Posts Tagged


7 Free Bootable Antivirus Disks to Clean Malware From Your PC

Your antivirus or antimalware suite keeps your system clean. At least, it does most of the time. Security programs are better than ever, but some malware still squeezes through the gaps. There is also the other common issue: the human touch. Where there is a human, there is a chance for malware to slip through.

When that happens, you can reach for a bootable antivirus disk. A bootable antivirus disk is a malware removal environment that works like a Linux Live CD or USB. Here are seven free bootable antivirus disks you should check out.

1. Kaspersky Rescue Disk

kaspersky rescue disk scan tool

The Kaspersky Rescue Disk is one of the best bootable antivirus disks, allowing you to scan an infected machine with ease. The Kaspersky Rescue Disk scanner has a reasonable range of antivirus scanning options, including individual folder scanning, startup objects, system drive, and fileless objects. You can also scan your system boot sectors, which is a nice option to find stubbornly hidden malware.

That said, the Kaspersky Rescue Disk does come with a smattering of additional tools, such as Firefox, a file manager, and more.

Another handy Kaspersky Rescue Disk feature is the graphic or text-based interface. For most users, the GUI is the best option, but the text-only mode is available for low power machines or otherwise.

Kaspersky consistently achieves high scores in antivirus testing, and the Kaspersky Rescue Disk brings that to you in a bootable format. Kaspersky also features in our list of the best antivirus suites for Windows 10.

Download: Kaspersky Rescue Disk (Free)

2. Bitdefender Rescue CD

Bitdefender Rescue CD is of the same ilk as Kaspersky’s offering. It is a large download, has a simple to use UI, and comes with several antivirus scan options to help you figure out what’s wrong with your system.

The scanning interface is easy to navigate, allowing you to exclude certain file types, scan archive files (such as a .ZIP or .7z), scan files below a particular size, or just drag and drop individual files into the scanner. For the most part, however, the standard scan is fine as you want to make sure your system is free of malware.

Also included in the Bitdefender Rescue CD is Firefox, a file browser, disk recovery tool, and a few other utilities.

The major downside to Bitdefender Rescue CD is that it is no longer updated; therefore, the virus signatures are outdated. Still, it is a decent rescue disk.

Download: Bitdefender Rescue CD (Free)

3. Avira Rescue System

Avira Rescue System is an Ubuntu-based bootable antivirus rescue disc. The Avira Rescue Disc is one of the best bootable antivirus environments for beginners, as it includes a handy guide to walk you through scanning your drives. Moreover, Avira offers very little in the way of scan customization. Again, this might suit a beginner, as there is less chance of turning part of a scan off and missing a malicious file.

The Avira Rescue System environment is easy to navigate, with a streamlined interface of labeled boxes. Like the other options, the Avira Rescue System includes a web browser and a disk partitioning tool amongst others.

As Avira is an Ubuntu-based rescue disk, it also works well with Linux-based systems.

Download: Avira Rescue System (Free)

4. Trend Micro Rescue Disk

From three of the largest bootable antivirus rescue disks to the smallest. The Trend Micro Rescue Disk may well be the smallest bootable antivirus disk on this list, but it packs a handy punch that will help you regain control of your system.

Given its size (around 70MB at the time of writing), you can forgive that the Trend Micro Rescue Disk has no graphical user interface. Instead, you use the rescue disk exclusively through plain text menus. It sounds a little daunting. But in practice, the text menus are simple to navigate, and you will find your way through.

Download: Trend Micro Rescue Disk for Windows (Free)

5. Dr.Web Live Disk

Despite the slightly suspect name (Dr.Web sounds like a phony internet firm, to me at least), Dr.Web Live Disk offers a wide range of antivirus scanning options in its bootable antivirus environment. In comparison with the alternatives, Dr.Web’s range of scanning options is extensive.

For instance, you can configure the types and sizes of files for inclusion and exclusion. You can set individual actions for specific types of malware, such as a bootkit, dialer, adware, and so on. You can also limit the amount of time the virus scan spends on individual files, handy if you have multiple large media file types.

Dr.Web Live Disk has another string in its bow, too: you can use it to scan Linux systems.

Download: Dr.Web Live Disk (Free)

6. AVG Rescue

avg rescue disk menu

AVG is one of the most recognizable names in security. The AVG Rescue disk has a very basic, text-only interface, but it does allow for customizable scanning.

For instance, you can mount a specific Windows volume and scan only that, or scan specific files within that volume. Alternatively, you can scan Windows Startup objects or even just the Windows Registry to seek out specific malware types. (Should you clean the Windows Registry

Using Registry Cleaner: Does Is It Really Make a Difference?

Using Registry Cleaner: Does Is It Really Make a Difference?

Advertisements for registry cleaners are all over the Web. There’s an entire industry out there bent on convincing inexperienced computer users that their registry needs fixing, and that, for ten easy payments of $29.95, their…
Read More

, anyway?) In addition, AVG Rescue comes with a few diagnostic and analytical tools to help you fix drive specific issues, rather than just straight-up malware.

The very basic text interface won’t be everyone’s cup of tea. Having to navigate back and forth through the interface using the arrow keys is infuriating at times. But, given the range of options available and the accuracy of the AVG Rescue disk scanner, you might overlook the arrow keys.

Download: AVG Rescue (Free)

7. ESET SysRescue Live

run eset sys rescue disk

The final bootable antivirus disk for your consideration is ESET SysRescue Live, an advanced antivirus rescue disk with lots of features.

ESET SysRescue Live comes with extensive antivirus scan control. You can scan archives, email folders, symbolic links, boot sectors, and more, or use the ESET scan profiles. The ESET SysRescue Live disk also packs in a disk analysis tool to check for defects and other failures, plus a memory test tool to check your system RAM for errors.

The rescue environment also comes with the Chromium browser, partition manager GParted, TeamViewer for remote system access, and a smattering of other handy utilities.

Download: ESET SysRescue Live (Free)

What Is the Best Free Bootable Antivirus Disk?

For me, the best free bootable antivirus disk is a toss-up between Kaspersky Rescue Disk and Dr.Web Live Disk.

The Kaspersky Rescue Disk is cumbersome but effective, updating regularly and backed with Kaspersky’s excellence in the field of security. But it doesn’t have the same extensive functionality as the Dr.Web Live Disk. While the latter cannot truly compete with Kaspersky on scanning terms alone, the scanning options available in the Dr.Web Live Disk make it a handy tool.

Regarding the other tools, all are strong and will clean your system. Depending on the severity of the malware, you could download two bootable antivirus disks and run them one after the other to make sure nothing slips through the net.

For more malware removal advice, check out our malware removal guide

The Complete Malware Removal Guide

The Complete Malware Removal Guide

Malware is everywhere these days, and eradicating malware from your system is a lengthy process, requiring guidance. If you think your computer is infected, this is the guide you need.
Read More


Image Credit: Asiorek/Depositphotos

Source link

Is Linux Really Immune to Viruses and Malware? Here’s the Truth

One reason people switch to Linux is to have better security. Once you switch to Linux, the thinking goes, you no longer have to worry about viruses and other types of malware. But while this is largely true in practice, desktop Linux isn’t actually all that secure.

If a virus wants to wreck shop on your free and open source desktop, there’s a good chance that it can.

Why Malware Is Less Common on Linux Desktops

Person in shadow looking at computer monitors
Image Credit: Kevin Horvat/Unsplash

Malware is unwanted code that somehow made its way onto your computer in order to perform functions designed with malicious intent. Sometimes these programs slow down a machine or cause it to crash entirely. The creators may then demand a ransom in order to fix the machine.

Sometimes malware uploads information to remote servers, giving someone access to your saved data or vital credentials that you type, such as passwords and credit card numbers.

People tend to create malware for Windows because that’s the operating system found on the most PCs. This increases the odds that a virus will spread from one computer to another.

Virus makers tend to target less technical users that are easier to fool with bogus web banners and phishing scams. Viruses also spread among people who know how to pirate music and TV shows but don’t understand how these files may be infected.

There are antivirus programs for Linux

The 6 Best Free Linux Antivirus Programs

The 6 Best Free Linux Antivirus Programs

Think Linux doesn’t need antivirus? Think again. These free antivirus tools can ensure your Linux box remains virus-free.
Read More

, but even their purpose is often to help protect Windows users.

Linux Desktop Malware Exists, But It’s Rare

One piece of malware has recently made news for targeting the Linux desktop. EvilGNOME runs on the GNOME desktop environment by pretending to be an extension.

GNOME is the most common Linux desktop environment

GNOME Explained: A Look at One of Linux’s Most Popular Desktops

GNOME Explained: A Look at One of Linux’s Most Popular Desktops

You’re interested in Linux, and you’ve come across “GNOME”, an acronym for GNU Network Object Model Environment. GNOME is one of the most popular open source interfaces, but what does that mean?
Read More

, found as the default interface on two of the most popular Linux distros, Ubuntu and Fedora, and on computers that ship directly from Linux manufacturers such as System76 and Purism. Legitimate extensions allow you to alter many aspects of the GNOME desktop.

The malware known as EvilGNOME is able to take screenshots and record audio from your PC’s microphone. It can also upload your personal files. A more detailed breakdown is available in a report by Intezer Labs, who gave EvilGNOME its name.

This malware didn’t attract attention for being particularly likely to impact large numbers of people. It was considered newsworthy because it existed at all.

Most Linux Malware Targets Servers

A datacenter room with server racks
Image Credit: Taylor Vick/Unsplash

Linux is relatively rare on desktops, but it’s the most prominent operating system found on servers powering the web and managing much of the world’s digital infrastructure.

Many attacks target websites rather than PCs. Hackers often look for vulnerabilities in network daemons that they can use to gain access to Linux-powered servers. Some will install a malicious script on a server that then targets visitors rather than the system itself.

Hacking Linux-powered machines, whether they are servers or IoT devices, is one way to go about infecting the web or creating botnets.

Linux’s Design Is Not Inherently Secure

Desktop Linux in its current form is hardly a fortress. Compared to Windows XP, where malicious software could gain administrator access without prompting for a password, Linux offered much better security. These days, Microsoft has made changes to close that gap. Since Vista, Windows has issued a prompt.

Yet fretting about the security of system files almost misses the point. Most of the data we care about isn’t saved in our root system folders. It’s the personal data in our home directory that’s irreplaceable and most revealing. Software on Linux, malicious or otherwise, doesn’t need your password to access this data and share it with others.

User accounts can also run scripts that activate your microphone, turn on your webcam, log key presses, and record what happens onscreen.

In other words, it almost doesn’t matter how secure the Linux kernel is, or the safeguards surrounding various system components, if it’s the vulnerabilities in apps and the desktop environment that can put the data you care most about at risk.

EvilGNOME doesn’t install itself among your system files. It lurks in a hidden folder in your home directory. On the positive side, that makes it easier to remove. But you have to first know it’s there.

4 Reasons Why Linux Relatively Safe to Use

While Linux isn’t immune to exploits, in day-to-day use, it still provides a much safer environment than Windows. Here are a few reasons why.

1. Multiple Distros, Environments, and System Components

App developers have a hard time developing for Linux because there are so many versions to support. The same challenge faces malware creators. What’s the best way to infiltrate someone’s computer? Do you sneak code in the DEB or RPM format?

You may try to exploit a vulnerability in the Xorg display server or in a particular window compositor, only to find that users have something else installed.

2. App Stores and Package Managers Shield Linux Users

Traditional Linux package management systems put app maintainers and reviewers between users and their software source. As long as you get all of your software from these trusted sources, you’re very unlikely to run into anything malicious.

Avoid copying and pasting command line instructions to install software, especially when you don’t know exactly what the command is doing and you’re unsure of the source.

3. Newer Technologies Actively Consider Security

New app formats like Flatpak and Snap introduce permissions and sandboxing, limiting what apps can access. The new Wayland display server can prevents apps from taking screenshots or recording happens onscreen, making it harder to exploit.

4. The Source Code Is Open for Anyone to Read

The primary advantage of Linux comes from being able to view the code. Since Linux is open source rather than proprietary, you don’t have to worry about the desktop itself working against you, acting as spyware itself or suffering from exploits that haven’t been disclosed for commercial reasons.

Even if you can’t make sense of the code, you can read the blog posts or reports by someone that does.

Should You Be Afraid of Linux Malware?

It’s a myth that Linux users don’t have to worry about viruses, but if you stick to your distro’s app stores or other trusted sources such as Flathub, you’re unlikely to stumble across anything dangerous.

No matter which operating system you use, it’s important that you adopt safe digital habits. Don’t make the mistake of believing that switching to Linux means you can download from sketchy sites without concern.

Yet for most of us, the biggest risk probably isn’t malware. If you’ve created a large number of online accounts or depend on cloud services, phishing scams are a much larger threat

How to Spot a Phishing Email

How to Spot a Phishing Email

Catching a phishing email is tough! Scammers pose as PayPal or Amazon, trying to steal your password and credit card information, are their deception is almost perfect. We show you how to spot the fraud.
Read More

to your data, whether or not you use Linux.

Source link

This VPN Blocks Malware Using a Database of 3.5 Million Known Threats

When you work online, security is pretty important. The last thing you want is client information or financial data to be stolen by a hacker on a coffee shop Wi-Fi network. For this reason, using a VPN is a wise move for any desk worker. The KeepSolid App Bundle helps you stay protected and productive, with two years of service with VPN Unlimited and a selection of useful apps. You can get it now for $59.99 at MakeUseOf Deals.

Security and Productivity

As the name suggests, VPN Unlimited offers online security without limits. By re-routing your connection, the app helps you stay anonymous and secure online. You can select the VPN protocol you trust the most, and choose from 70 server locations around the world.

On mobile, KeepSolid Private Browser applies AES-256 encryption to all browsing traffic. It also provides full VPN protection on up to 25 tabs and five devices. With this deal, you get two years of service.

The bundle also contains two years of KeepSolid Sign and KeepSolid Roadmap Planner. The former provides an easy platform for collecting signatures for contracts and other paperwork, with full AES-256 encryption. Meanwhile, Roadmap Planner helps you map out the direction and timescales of any project.

Four Apps for $59.99

Order now for $59.99 to get two years of access to these four great KeepSolid apps.

Source link

How to Spot and Remove Agent Smith Malware on Android

A new malware type targeting smartphones has infected some 25 million devices, 15 million of which are in India. The malware is dubbed “Agent Smith.” It targets the Android mobile operating system, replacing installed apps with a malicious version without alerting the user.

Here’s how you spot Agent Smith, how to stop it, and how to protect against Android malware.

What Is Agent Smith Malware?

Agent Smith is a modular malware that exploits a series of Android vulnerabilities to replace legitimate existing apps with a malicious imitation. (What is modular malware, anyway

Modular Malware: The New Stealthy Attack Stealing Your Data

Modular Malware: The New Stealthy Attack Stealing Your Data

Malware has become more difficult to detect. What is modular malware, and how you stop it wreaking havoc on your PC?
Read More

?) The malicious app doesn’t steal data. Instead, apps replaced display a huge number of adverts to the user or steal credit from the device to pay for adverts already served.

The malware carries the “Agent Smith” moniker, the same name as the infamous Matrix character who is characterized as a virus. The Check Point research team reason that the methods the malware uses to propagate are similar to Agent Smith’s techniques in the film series.

“The malware attacks user-installed applications silently, making it challenging for common Android users to combat such threats on their own,” says Check Point Software Technologies Head of Mobile Threat Detection Research Jonathan Shimonovich in the blog post. “Combining advanced threat prevention and threat intelligence while adopting a ‘hygiene first’ approach to safeguard digital assets is the best protection against invasive mobile malware attacks like “Agent Smith.”

Moreover, Agent Smith has infected a huge number of devices. India has by far the most infections. The Check Point research indicates some 15 million devices carrying Agent Smith. The next closest country is Bangladesh, with around 2.5 million devices infected. There were over 300,000 Agent Smith infections in the US and around 137,000 in the UK.

agent smith list of infections

How Does the Agent Smith Malware Work?

Check Point Research believe the Agent Smith malware originates from a Chinese company that helps Chinese Android developers publish and promote apps in foreign markets.

The malware first appeared on the third-party app store “9Apps.” The third-party app store targets Indian, Arabic, and Indonesian users, explaining the significant number of infections in those areas. (It is a good reason to avoid downloading Android apps from third-party app stores

Is It Safe to Install Android Apps from Unknown Sources?

Is It Safe to Install Android Apps from Unknown Sources?

The Google Play Store isn’t your only source of apps, but is it safe to search elsewhere?
Read More


Agent Smith malware works in three phases.

  1. A dropper app lures the victim to install the malware voluntarily. The initial dropper contains encrypted malicious files and usually takes the form of “barely functioning photo utility, games, or sex-related apps.”
  2. The dropper decrypts and installs the malicious files. The malware uses Google Updater, Google Update for U, or “” to disguise its activity.
  3. The core malware creates a list of installed apps. If an app matches its “prey list,” it patches the target app with a malicious advertising module, replacing the original as if it was a simple app update.

agent smith how malware works

The prey list includes WhatsApp, Opera, SwiftKey, Flipkart, and Truecaller, among others.

Interestingly, Agent Smith bundles together several Android vulnerabilities, including Janus, Bundle, and Man-in-the-Disk. The combination creates a 3-stage infection process allowing the malware distributor to build a monetized (via adverts) botnet. The Check Point research team believe Agent Smith is “possibly the first campaign seen that integrates and weaponized” all the vulnerabilities together, making the malware “as malicious as they come.”

Agent Smith Malware Modules

Agent Smith malware uses a modular structure to infect targets, consisting of:

  • Loader
  • Core
  • Boot
  • Patch
  • AdSDK
  • Updater

agent smith malware modular structure

The dropper is a repackaged legitimate application that also contains the malicious loader.

The loader extracts and runs the Core module, which in turn communicates with the malware command and control (C&C) server. The C&C server sends the prey list. If any apps are found, the malware uses a vulnerability to inject the Boot module into the repackaged application.

The next time the infected application starts, the Boot module runs the Patch module, which uses the AdSDK module to introduce the adverts and begin generating revenue.

Another interesting element of Agent Smith is that it doesn’t stop at one malicious app. If Agent Smith finds multiple app matches on the prey list, it will replace each one with a malicious version. Agent Smith also issues malicious update patches to the repackaged apps, keeping the infection going, and serving new advertising packages.

Removing Agent Smith Apps From Google Play

The main point of infection for Agent Smith was third-party app store, 9Apps. However, Google Play wasn’t untouched. Check Point discovered 11 apps on the Google Play store containing a “malicious yet dormant” set of files relating to the Agent Smith actor. The Google Play versions of Agent Smith use a slightly different propagation technique but have the same end-goal.

Check Point reported the malicious apps to Google, and all were removed from the Google Play store.

How to Spot and Remove Agent Smith From Android

You can spot Agent Smith fairly easily. If your regularly used apps suddenly start producing an overwhelming amount of adverts, it is a sure sign something is wrong. The ads the malware serves are difficult or impossible to exit, which is another indicator. But as Agent Smith acts almost silently bar the adverts, picking up on subtle changes to your apps is incredibly difficult.

Please note that apps suddenly displaying a huge volume of adverts isn’t the solo marker of Agent Smith. Other Android malware types serve adverts to increase revenue. Your device could have a different type of Android malware.

If you suspect something is wrong, you should complete an antimalware or antivirus scan on your device

The Complete Malware Removal Guide

The Complete Malware Removal Guide

Malware is everywhere these days, and eradicating malware from your system is a lengthy process, requiring guidance. If you think your computer is infected, this is the guide you need.
Read More


The first port of call is Malwarebytes Security, the Android version of the excellent antimalware tool. Download Malwarebytes Security and run a full system scan. It should catch and remove any malicious apps.

Download: Malwarebytes Security (Free, subscription available)

If Agent Smith or other Android malware persists, we strongly advise checking our guide to removing Android malware without a factory reset

How to Remove a Virus From Your Android Phone Without a Factory Reset

How to Remove a Virus From Your Android Phone Without a Factory Reset

Need to remove a virus from your Android phone? We show you how to clean your phone from a virus without a factory reset.
Read More

. It features more Android malware removal apps as well as a step-by-step guide to cleaning your device—without deleting any data!

Source link

Malware in Your Pirated Software

Researchers at ESET and Malwarebytes have discovered crypto mining malware hidden in pirated music production software. The pirated software loads the malware in an emulated copy of Linux and can infect Windows, Linux, and even MacOS.

Downloading pirated software is generally a bad thing to do. Not only does it deprive developers of earnings for their hard work, but you may also put yourself at risk in the process. Case in point, researchers at ESET and Malwarebytes, recently published findings of malware they’ve dubbed Loud Miner and Bird Miner respectively.

From what we can tell, they’re looking at the same malware, as nearly all details line up. The companies found crypto miners hidden in pirated copies of music production software known as Ableton Live.

Ableton Live is a high-end audio software and is known to be, out of necessity, processor intensive to use. That fact makes it a perfect targets for the malware developers, as they can surmise that anyone that wants to the software will have powerful processors (useful for crypto mining), and may write off the heavy processor use from mining as the audio software doing its job.
The developers of the malware took novel steps to both infect as many people as possible and hide their true intentions.

The software creates an emulated copy of Linux, known as TinyCore, to run from, allowing to work across Windows, Linux, and Mac. And before it begins mining, it checks processor usage. If it detects 85% or more of the CPU in use, it waits to mine until more resources are available. The software also closes if certain tools, like Activity Monitor, are running that may reveal it.

Malwarebytes already updated its software to detect Birdminer, for anyone worried about infection. [TechRadar]

In Other News:

  • Apple launches a voluntary recall of some MacBooks: 15-inch MacBook Pros from mid-2015 are overheating. Drastically enough, Apple felt the need to do a recall. You can check Apple’s recall site to see if the recall includes your MacBook if it does you’ll get a new battery. Now if only Apple would recall its keyboards and replace it with something good. [9to5Mac]
  • Canadia’s largest credit union just revealed a massive breach: Desjardins, Canada’s largest credit union, revealed an employee leaked the personal information of 2.7 million people and over 170,000 businesses. The bank fired the employee and is offering monitoring services to everyone impacted. They say you shouldn’t stash cash in a mattress, but sometimes it sounds tempting. [ZDNet]
  • Google is exiting the tablet business: The lead engineer for Google’s hardware division has confirmed the company no longer plans to make tablets. The decision included canceling two projects already in the works. If we’re honest, there’s no great Android out there, and the OS is half the problem. So losing Google tablets isn’t a huge loss. Other manufacturers will still fill in the gap anyway. [Ars Technica]
  • Windows 10 will tell if you the May 2019 Update is blocked: With any significant Windows 10 update, Microsoft likes to scan your PC for potential known problems with the update. If it finds a match, it blocks the update to prevent issues. That’s good, but until now you were told “no update available” which is slightly misleading. You may have thought the May 2019 Update wasn’t released. Now Windows will tell you that it’s blocked and give you a link to why. Good stuff. [TechRadar]
  • Esports comes back to the X Games: The X games stopped hosting esports about three years ago. Now they’re returning and the first game to be featured is rising battle royale star Apex Legends. The prize pot is over $150,000, and qualifiers are on June 29th so get your team together quickly. My first pick is Wraith, but I’ll settle for Bangalore. [Engadget]
  • Google Maps is filled with fake businesses: Google Maps is an easy place to check for a local plumber, electrician, or car repair shop. Unfortunately, many of these businesses are fake and lead to competitors, or are people posing as other businesses. It’s always a good idea to check more than one source when you need to find a repair service, especially one you invite into your home. And if you find a fake business, you should report it to Google[The Verge]
  • A survey indicates the Tesla Autopilot name may lead to overconfidence in the tech: The Insurance Institute for Highway Safety (IIHS) did a survey asking people how safe they felt using self-driving features like taking hands off the wheel, talking on the phone or sleeping. The study gave participants the names of several competing technologies (Autopilot, Supercruise, etc.) but no manufacturer names or explanations of capabilities. Autopilot scored much higher in trust even in actions it’s clearly not designed, like napping, which is disconcerting. What’s in a name exactly? [IIHS]

You may have seen the news that smartphone users are growing a skull horn in the back of their head. The research comes from a chiropractor and associate professor of biomechanics and has the studied abnormally large bony structures in the base of some people’s skulls.

While the study hypothesized that the cause was bad posture from staring at smartphones and tablets, it failed to do several things to establish that theory.

For instance, the study focused solely on people who were already visiting chiropractors due to severe pain, likely increasing the sample set of people with strange bone growth. It also didn’t control for people who did and didn’t use smartphones, meaning it has nothing to compare the data to at all.

Proper research needs large sample sets, with controls, and correlating data. Even with all of that in place, mistakes happen, and studies can and do draw incorrect conclusions, which is why we also repeat research to reproduce results.

So if you’re worried (or hopeful) your curled up smartphone posture might cause you to grow a horn, you can stop. But maybe sit straight anyway, you’re gonna throw your back out. And if you don’t stop crossing your eyes, they’re going to get stuck that way. [Gizmodo]

Source link

That malware with its own backdoor into Android’s framework? Don’t worry Google’s on it. (Gulp!)

Google last week (June 6) confirmed that cyberthieves had managed to pre-install malware into the Android framework backdoor. In short, the malware appeared to be blessed by Google at the deepest point within Android.

“In the Google Play app context, installation meant that [the malware] didn’t have to turn on installation from unknown sources and all app installs looked like they were from Google Play,” wrote Lukasz Siewierski, of the Android security and privacy team, in a blog post. “The apps were downloaded from the C&C server and the communication with the C&C was encrypted using the same custom encryption routine using double XOR and zip. The downloaded and installed apps used the package names of unpopular apps available on Google Play. They didn’t have any relation to the apps on Google Play apart from the same package name.”

Enterprise CISOs and CSOs, along with CIOs, are discovering that trusting the major mobile operating system companies today — Apple and Google — to handle their end of security protections is foolhardy. Due to the nature of the Apple ecosystem (a total of one handset maker, which allows for a much more closed system), iOS is slightly more secure, but only slightly.

Still, Google’s new admission certainly makes Apple look a little better in the security area. The issue isn’t with the operating systems per se — both iOS and Android have reasonably secure code. It’s with apps offered to enterprises and consumers through the officially sanctioned app depositories. Enterprise security pros already know that neither Apple nor Google does a heck of a lot to validate the security of the apps. At best, both are checking for policy and copyright issues far more than the presence of malware.

But that’s dealing with true third-party apps. Apps coming directly from Apple and Google can be trusted — or so was thought until Google’s disclosure.

The incident that Google admitted happened some two years ago, and the blog post didn’t say why Google didn’t announce it at the time, or why it chose to now. It might be that Google wanted to make sure it had sufficiently closed this hole before announcing it, but two years is an awfully long time to know about this serious a hole and be silent about it.

So what actually happened? Google gets points for publishing lots of details. The background to Google’s story begins a year earlier than this — so, three years ago —  with a series of spam ad-displaying apps called Triada.

“The main purpose of Triada apps was to install spam apps on a device that displays ads,” Siewierski wrote. “The creators of Triada collected revenue from the ads displayed by the spam apps. The methods Triada used were complex and unusual for these types of apps. Triada apps started as rooting trojans, but as Google Play Protect strengthened defenses against rooting exploits, Triada apps were forced to adapt, progressing to a system image backdoor.”

Siewierski then detailed the app’s methodology: “Triada’s first action was to install a type of superuser (su) binary file. This su binary allowed other apps on the device to use root permissions. The su binary used by Triada required a password, so was unique compared to regular su binary files common with other Linux systems. The binary accepted two passwords: od2gf04pd9 and ac32dorbdq. Depending on which one was provided, the binary either ran the command given as an argument as root or concatenated all of the arguments, ran that concatenation preceded by sh, then ran them as root. Either way, the app had to know the correct password to run the command as root.”

The app used an impressively sophisticated system to free up the space it needed, but avoiding — to the extent it could — deleting anything that would alert IT or the consumer to a problem. “Weight watching included several steps and attempted to free up space on the device’s user partition and system partition. Using a blacklist and whitelist of apps, it first removed all the apps on its blacklist. If more free space was required, it would remove all other apps leaving only the apps on the whitelist. This process freed space while ensuring the apps needed for the phone to function properly were not removed.” He also noted that “in addition to installing apps that display ads, Triada injected code into four web browsers: AOSP (, 360 Secure (com.qihoo.browser), Cheetah (com.ijinshan.browser_fast) and Oupeng (com.oupeng.browser).”

At that point, Siewierski wrote, Google detected the malware efforts and was able to remove Triada samples using Google Play Protect and tried to thwart Triada in other ways. That’s when Triada fought back, around the summer of 2017. “Instead of rooting the device to obtain elevating privileges, Triada evolved to become a pre-installed Android framework backdoor. The changes to Triada included an additional call in the Android framework log function. By backdooring the log function, the additional code executes every time the log method is called. That is, every time any app on the phone tries to log something. These log attempts happen many times per second, so the additional code [was] running non-stop. The additional code also executes in the context of the app logging a message, so Triada can execute code in any app context. The code injection framework in early versions of Triada worked on Android releases prior to Marshmallow. The main purpose of the backdoor function was to execute code in another app’s context. The backdoor attempts to execute additional code every time the app needs to log something.”

The malware then got creative about finding ways to avoid — or to at least delay — detection.

“Each MMD file had a specific file name of the format <MD5 of the process name>36.jmd. By using the MD5 of the process name, the Triada authors tried to obscure the injection target. However, the pool of all available process names is fairly small, so this hash was easily reversible. We identified two code injection targets: (the System UI app) and (the Google Play app). The first target was injected to get the GET_REAL_TASKS permission. This is a signature-level permission, which means that it can’t be held by ordinary Android apps. Starting with Android Lollipop, the getRecentTasks() method is deprecated to protect users’ privacy. However, apps holding the GET_REAL_TASKS permission can get the result of this method call. To hold the GET_REAL_TASKS permission, an app has to be signed with a specific certificate, the device’s platform cert, which is held by the OEM. Triada didn’t have access to this cert. Instead it executed additional code in the System UI app, which has the GET_REAL_TASKS permission.”

The malware had one more trick up its evil sleeve. “The last piece of the puzzle was the way the backdoor in the log function communicated with the installed apps. This communication prompted the investigation: the change in Triada made it appear that there was another component on the system image. The apps could communicate with the Triada backdoor by logging a line with a specific predefined tag and message. The reverse communication was more complicated. The backdoor used Java properties to relay a message to the app. These properties were key-value pairs similar to Android system properties, but they were scoped to a specific process. Setting one of these properties in one app context ensures that other apps won’t see this property. Despite that, some versions of Triada indiscriminately created the properties in every single app process.”

At the end of the post — which has a lot more code included and is worth a thorough read — Google offers some thoughts on next steps. Look carefully at its suggestions and see if you can detect who seems to emerge blameless from all of this? From Google’s suggestions: “OEMs should ensure that all third-party code is reviewed and can be tracked to its source. Additionally, any functionality added to the system image should only support requested features. It’s a good practice to perform a security review of a system image after adding third-party code. Triada was inconspicuously included in the system image as third-party code for additional features requested by the OEMs. This highlights the need for thorough ongoing security reviews of system images before the device is sold to the users as well as any time they get updated over-the-air (OTA).”

That’s fair, but who exactly is supposed to be doing these ongoing security reviews? Surely, Google isn’t suggesting that something so important should be left in the hands of OEMs unchecked. I conclude that Google will be adding extensive resources to its own security teams, to make sure that nothing such as this happens gets through the OEM checkpoints.

There is an issue of trusting Google — and Apple — when it comes to making sure that mobile operating systems and the associated apps are secure. OEMs have very little ROI to justify big security investments. The buck must top with Google. I don’t seem to recall BlackBerry having too many of these kinds of issues, and that was because, as a company, it prioritized security. (OK, perhaps it should have spared a bit of that priority for marketing, but I digress.)

If Google doesn’t do more for security, CIOs/CISOs/CSOs are going to either have to take on this task themselves — or seriously question which MOS they can justify supporting.

Source link

What Is Code-Signed Malware and How Do You Avoid It?

Code signing is the practice of cryptographically signing a piece of software so that the operating system and its users can verify that it is safe. Code signing works well, by and large. The majority of the time, only the correct software uses its corresponding cryptographic signature.

Users can download and install safely, and developers protect the reputation of their product. However, hackers and malware distributors are using that exact system to help malicious code slip past antivirus suites and other security programs.

How does code-signed malware and ransomware work?

What Is Code Signed Malware?

When software is code-signed, it means that the software carries an official cryptographic signature. A Certificate Authority (CA) issues the software with a certificate confirming that the software is legitimate and safe to use.

Better still, your operating system takes care of the certificates, code checking, and verification, so you don’t have to worry. For instance, Windows uses what is known as a certificate chain. The certificate chain consists of all the certificates needed to ensure the software is legitimate at every step of the way.

“A certificate chain consists of all the certificates needed to certify the subject identified by the end certificate. In practice, this includes the end certificate, the certificates of intermediate CAs, and the certificate of a root CA trusted by all parties in the chain. Every intermediate CA in the chain holds a certificate issued by the CA one level above it in the trust hierarchy. The root CA issues a certificate for itself.”

When the system works, you can trust software. The CA and code signing system require a huge amount of trust. By extension, malware is malicious, untrustworthy, and should not have access to a Certificate Authority or code signing. Thankfully, in practice, that is how the system works.

Until malware developers and hackers find a way around it, of course.

Hackers Steal Certificates From Certificate Authorities

Your antivirus knows that malware is malicious because it has a negative effect on your system. It triggers warnings, users report problems, and the antivirus can create a malware signature to protect other computers using the same antivirus tool.

However, if the malware developers can sign their malicious code using an official cryptographic signature, none of that will happen. Instead, the code-signed malware will walk through the front door as your antivirus and the operating system rolls out the red carpet.

Trend Micro research found that there is an entire malware market supporting the development and distribution of code-signed malware. Malware operators gain access to valid certificates which they use to sign malicious code. The following table shows the volume of malware using code signing to evade antivirus, as of April 2018.

trend micro code signed malware type table

The Trend Micro research found that around 66 percent of the malware sampled was code-signed. Furthermore, certain malware types come with more code signing instances, such as Trojans, droppers, and ransomware. (Here are seven ways to avoid a ransomware attack

7 Ways to Avoid Being Hit by Ransomware

7 Ways to Avoid Being Hit by Ransomware

Ransomware can literally ruin your life. Are you doing enough to avoid losing your personal data and photos to digital extortion?
Read More


Where Do Code Signing Certificates Come From?

Malware distributors and developers have two options regarding officially signed code. Certificates are either stolen from a Certificate Authority (directly, or for resale), or a hacker can attempt to mimic a legitimate organization and fake their requirements.

As you would expect, a Certificate Authority is a tantalizing target for any hacker.

It isn’t just hackers fueling the rise in code-signed malware. Allegedly unscrupulous vendors with access to legitimate certificates sell trusted code-signing certificates to malware developers and distributors, too. A team of security researchers from Masaryk University in the Czech Republic and Maryland Cybersecurity Center (MCC) discovered four organizations selling [PDF] Microsoft Authenticode certificates to anonymous buyers.

“Recent measurements of the Windows code signing certificate ecosystem have highlighted various forms of abuse that allow malware authors to produce malicious code carrying valid digital signatures.”

Once a malware developer has a Microsoft Authenticode certificate, they can sign any malware in an attempt to negate Windows security code-signing and certificate-based defense.

In other cases, rather than steal the certificates, a hacker will compromise a software build server. When a new software version releases to the public, it carries a legitimate certificate. But a hacker can also include their malicious code in the process. You can read about a recent example of this type of attack below.

3 Examples of Code-Signed Malware

So, what does code-signed malware look like? Here are three code-signed malware examples:

  1. Stuxnet malware. The malware responsible for destroying the Iranian nuclear program used two stolen certificates to propagate, along with four different zero-day exploits. The certificates were stolen from two separate companies—JMicron and Realtek—that shared a single building. Stuxnet used the stolen certificates to avoid the then newly-introduced Windows requirement that all drivers required verification (driver signing).
  2. Asus server breach. Sometime between June and November 2018, hackers breached an Asus server the company uses to push software updates to users. Researchers at Kaspersky Lab found that around 500,000 Windows machines received the malicious update before anyone realized. Instead of stealing the certificates, the hackers signed their malware with legitimate Asus digital certificates before the software server distributed the system update. Luckily, the malware was highly targeted, hard-coded to search for 600 specific machines.
  3. Flame malware. The Flame modular malware variant targets Middle Eastern countries, using fraudulently signed certificates to avoid detection. (What is modular malware, anyway

    Modular Malware: The New Stealthy Attack Stealing Your Data

    Modular Malware: The New Stealthy Attack Stealing Your Data

    Malware has become more difficult to detect. What is modular malware, and how you stop it wreaking havoc on your PC?
    Read More

    ?) The Flame developers exploited a weak cryptographic algorithm to falsely sign the code signing certificates, making it appear as if Microsoft had signed them off. Unlike Stuxnet which carried a destructive element, Flame is a tool for espionage, seeking out PDFs, AutoCAD files, text files, and other important industrial document types.

How to Avoid Code-Signed Malware

Three different malware variants, three different types of code signing attack.  The good news is that most malware of this type is, at least at the current time, highly targeted.

The flipside is that because of the success rate of such malware variants that use code signing to avoid detection, expect more malware developers to use the technique to make sure their own attacks are successful.

As well as this, protecting against code-signed malware is extremely difficult. Keeping your system and antivirus suite up to date is essential, avoid clicking on unknown links, and double-check where any link is taking you before following it.

Other than updating your antivirus, check our list of how you can avoid malware

Antivirus Software Isn’t Enough: 5 Things You Must Do to Avoid Malware

Antivirus Software Isn’t Enough: 5 Things You Must Do to Avoid Malware

Stay safe and secure online after installing antivirus software by following these steps for safer computing.
Read More


Explore more about: Malware, Online Security, Security Certificate.

Source link

How to Uninstall Chromium Malware in 4 Easy Steps

It’s cheap and easy for program developers to bundle their software with adware to make some extra cash. If you’re not paying attention, you might end up with more than you bargained for when you’re installing new software, thanks to pre-packaged malware.

Chromium malware is a pretty popular option for roguish developers to include. It may look almost like the real deal, but don’t be fooled—you’ll need to remove it if you want your PC to be safe to use. Let’s run through how to uninstall Chromium malware in four easy steps.

What Is Chromium Malware?

Chromium is Google’s open-source browser project, used as the basis of Google Chrome. Chromium malware is named after the project because malicious developers use that code to create fake Chrome web browsers.

They’ll have their own names (like BeagleBrowser and BoBrowser) but they’ll look a lot like Chrome on the surface. While there are other legitimate Chromium browsers

9 Alternative Chromium Browsers That Beat Chrome at Its Own Game

9 Alternative Chromium Browsers That Beat Chrome at Its Own Game

Google Chrome is the most popular browser today. But it has its problems too. These nine alternative browsers are lightweight and retain the technology that runs Chrome. Get the best of both worlds.
Read More

you could install, these aren’t it—they’re not designed to benefit the end user.

They’ll set your home page and default search engine to match a site that generates income if you use it. If you’re a Windows novice, you might not even realize it’s happened. They may also infect settings in other browsers, or infect your own Chrome installation with rogue third-party extensions.

You might install these browsers (or malicious extensions) accidentally from browser pop-ups, or they may come pre-packaged with other software.

Step 1: End Running Processes, Attempt Uninstall

Before you can start learning how to remove Chromium malware, you’ll need to check the software isn’t running. Some malware will be stubborn enough to continue running in the background when you close it. This is designed to stop you from being able to uninstall it.

Open up the task manager on your Windows PC by hitting Ctrl + Shift + Esc. You’ll see a list of running processes and open apps. Look for anything named Chromium or Chrome.

Select an unwanted process and hit Del. If it doesn’t close, right-click the process and select End Task. If the processes won’t close, head to the next step, as you’ll need some extra software to deal with the problem.

Windows 10 Task Manager Menu End Chrome Process

If the software closed, you’ll be able to begin uninstalling the malware. If you’re using Windows 10, hit Win + X > Settings before choosing Apps in the screen that appears. In the Apps & features list, find the name of your malicious malware and choose Uninstall.

Windows 10 Uninstall Apps Menu Chrome Uninstall

Step 2: Begin a Thorough Malware Scan

We’re going to assume, for argument’s sake, that any malware you have installed won’t neatly uninstall itself when you ask it to. For that reason, you’ll need to do a full scan of your PC for any malware, viruses, or other PUPs (potentially unwanted programs) hiding away.

Start by installing some malware removal tools

Easily Remove Aggressive Malware With These 7 Tools

Easily Remove Aggressive Malware With These 7 Tools

Typical free anti-virus suites will only be able to get you so far when it comes to exposing and deleting malware. These seven utilities will weed out and remove malicious software for you.
Read More

to help you search your system, especially if you find processes won’t terminate on your PC. Software like Rkill will terminate anything stubborn that won’t stop when you use the task manager. You can then attempt to uninstall malware-packaged Chromium installations using the method above.

You’ll also need to make sure you have a fully up-to-date antivirus installed. If you haven’t, install one of the best antivirus suites

The 10 Best Free Antivirus Software

The 10 Best Free Antivirus Software

No matter what computer you’re using, you need antivirus protection. Here are the best free antivirus tools you can use.
Read More

you can for your PC, either free or paid.

RogueKiller Anti Malware Standard Scan Screen

Start with a malware scan. If you’re using RogueKiller, open up the software and choose Standard Scan. It’ll then proceed to scan your PC for malware processes and files.

Once the process is complete, you’ll be asked if you want to review the results and remove any malware found, so confirm these if they appear.

If you’re using Malwarebytes, the process is similar. Hit Scan Now in the main dashboard menu, or goto Scan and select your chosen scan method. The full Threat Scan is recommended here.

Malwarebytes Anti Malware Scan Methods Selection Screen

Run similar scans using your chosen antivirus software, including a full boot scan. If you’ve only recently installed antimalware and antivirus software, these should now actively scan your PC on a regular basis to help avoid any future infections.

Step 3: Delete Your Chromium User Data Folder

While the malware scan should have removed any malicious Chromium malware it found, some lingering files may remain. This might include rogue settings and profiles that were created.

It’s better to be safe than sorry, so it’s time to go nuclear and erase your Chromium settings folder. Don’t be too concerned by this, as your standard Chrome browser will regenerate the folder when you run the program again.

As long as your Chrome browser isn’t running, hit Win + R and type %appdata% before hitting OK. This’ll take you to your Windows user AppData Roaming folder. Search for a folder named Chromium or, if your standard Chrome installation is infected, GoogleChrome.

Delete the folders, then do the same in the AppData Local folder with Win + R and %localappdata%.

Step 4: Reset Your Standard Chrome Installation

This step may not be necessary if you’ve been able to successfully remove the malware on your PC and you’ve erased your settings folder, but it’s better to be safe than sorry. If you’re running Chrome as your standard browser, you can reset it to its original settings inside Chrome itself.

This’ll remove any extensions or add-ons, remove your browser history, and log you out of any accounts. You’ll be able to start again with a fresh Chrome installation.

Click the menu icon (the three vertical dots) in the top right and go to Settings > Advanced > Reset and Clean Up. Choose Restore settings to their original defaults. Click Reset settings to confirm.

Chrome Browser Menu Reset Settings Option

This will then reset your Chrome installation to its original condition. This should be obvious, but only attempt this if you’re using the standard version of Google Chrome or a safe, alternative Chromium browser.

Don’t Be Duped by Chromium Malware

Chromium malware isn’t always easy to spot, but there are some obvious signs if you know what to look for. If your browser isn’t using Google or another major search engine, or you didn’t install the browser in the first place, you’ve got malware.

The best way to avoid future infections is to keep your system up-to-date and install the best malware protection for your Windows PC. If you’d prefer to ditch Windows completely, you can download and run Chrome OS on your PC instead

How to Run Google Chrome OS From a USB Drive

How to Run Google Chrome OS From a USB Drive

You don’t need to buy a Chromebook to enjoy the features of Google’s desktop operating system. In fact, all you need is a working computer and a USB Drive.
Read More


Explore more about: Chromium, Malware.

Source link

How Pirating Game of Thrones and Other Shows Can Give You Malware

The consensus is that pirating content leads to malware. Downloading illegal content exposes you to malware at multiple points: the file you download, malicious advertising, cryptojacking scripts, and more lurk on sites hosting illegal content.

It isn’t just malvertising and cryptojacking you must watch out for. The type of content you download can carry a higher risk of containing malware. Malware distributors know that the popularity of certain TV shows means that people will illegally download, regardless of risk.

So, which TV shows have the most risk of carrying malware?

Which Country Downloads the Most Illegal Content?

Perhaps unsurprisingly, the western world tops the leaderboards for the most illegal content downloaded.

The 2017 Piracy Report by global piracy analytics firm, Muso, tracked and analyzed more than 300 billion visits to pirate websites across 2017.

The US topped the list with 27.9 billion visits. Next up is Russia, with 20.6 billion visits, followed by India, with 17 billion visits to sites offering pirated content. The figures also include web streaming for films, shows, and sporting events.

It isn’t just the US, Russia, and India. The following Statista chart shows the share of consumers who consumed movies or TV series from an illegal channel in 2017.

statista number of users watching or using illegal tv shows movies

Spain tops the list with 38%, with Canada close behind on 32%. There are a further nine countries where more than 20% of respondents watch illegal channels.

The figures show that despite the rise of easily accessible on-demand streaming services for music and video, a substantial number of people still pirate content.

Game of Thrones ISN’T the Most Torrented Show

And the most torrented show? Well, in 2018, it wasn’t Game of Thrones (GoT). HBO’s epic screen version of George R. R. Martin’s equally spellbinding fantasy series, A Song of Ice and Fire, took the unwelcome title of most pirated show for six consecutive years.

A new GoT series almost every year, combined with HBO’s original reluctance to allow Game of Thrones to broadcast on any other platform meant fans turned to alternative, illicit sources.

In 2018, AMC’s The Walking Dead usurped Game of Thrones, owing to the fact there was no new Game of Thrones series. The Walking Dead was followed up by The CW’s The Flash, and the Marmite-esq, The Big Bang Theory, completing the top three.

However, I would expect a prompt return to the top of the list for Game of Thrones. The eighth and final season first aired in April 2019, giving pirates plenty of time to return its unwelcome crown.

Game of Thrones Most Likely to Contain Malware

Even though Game of Thrones wasn’t the most pirated show, it holds an infamous accolade.

GoT episodes uploaded to torrenting sites are most likely to contain malware. According to a recent Kaspersky blog, there were 9,986 Game of Thrones related malware-species found during 2018. Furthermore, those GoT-related malicious programs attempted to infect more than 120,000 users, with 20,934 successful infections.

The Kaspersky blog also notes that “the statistics are limited to users of our solutions, so the total number of attacks worldwide should be far larger.”

kaspersky number of tv show infections game of thrones malware

However, the overall number of GoT-related malware dropped in comparison to the previous year. In 2017, Kaspersky found 19,810 GoT-related malware species which attempted 167,692 attacks, of which 42,330 were a success.

Running GoT an extremely close second was—you guessed it—The Walking Dead. Another hit show that a) fans cannot get enough of, and b) has a limited initial broadcast reach that sends people looking for pirate copies. The CWs Arrow was third. Refer to the table above to see the changes from 2017 to 2018.

Game of Thrones Season 8 Will See Malware Surge

If history repeats, as it so often does, the release of Game of Thrones Season 8 in mid-April 2019 will trigger a surge in GoT-related malware. And the biggest target? The first and last episode of each season.

GoT Season 1 Episode 1 (“Winter is Coming”) still sees the highest rate of malware exploitation across the GoT series. The Kaspersky study found nearly 600 individual “Winter is Coming” related malware samples.

GoT Season 7 Episode 1 (“Dragonstone”) hit similar highs with nearly 600 individual “Dragonstone” related malware samples.

In that, beware Game of Thrones Season 8 Episode 1 (“Winterfell”) torrents and illegal downloads. There is a strong chance it is a malicious file masquerading as a GoT episode. Besides the point downloading content under copyright is, well, illegal.

American Horror Story Is Most Effective Malware Disguise

Despite the Game of Thrones and The Walking Dead regularly topping out the highest number of malicious files and infections, neither show is the most efficient malware infection disguise.

kaspersky malicious tv show malware conversion rate 2018

In 2018 (see above chart), that accolade fell to FX’s American Horror Story, while in 2017, The Big Bang Theory topped the chart (see below chart). The charts show the proportion of malicious files to the number of affected users for each show.

kaspersky malicious tv show malware conversion rate 2017

What Type of Malware Do You Get If You Pirate Game of Thrones?

Lastly, what type of malware will infect your system if you pirate content? The Kaspersky team found that amongst the GoT malicious files were Trojans, adware, worms, Trojan-Ransomware, exploits, and plain-old viruses.

Downloaders and adware infections combine for a 49% share of malicious files, though these aren’t strictly malware (but do interfere with regular system operation).

kaspersky game of thrones malware types

Lots of Popular Music Also Hide Malware

A 2018 report by the International Federation of the Phonographic Industry (IFPI) found that although platforms such as Spotify and Apple Music stemmed illegal music consumption, 38% of listeners continue to acquire music illegally. Stream-ripping accounts for 32% of illegal downloading (such as converting YouTube videos to audio), while torrenting comes in with 23%.

As you might expect, the illegally downloading the most popular artists comes with the highest chance of carrying malware. For instance, a bootleg copy of Ariane Grande’s Thank U, Next album exists online; it carries a banking Trojan.

Researchers have found malware lurking behind downloads for Drake, Kendrick Lamar, Maroon 5, Arctic Monkey’s, Queen, The Beatles, and many more popular artists, old and new.

iOS and Android Apps Carry Malware

Mobile apps aren’t safe either, though it does depend on the mobile platform you use. Android users are significantly more likely to encounter malware via an app from the Google Play Store than an iOS user from Apple’s App Store.

There is no “one” type of app that malware distributors select, though there are common features.

For instance, Android malware tends to focus on apps that are easy to mimic, that have multiple entries of extremely similar apps using the same app logo, and have lots of potential for clicks or malvertising. Indeed, the Xavier ad library malware exploited over 75 individual apps

Has Xavier Malware Infected Apps on Your Android Device? 

Has Xavier Malware Infected Apps on Your Android Device? 

A new vulnerability, Xavier, has been discovered on Android — and it has been exploited for some time. Are your devices affected? And what can you do about it?
Read More

to deliver malicious content to hundreds of thousands of Android users.

In another case, security researchers for ESET found Android-based PayPal malware

Warning: Android Malware Can Empty Your PayPal Account

Warning: Android Malware Can Empty Your PayPal Account

Want to know about cybersecurity threats in December 2018? Check these astonishing stories of hackers and malware.
Read More

that could steal funds, even with two-factor authentication enabled.

Apple runs a much tighter ship. iOS isn’t impenetrable but is certainly more difficult to infect due to Apple’s due diligence process regarding the App Store and how they deliver updates to their phones. You can find out more about iOS and iPhone malware right here

Can iPhones Get Viruses? Here Are the Facts

Can iPhones Get Viruses? Here Are the Facts

Most people think iPhones can’t get viruses, but is that true? Let’s look at the cold hard facts.
Read More


How to Avoid Pirate Content Malware

So, the most obvious and easy method of avoiding pirate content malware is to stop all the downloading. Of illegal content, that is. If you’re not pirating content, you’re not exposing yourself to malware through these sites and files.

However, if you are determined to pirate content, take the following few tips into consideration:

  • Check file names. If the filename for a supposed Game of Thrones episode has the .exe file extension, it isn’t a video file. That is malware masquerading as the latest GoT episode.
  • Don’t follow suspicious links. Links advertising latest premieres, unreleased episodes, special episodes, or similar are likely to lead to malware or a phishing site.
  • Double-check. Make sure the torrent site you are using is the “legitimate” site. Torrent sites are a handy target for malware distributors.
  • Install and update. Install and update an antivirus suite. I would strongly advise picking up a Malwarebytes Premium subscription, too.

Steering clear of torrent and streaming sites isn’t a guarantee that you will remain malware free. The 2019 Webroot Threat Report found that 40% of malicious URLs are found on good domains. Formjacking attacks from the various Magecart groups show that hackers can compromise almost any site.

And the list of sites most likely to host malware

Which Websites Are Most Likely to Infect You with Malware?

Which Websites Are Most Likely to Infect You with Malware?

You might think that porn sites, the Dark web or other unsavory websites are the most likely places for your computer to be infected with malware. But you would be wrong.
Read More

definitely has a few surprises on it.

Explore more about: BitTorrent, Game of Thrones, Malware, Media Streaming, Ransomware, Trojan Horse.

Source link