privacy issues. In this blog, we summarize our findings related to the insecure usage of JavaScript binding in ad libraries.

First, we describe a widespread security issue with using JavaScript binding (addJavascriptInterface) and loading WebView content over HTTP, which allows a network attacker to take control of the application by hijacking the HTTP traffic. We call this the JavaScript-Binding-Over-HTTP (JS-Binding-Over-HTTP) vulnerability. Our analysis shows that, currently, at least 47 percent of the top 40 ad libraries have this vulnerability in at least one of their versions that are in active use by popular apps on Google Play.

Second, we describe a new security issue with the JavaScript binding annotation, which we call JavaScript Sidedoor. Starting with Android 4.2, Google introduced the @JavascriptInterface annotation to explicitly designate and limit which public methods in Java objects are accessible from JavaScript. If an ad library uses @JavascriptInterface annotation to expose security-sensitive interfaces, and uses HTTP to load content in the WebView, then an attacker over the network could inject malicious content into the WebView to misuse the exposed interfaces through the JS binding annotation. We call these exposed JS binding annotation interfaces JS sidedoors.

Our analysis shows that these security issues are widespread, have affected popular apps on Google Play accounting for literally billions of app downloads. The parties we notified about these issues have been actively addressing them. Continue reading »

Targeted Attacks in 2013: Asia Pacific

January 14, 2014 | By Geok Meng Ong and Kenneth Geers | |

Comments

Here at FireEye, the New Year gives us an opportunity to look back at 2013 and analyze what happened in cyber security from a high-level and strategic perspective.

Let’s start with Asia. Cyber attacks against government websites in Southeast Asia and Australia made the front-page news, reminding security professionals that cyber threats are both a global and a regional issue.

While attention-seeking hackers are trying to attract as much press as possible, organized and resourceful cyber criminals and nation-state threat actors are capable of more advanced – and stealthy – attacks. Motivated by economic and political aims, some of the most advanced cyber attacks are designed to steal information (or, like Stuxnet, sabotage critical infrastructure) and evade detection. Therefore, this class of attacks can often go unnoticed for long periods of time. Continue reading »

Trends in Targeted Attacks: 2013

January 13, 2014 | By Nart Villeneuve | |

Comments

FireEye has been busy over the last year. We have tracked malware-based espionage campaigns and published research papers on numerous advanced threat actors. We chopped through Poison Ivy, documented a cyber arms dealer, and revealed that Operation Ke3chang had targeted Ministries of Foreign Affairs in Europe.

Worldwide, security experts made many breakthroughs in cyber defense research in 2013. I believe the two biggest stories were Mandiant’s APT1 report and the ongoing Edward Snowden revelations, including the revelation that the U.S. National Security Agency (NSA) compromised 50,000 computers around the world as part of a global espionage campaign.

In this post, I would like to highlight some of the outstanding research from 2013.