#LoneWolf - SamadKhan.Com

Can the EVM machines used for Indian elections be hacked or tampered?

By Khaleel Khan

Read

EVMs hack india

Yes, EVMs can be tampered. But process is not trivial. Also, you need physical access to control unit, seal breaking of unit, time and lots of technical knowledge.

Indian EVM uses micro controllers manufactured by Renesas(Japan) and Microchip(USA). These micro controllers have their firmware i.e. software code, stored within a One Time Programmable Non Volatile Memory OR field programmable read-only memory[FP-ROM].

From time to time, doubts have been raised over the EVMs. The Supreme Court had directed the Election Commission in 2013 to introduce a paper trail in EVMs in a phased manner.

Let me explain...

Can EVMs be hacked?
A lot of people have said if something as safe as a bank account can be hacked, why not an EVM. Hacking would require an EVM to be connected to Internet but EVMs have no internet connection. So, hacking an EVM is not possible.

How EVMs can be tampered?
A small chip with a Bluetooth connection can be inserted into the machine. The chip can be controlled from a mobile phone to influence results when the voting is taking place.

Why it's not possible
However, it may not seem possible that such chips can be inserted in lakhs of voting machines. Also, this kind of tampering will have to involve hundreds of people at different stages—including various centre and state officials—which makes it very difficult to keep the tampering secret.

Can it happen that people press on one party and vote goes to another?
For this we should understand the concept of VVPAT. The VVPAT, or voter-verified paper audit trail, means letting voters know, through printed pieces of paper which are kept as record, that the votes have really gone to the candidates they have voted. The paper trail is seen as one way to remove doubts about the efficacy of EVMs. So if that would be the case the people would have known that their vote is going to someone else.

So, practically its impossible to tamper enough EVMs to overturn General Election results.

There are some videos which claims to demonstrate that EVMs can be easily tampered. Those are fake. First you can’t just get genuine EVM used by Election Commission in market to buy and show it can be tampered easily. There are few videos which shows the process on emulated EVM on screen. Come on, that’s ridiculous. One can write such emulators to whatever they want. Even I can write and give you such fake emulator which gives your desired results. Those are not EC official EVM emulators or how EVMs actually work. Those are fake created by some people to just fool people to believe how easy it is to tamper EVM which is not the case.

Read More Add comment

Top tools all data scientists should know

By Khaleel Khan

Read

Read More Add comment

Linkedin Enumeration Tool for information gathering

By Khaleel Khan

Read

Read More Add comment

Hacking WordPress – Capturing Usernames & Passwords

By Khaleel Khan

Read

Google have now been pushing the HTTPS agenda for the years that are few – they desire all web sites to perform on HTTPS. The dashboard or admin pages, all data is submitted clear text should your WordPress is still running on HTTP, when you login to WordPress and access. This means your WordPress credentials may also be delivered on the internet in clear text.

Therefore the dangers of getting your WordPress password and username stolen have become high. This post describes how harmful hackers can steal your WordPress login details making use of pc software that's free. Additionally recommends your skill to protect your website from such assaults and exactly how to make use of WordPress activity logs to spot behavior which dubious.

How exactly to steal WordPress credentials (Usernames and Passwords)
Routing of Clear Text Data Over the Internet
Whenever you access an online site or your WordPress, the information just isn't sent straight from your computer browser towards the internet server. It is routed through several devices on the internet that are administered by different entities (ISPs, web hosts an such like).

Depending on the location that's geographic of computer and WordPress internet site, your login details may be routed through 5 to 20, or maybe more products before it reaches the location. And since such information is sent in clear text, should a hacker which malicious into one of these devices, which may be your own house router, they could effortlessly recover your WordPress username or password.

Hacking WordPress sites by stealing login details
Harmful hackers utilize software such as for example Wireshark (sniffer) or Fiddler (proxy) to capture your WordPress login details.

As an example the screenshot below is of Fiddler, which is a pc software which proxy the attacker might used to capture your WordPress credentials by proxying the traffic through it.

Protecting your WordPress login details (and password)
There are many methods how to prevent having your WordPress login details taken. The initial & most way that is protected to gain access to your WordPress dashboard over an HTTPS connection.

It's also advisable to include authentication that is two-factor your WordPress because despite the fact that harmful hackers can’t steal your credentials whenever accessing the WordPress admin pages over SSL, it's still prone to brute force assaults. Two-factor verification protects your WordPress from automated brute force attacks.

Keep a WordPress task log to spot logins that are suspicious hack attacks

The more protection layers you can implement in your WordPress internet site, the higher it's generally of thumb. So since no WordPress protection solution is perfect, you should also keep a WordPress activity log to be able to spot logins which can be dubious other activity in your WordPress web sites.

Using a plugin like WP Security Audit log your WordPress site it is possible to help keep a log of whatever is happening on your web site, therefore should be able to just take the required action that's evasive your site is damaged in case there is a possible WordPress hack attack.

Read More Add comment

Bitcoin’s Block Size Is Increased Without Tough Fork, States Blockstream Co-Founder

By Khaleel Khan

Read

Bitcoin (BTC) protocol designer Mark Friedenbach introduced a technique for Bitcoin scaling he claims won't require a fork which hard a workshop in Tokyo October 5.

The style that is new within Scaling Bitcoin workshop, entitled “Forward Blocks,” shows an important on-chain ability boost by way of a Proof-of-Work (PoW) alternation that's done as soft fork, along with use of alternate personal ledgers.

The proposal describes a way for scaling that claims to be able to increase transaction that is“settlement to 3584x current amounts” and improve censorship resistance via sharding.

Throughout the presentation, Friedenbach advised improvements which can be major on-chain Bitcoin deals, or the ones that show up on the Bitcoin blockchain. The“soft-fork that's so-called alternation implies a strengthening of opinion guidelines in which old nodes “still see the chain advance.” The research also represents a concept of “forwards appropriate soft-fork,” that non-upgraded nodes nevertheless receive and process all transactions.

In his presentation, Friedenbach emphasized the part of sharding for increased censorship resistance, noting which he borrowed the “sharding” term through the “database field.” But the definition of that's described in scientific studies are “largely maybe not” the sharding which implied by other major crypto-related jobs, but is “nevertheless the expression that is correct use” with regards to the study.

The sharding term has garnered popularity which most in mention of the the Ethereum (ETH) blockchain’s upcoming major improvements. Revealed in mention of the Ethereum’s by its co-founder Vitalik Buterin in 2018, the word implies a method of increasing the number of transactions a blockchain can process april. The thought of sharding is that for on-chain deals, numerous network computer systems can divide the transaction workload between them.

Friedenbach, that is also a former NASA contractor, reported in his talk you introduce a brand new PoW having a soft-fork. which he failed to attempt to think about Bitcoin scaling solutions originally, but was contemplating “the development of a twin PoW modification in which” The designer stressed that his work isn't really a proposal for subsequent modifications, but instead a concept for designers to think about and “a great place to start. while suggesting the addition of some other PoW algorithm”

The problem of Bitcoin scalability is amongst the major topics of conversation across the top cryptocurrency.

Several Bitcoin engineers announced the launch of this Bitcoin Operations Technology Group (Bitcoin Optech) to address the issue of scaling the Bitcoin blockchain in July of the 12 months. The team that's non-profit supported by leading industry actors, including PayPal Board Member Wences Casares, professional of Kohlberg Kravis Roberts & Co. Ltd John Pfeffer, and cryptocurrency research and development team Chaincode Labs.

Read More Add comment

Fake Cheat for Trendy Game Fortnite Hides Bitcoin-Targeting Spyware

By Khaleel Khan

Read

Read More Add comment

What is Blockchain Technology? | Gekza Technologies

By Khaleel Khan

Read

what is blockchain and how its works gekza technologies

Blockchain technology was created by people not smarter than you and I, and it seems to be quite simple to understand when we stop using tech terms.

In simple words, blockchain is an ever-growing list of “blocks”, which are records that are linked to each other and secured using cryptography.

Where is blockchain stored?

These records are stored in a record book (“ledger”), which, in turn, is simultaneously stored on thousands of home computers and business servers (“nodes”) all over the world.

How does blockchain work?

Imagine that you want to send money to your friend. When you did this, a new record is created detailing this transaction.

This record then is sent to thousands of computers, which store a copy of the record book. Those computers confirm that the transaction is authorized and they agree or disagree that all issues about the transaction are legitimate.

Imagine another situation: there are hundreds of fellows standing around you and your friend, who see with their own eyes how you actually gave him money and that it was a right amount.

This record book is not owned by any individual, bank, financial institution or any other kind of organization. It is owned by everyone who has a copy of the record book. At the same time, it doesn’t mean that a person with a copy has control over it.

If your friend wants to return the money, that will be a new record in the book. It won’t replace the original record about the first transaction.

One of the main advantages of blockchain is that it is impossible to fudge those records in the record book. If someone who has a copy of the record book tries to change a record, this change will be rejected by other computers during the verification process.

Benefits of adopting blockchain technology

Lower costs
Innovation
Advantage over competitors
Full control over transactions and data
High level of data security and protection against unauthorized actions
Accurate record keeping
Transparency

Technically, the original blockchain is separable from Bitcoin, but this report will show that the blockchain design is so specific to Bitcoin that it's not a good fit for much else.

The central problem in electronic cash is Double Spend. Because pure electronic money is just data, nothing stops a currency holder from trying to spend it twice. Blockchain solves the Double Spend problem without a digital reserve fund or similar form of umpire.

Blockchain monitors and verifies Bitcoin transactions by calling upon a decentralized network of volunteer-run nodes to, in effect, vote on the order in which transactions occur. The network's algorithm ensures that each transaction is unique.

Many critics of the blockchain design have said the inefficiencies in keeping data communally are likely to make blockchains unattractive except in cases where centrally kept databases are a major liability.

At this point, aside from the big virtual currencies, few blockchains have been used and battle tested in the real world for any amount of time, which leaves significant questions about how they will perform once they make it into use.

Read More Add comment

What are the benefits of LinkedIn learning courses?

By Khaleel Khan

Read

linkedin learning, learning courses

LinkedIn learning is the integration of Lynda, a US based e-learning platform which was purchased by LinkedIn in April 2015.

A LinkedIn subscription now includes free access to LinkedIn learning which offers courses to help you learn business, software, technology, and creative skills to achieve your professional goals. Excellent production and very easy to follow modules.

As an active LinkedIn user (Premium profile) I can list a couple of benefits for leveraging this great opportunity to learn via LinkedIn Learning. Most important is that it is a great way to expand your knowledge and make a move in your professional development.

Personalized learning that suits you - if you already have skills on your profile, it is easier to find relevant courses and get recommendations from the platform. You can also filter courses based on the skills you have or based on skills you’d like to master.

Thousands of courses from Lynda: Online Courses, Classes, Training, Tutorials covering business, tech and creative skills - but try sorting them out based on their upload date (e.g. Google Analytics course from 2016 is not that much applicable due to Analytics’ changed UI).

Video-based tutorials are produced in-house in their California studios.

Customization possibility - you can also add your own content (or from your organization) via links.

Analytics that will keep you informed about your progress - how much knowledge you’ve adopted, level of engagement and more..

Material can be downloaded (PDF files and other related documents).

Pricing - LinkedIn Learning is available as a Premium subscription and costs $29.99 a month for a monthly subscription, plus taxes. Annual subscriptions cost $299.88 per year, plus taxes. You can have a free trial for a month.

Is LinkedIn Learning worth it?

If you need to quickly improve a skill or knowledge of a software package, then yeah, LinkedIn Learning will serve as an excellent introduction. If you are doing this as part of portfolio development, you still need to design and execute a project on your own.

Read More Add comment

Do Android applications steal our personal data?

By Khaleel Khan

Read

Read More Add comment

What is Machine Learning?

By Khaleel Khan

Read

machine learning at gekza technologies

Machine learning is an application of artificial intelligence (AI) that provides systems the ability to automatically learn and improve from experience without being explicitly programmed. Machine learning focuses on the development of computer programs that can access data and use it learn for themselves.

The process of learning begins with observations or data, such as examples, direct experience, or instruction, in order to look for patterns in data and make better decisions in the future based on the examples that we provide. The primary aim is to allow the computers learn automatically without human intervention or assistance and adjust actions accordingly.

Some machine learning methods

Machine learning algorithms are often categorized as supervised or unsupervised.

Supervised machine learning algorithms can apply what has been learned in the past to new data using labeled examples to predict future events. Starting from the analysis of a known training data set, the learning algorithm produces an inferred function to make predictions about the output values. The system is able to provide targets for any new input after sufficient training. The learning algorithm can also compare its output with the correct, intended output and find errors in order to modify the model accordingly.

In contrast, unsupervised machine learning algorithms are used when the information used to train is neither classified nor labeled. Unsupervised learning studies how systems can infer a function to describe a hidden structure from unlabeled data. The system doesn’t figure out the right output, but it explores the data and can draw inferences from data sets to describe hidden structures from unlabeled data.

Semi-supervised machine learning algorithms fall somewhere in between supervised and unsupervised learning, since they use both labeled and unlabeled data for training – typically a small amount of labeled data and a large amount of unlabeled data. The systems that use this method are able to considerably improve learning accuracy. Usually, semi-supervised learning is chosen when the acquired labeled data requires skilled and relevant resources in order to train it / learn from it. Otherwise, acquiring unlabeled data generally doesn’t require additional resources.

Reinforcement machine learning algorithms is a learning method that interacts with its environment by producing actions and discovers errors or rewards. Trial and error search and delayed reward are the most relevant characteristics of reinforcement learning. This method allows machines and software agents to automatically determine the ideal behavior within a specific context in order to maximize its performance. Simple reward feedback is required for the agent to learn which action is best; this is known as the reinforcement signal.

Machine learning enables analysis of massive quantities of data. While it generally delivers faster, more accurate results in order to identify profitable opportunities or dangerous risks, it may also require additional time and resources to train it properly. Combining machine learning with AI and cognitive technologies can make it even more effective in processing large volumes of information.

Source: Quora.com

Read More Add comment

Disadvantages of customer loyalty programs

By Khaleel Khan

Read

disadvantages of customer loyalty programs

Many loyalty vendors offer a shared rewards network where customers can shop at various retailers across the state/province, or even throughout the country. Customers earn and redeem points at participating merchants. The more retailers that join this type of program, the more attractive it looks to customers. This sounds great but there are some disadvantages to these shared loyalty programs across unlimited retailers where the customer is often loyal to the program, but not to each retailer.

You have no control over which merchants participate in the shared loyalty program. If you own a bakery in a small town and share a coalition rewards program with two other bakery shops down the street, what incentive do customers have to visit? They’re going to earn points no matter which bakery they choose so they may not perceive any added value at your location. If there’s no added value, does it make sense to offer a rewards program at all?

Solution: Standalone loyalty programs allow you to incentives customers for shopping with your business. You’re not paying for a program where your customers can earn discounts at your competitors. Implementing your own customer loyalty program allows you to customize exactly how you want to reward your customers, providing you with a greater degree of control.

So far we have considered only one side of customer loyalty programs, However, there are some disadvantages of these programs too. Most of these programs are managed by third-party companies, which keep track of customer’s points, their private information such as date of birth, phone number, address, etc. Somehow I feel that our privacy is not being given the proper importance as these companies are tracking all of our movements such as where we shop, what we shop, and other spending habits. Our information is shared with third parties to do surveys, to promote their products and for various other reasons. Today we are living in an age of cybercrime, which is a very important factor when it comes to our privacy. If a hacker hacks these companies loyalty program systems, all of our information might go into wrong hands and can have drastic consequences.

The other disadvantage of such programs is to lure people to spend more money in the store by making them collect extra loyalty points or rewards. In this scenario, consumers are actually spending most of their disposable income just to collect few extra reward points. Loyalty cards are like a temptation for consumers to spend their disposable income. The fact is that they increase the price of a product and then give the portion of that towards reward points. Ultimately it is the consumer who is paying more from his/her pocket. Once you get into such schemes, it’s never easy to get out of them. It is like a trap where one gets caught just because of few extra rupees they earn. The decision of enrolling into these loyalty programs is not easy as we have to see our needs and desires. It depends upon what type of card or programs we are looking at such as travel rewards, cash backs or air miles.

So what do you think? Am I being too Scrooge-like in advocating restraint with loyalty discounts? What other ways can you show gratitude to customers aside from discounts? I’d love to hear your thoughts.

Read More Add comment

What is Big Data?

By Khaleel Khan

Read

what is big data

“Big Data” is literally just a lot of data. While it’s more of a marketing term than anything, the implication is usually that you have so much data that you can’t analyse all of the data at once because the amount of memory(RAM) it would take to hold the data in memory to process and analyse it is greater than the amount of available memory

Today, big data platform, big data analysis, big data applications have been developed in full swing. Our life is almost surrounded by various images, sounds, videos and other data.

Have you ever had such a confusion: what is big data? How do I use big data in today’s life?

big data google adwords

We certainly will not get the answer from here. Because the big data is comprehensive, complete and systematically. He let us from the sampling, the local data to rescue, through a large number of data on the over statistics, find the bottom of the data implied meaning, for our services. It is in life safety, network security, marketing and other aspects of cut a striking figure, and gradually play an increasingly important role.

This is indeed the era of BIG DATA revolution. Whether it is healthcare, IT, Industrial, Manufacturing, Food Corporations, Agriculture or any large scale or small scale industries, there are terabytes and petabytes of data generated each day. The daily functioning of all the companies in all sectors relies on the extracting meaningful information from structured and unstructured

Jobs in Big Data

While Hadoop, MapReduce, Cassandra, HBase, MongoDB, Spark, Strom, and Scala are the most in-demand platforms for processing of Big Data, there are thousands of jobs generated every month. Most companies across the globe are seeking for professionals who can be productive from Day 1and hold proficiency in managing high data volumes.

It effectively says that: there is a lot of data, it is coming into the system rapidly, and it comes from many different sources in many different formats.

Big Data come from:

Internet and intranet websites across the world
Posts on social media websites
Digital pictures and videos
Softwares logs, cameras
Microphones
GPS Trails
Scans of Govt. documents
POS Machines and inventory control system
Purchase transection records
Radio Frequency Identification (RFID) Devices

big data analysis, big data science

Also, many apps that have huge amounts of transactional lookup data, but aren’t doing mining of analytics on the data, are not what I’d call big data applications. Processing a purchase using credit card isn’t a big data app, event through the transaction may interact with some very large databases.

Read More Add comment

Hacking Drupal CMS - Drupalgeddon Forms API Injection

By Khaleel Khan

Read

Read More Add comment

#GekzaPy - A Python Training Program in Hyderabad

By Khaleel Khan

Read

Read More Add comment

WhatsApp 2.17.52 - Memory Corruption

By Khaleel Khan

Read

Read More Add comment

How to Prevent SQL Injection in PHP

By Khaleel Khan

Read

Best Cyber Security Company in Hyderabad | gekza.com

SQL injection is a technique, used to attack data-driven applications. Using this method, hackers will try to execute their SQL statements within your application and access your database data.

Here is an example SQL injection. Let's consider you have a login form with two fields - email (text field) and password (password field). Upon login, you will build and execute a similar query:

<?php
"SELECT * FROM `users` WHERE `email` = '".$_POST["email"]."' AND `password` = '".$_POST["password"]."'";
?>

You can see that the query is searching for a user in `users`table, which matches the email and password posted via the login form. However, since both email and password are not properly handled, an attacker can modify the query. Assume that they enter:

Email: email@domain.com
Password: password

The constructed query will be:

SELECT * FROM `users` WHERE `email` = 'email@domain.com' AND `password` = 'password';

Which seems to be correct. However, if the attacker uses:

Email: email@domain.com
Password: password'; DROP TABLE 'users

the query will become:

SELECT * FROM `users` WHERE `email` = 'email@domain.com' AND `password` = 'password'; DROP TABLE 'users';

And of course, you do not want people to execute such queries over your database.

To protect your PHP application from being abused via such SQL injections, you should correctly set all SQL queries that are being run. With older versions of PHP (>= 4.3.0, 5) you would do that with mysql_real_escape_string(). So above query would look like this:

<?php
"SELECT * FROM `users` WHERE `email` = '".mysql_real_escape_string($_POST["email"])."' AND `password` = '".mysql_real_escape_string($_POST["password"])."'";
?>

This is how the SQL injection protected query looks like now:

SELECT * FROM `users` WHERE `email` = 'email@domain.com' AND `password` = 'password\'; DROP TABLE \'users'

You can see that the data being passed via $_POST is now escaped and DROP TABLE query will not be executed separately, but will be considered as a part of the password string.

With the latest versions of PHP you can now use PDO and prepared queries. Here is an example:

$stmt = $conn->prepare("SELECT * FROM `users` WHERE `email`=:email AND `password` = :password");
$stmt->bindValue(':email', $_POST["email"]);
$stmt->bindValue(':password', $_POST["password"]);
$stmt->execute();

The key function here is prepare(). It secures the SQL query and protects it from SQL injections.

There are other ways to verify that data passed via SQL queries is valid and not abused. For example, if you expect an integer to be passed, you may use interval() to convert the inputted data into an integer.

"SELECT * FROM `users` WHERE `age` = '".intval($_POST["age"])."'";

SQL injection is one of the top website vulnerabilities, so you should be very careful when using user inputted data to construct SQL queries.

Read More Add comment

Top Android Ransomware Threats

By Khaleel Khan

Read

android ransomware, android forgot lock, android pin lock, reset pin, virus, malware

Malicious programs categorized as ransomware, which encrypts their victims’ personal files and demands a ransom for restoring the locked data, proved to be extraordinarily profitable for cyber extortionists. A lot of infected users end up giving in to perpetrators’ demands and pay to recover their data. Windows users are suffering most heavily from ransomware. As mobile platforms are exhibiting rapid growth in user count, though, ransomware authors have started to target mobile devices as well. Researchers rank ransomware the number one mobile malware threat for 2016. We can already list several known strains of Android ransomware at this point.

Xbot

The relatively recent Xbot Trojan family encompasses more than 20 offending apps. This infection can steal Android users’ personally identifiable data and banking credentials by leveraging a phishing hoax. To get the job done, it imitates Google Play payment screen and Login interfaces for several e-banking applications. Another nasty functionality is remote data encryption – Xbot can encode files stored on the SD card. Then, it tells victims to redeem their data by paying a ransom of 100 USD via PayPal. To top it off, the malware pilfers text messages and contacts.

Xbot mostly targets users in Australia and Russia. Based on code analysis, it appears to be a newer version of the infamous Trojan dubbed Aulrin, which surfaced in 2014. However, whereas Aulrin used Lua and .NET framework to operate, Xbot relies on the Rhino JavaScript engine by Mozilla. Furthermore, the Trojan employs DexGuard technology to prevent security researchers from reverse engineering its code.

The author of Xbot is most likely from Russia. The JavaScript code contains comments in Russian, and the above-mentioned Google Play phishing scam featured a misleading notification in the same language. Also, a Russian registrar was used to register some of the malware’s Command and Control domains.

Xbot reaches out to its C2 server after infiltrating a device. Depending on the incoming commands, the infection may act differently. For example, if a “cc_notify” command is received the Trojan starts deploying the Google Play payment page fraud. In case the of “enable_inject” command, the malware looks for apps related to a number of Australian banks. If one is detected, a fake banking application interface is displayed on top of the original program, which allows the attackers to intercept the login credentials and transmit them to the C2 server.

In the event Xbot receives an “enable_locker” command, it encrypts the user’s personal files and displays a ransom page. The alert says that the victim has five days to buy a 100 USD worth PayPal card and provide the card’s number otherwise the files will be lost.

The Trojan can also parse text messages that the user receives from banks’ premium rate numbers. This way, the scoundrels attempt to get hold of the person’s account details and confirmation codes for various transactions.

Lockdroid
This iteration of Android ransomware employs Google’s Material Design to build a trustworthy-looking user interface. Material Design is a language created by Google that features grid-based layouts, fancy depth effects, and responsive visual components to deliver intuitive experience across the company’s services. The criminals behind Lockdroid use this style to generate counterfeit legal warnings and display the harvested device logs along with sensitive user details in a bid to make the extortion scarier and more realistic.

The perpetrators are distributing Lockdroid by masquerading its payload as an application update package rolled out by Google. Tapping the “Continue” button on the phony “Package Installation” dialog effectively authorizes the harmful installation and furtively invokes the respective API. To that end, the infection harnesses a TYPE_SYSTEM_ERROR popup window generated on the highest UI layer. This window pretends to request permission to unpack the alleged update package components.

Then, the user is suggested to tap another “Continue” button on the “Installation is Complete” popup. The latter is, in fact, a TYPE_SYSTEM_OVERLAY window displayed on top of the administrator activation dialog. Therefore, users end up tapping the “Activate” option while they think they are simply moving on with the software update. Referred to as clickjacking, this type of fraud can only be deployed on devices running operating system versions under Android 5.0.

Having hit a device, the virus grabs the entirety of device logs such as the browser history, text messages and call records. This being done, it locks the phone and displays a ransom alert on the lock screen. The deceptive warning states that the user has accessed forbidden materials and that the respective logs are now in law enforcement’s custody. The lock screen menu includes options to view the log details, making the risk appear yet more true-to-life. This isn’t a new vector of ransomware activity, but the strain in question makes the collected private data available to the infected person.

Lockerpin

Lockerpin, which pretends to be yet another x-rated media content player, is distributed in a similar fashion. Reputable services like Google Play are not involved in the spreading process. This campaign, however, is a lot more hazardous because it exploits the stock screen lock features built into Android.

More than 75% of Lockerpin victims are from the United States. The malware gets administrator-level permissions on the device as the victim unknowingly confirms this, thinking it’s a harmless update that’s being approved. Owing to the admin privileges obtained this way, the applet modifies the PIN code, thus making it impossible to access the smartphone or tablet. Lockerpin demands a fine of 500 USD for purportedly viewing and storing prohibited material. When the infected user tries to disable Device Admin for the Trojan, a call-back function will automatically restore the elevated permissions.

This infection has introduced a more sophisticated modus operandi to the Android lock screen malware environment since the locking principle no longer relies on just a recurrent triggering of the ransom warning at the foreground. Without root privileges in place, the victim cannot uninstall the malware because it overlays the Device Administrator window with a fake one. Therefore, tapping “Continue” simply reactivates the Trojan’s privileges.

The malicious app can be safely removed in the event the Android device had been rooted before the attack. All it takes to get the job done in these favorable circumstances is launch ADB (Android Debug Bridge), enable debugging and obliterate all files related to the ransomware. Also, the user may be able to reset the PIN if an MDM (mobile device management) tool is running on the gadget. A factory reset fixes the problem as well, but it erases the victim’s files.

The ransomware also adopts antivirus evasion techniques. In particular, it terminates the executables of ESET Mobile Security, Avast Mobile Security and Dr.Web for Android.

Simplocker

This sample is the first-ever Android ransomware that encrypts files. It emerged from the Russian underground forum and was originally spotted in the wild in summer 2014. Simplocker represents the Reveton family known for coining the infamous police ransomware. It denoted a revolutionary transition of crypto malware from Windows to Android. This pest locates files with certain extensions on the SD card, then leverages the AES algorithm to encode them, and ultimately triggers an extortion routine for data decryption. The compromised user is tricked into thinking the gadget was blocked by a law enforcement agency due to allegedly detected illegal activity involving child pornography or a similar felony. This is intrinsic to the aforementioned police ransomware. For the sake of persuasiveness, Simplocker displays camera feed from the targeted phone or tablet.

The first edition of this Trojan featured geo-restricted propagation. It only targeted Android users in Ukraine and Russia, and the ransom instructions were in Russian. The fee amounted to the local currency equivalent of 21 USD, and the victims could pay it using the MoneXy service. The files ciphered by this variant were easy to recover because the decryption key was hard-coded into the Trojan. Furthermore, the keys weren’t unique for every infected gadget.

The second iteration is more sophisticated. Its distribution scope expanded to more countries, and the ransom notes are in English. The decryption keys are unique for each smartphone, which makes recovery barely feasible. The ransom amounts to 300 USD, and the infected users are supposed to submit it via MoneyPak pre-paid service.

The Simplocker payload is deposited onto Android devices through a fake Flash Player installation. The would-be victims get a misleading popup alert that promotes the shady setup, stating that it’s mandatory for watching videos. If the ad is clicked and the installation begins, the phony Flash Player requests administrative privileges, which ultimately leads to the deployment of the crypto attack behind the scenes.

The malady reaches out to its C2 server every 60 minutes. When the connection is first established, it transmits identification data which is unique to the specific gadget, such as the OS, BUILD_ID, IMEI, PhoneNumber, OperatorName, etc. This Command and Control server, which is hosted on Tor anonymity network, subsequently issues the details for decryption after the victim submits the ransom.

Android Defender

This one surfaced back in 2013. Android Defender is believed to be a pioneer in the array of mobile ransomware plagues accommodating rogue antivirus characteristics and the capability of locking the screen of an infected smartphone. This app is distributed via multiple shady sites, but Google’s Play Store never was one of them. Users are duped into downloading something they think is Skype with a free phone call feature.

The app operates similarly to fake antivirus programs. Victims are told their gadget is infected with malware, and they need to pay 129 USD to resolve the issue, which is essentially a removal of nonexistent viruses. To appear trustworthy, the offending applet pretends to detect Android infections that exist, including Android.MailStealer. Android Defender’s APK file contains an XML data file that stores the names of bogus threats reported by this malware. The purported malware database seems to increase in size every time a daily “update” completes, but that’s just an effect from Java pseudorandom number generator functioning and not the real update.

The pest modifies some of the operating system settings so that the infected person is unable to do a factory data reset. The user may, therefore, have to perform a hard reset by connecting the gadget to a desktop computer. If something goes wrong during this process, the device may become inoperable.

The harmful program cannot be uninstalled by regular means. The threat prevents other apps from being executed, and causes system crashes once in a while. Overall, Android Defender disrupts the functioning of the mobile device, reports imaginary problems on purpose and acts as a ransomware threat.

If the victim refuses to pay, the app offers a discount, and the amount goes down to 89 USD. No matter how much you pay, though, you get nothing useful in return except a relief from discontinued popup alerts. The good news is that the malware has reportedly attacked only about 50 devices, and the criminals weren’t very professional as they didn’t even get the payment page working properly.

Android Ransomware Prevention

Keep your Android software up to date.
Stay away from apps distributed on unfamiliar websites. Most ransomware samples emanate from application downloads available on freeware sites as well as third-party app stores.
Be sure only to install apps from reputable stores like Google Play or Amazon Appstore. Be advised, though; that caution won’t hurt even if you stick with trustworthy sites like these. Scrutinize every applet and resort to user reviews before making up your mind.
Examine the set of permissions requested by every app.
Use a reliable mobile security suite.
Make regular backups.

Read More Add comment

Subscribe to: Posts ( Atom )