{"id":3309,"date":"2020-11-02T08:03:00","date_gmt":"2020-11-02T07:03:00","guid":{"rendered":"https:\/\/xopero.com\/blog\/?p=3309"},"modified":"2023-08-16T13:24:40","modified_gmt":"2023-08-16T11:24:40","slug":"hiddenads-malware-does-manage-to-slip-into-google-play-again","status":"publish","type":"post","link":"https:\/\/xopero.com\/blog\/en\/hiddenads-malware-does-manage-to-slip-into-google-play-again\/","title":{"rendered":"HiddenAds malware does manage to slip into Google Play… again"},"content":{"rendered":"\n

Google continues to struggle with keeping bad apps off Play marketplace. This time researchers have discovered malicious gaming apps packed with a new threat from HiddenAds malware family. Apps were downloaded 8 million… Yes, definitely – Google is still struggling with its marketplace security. <\/p>\n\n\n\n\n\n\n\n

<\/div>\n\n\n\n<\/a>\n\n\n

21 Malicious Apps Downloaded 8 Million Times From Google Play<\/strong><\/h2>\n\n\n

Despite Google\u2019s best efforts to keep Android users safe, malware does manage to slip into Google Play from time to time, and the 21 malicious apps that Avast identified recently are proof of that. Google has already removed 15 of them. <\/p>\n\n\n\n

Catered for gamers, the apps were found to include adware that is part of the HiddenAds family. The offending applications appear to have been downloaded roughly 8 million times before being discovered. <\/p>\n\n\n\n

The HiddenAds malware, Avast explains, poses as fun or useful apps but in reality delivers intrusive ads outside the application. Often, the malware would make detection difficult by hiding behind relevant-looking advertisements and would attempt to prevent removal by hiding icons.<\/p>\n\n\n\n

In this case, the threat was disguised as games promising to provide users with highly engaging actions.<\/p>\n\n\n\n

To stay protected, users are advised to always double-check any application they want to download and install on their devices, even those listed in Google Play. Checking the app\u2019s reviews, price, and ratings in the store and paying attention to the requested permissions should help users identify suspicious apps.<\/p>\n\n\n\n

Source<\/a><\/p>\n\n\n\n

<\/div>\n\n\n\n<\/a>\n\n\n

KashmirBlack botnet behind attacks on CMSs like WordPress, Joomla, Drupal, others<\/strong><\/h2>\n\n\n

A highly sophisticated botnet is believed to have infected hundreds of thousands of websites by attacking their underlying content management system (CMS) platforms. Named KashmirBlack, the botnet started operating in November 2019.<\/p>\n\n\n\n

Security researchers from Imperva who analyzed the botnet said its primary purpose appears to be to infect websites and then use their servers for cryptocurrency mining, redirecting a site’s legitimate traffic to spam pages, and to a lesser degree, showing web defacements.<\/p>\n\n\n\n

The botnet started out small, but after months, it has evolved into a sophisticated behemoth capable of attacking thousands of sites per day. Nowadays, KashmirBlack is „managed by one C&C (Command and Control) server and uses more than 60 \u2013 mostly innocent surrogate \u2013 servers as part of its infrastructure,” Imperva said. \u201cIt handles hundreds of bots, each communicating with the C&C to receive new targets, perform brute force attacks, install backdoors, and expand the size of the botnet.”<\/p>\n\n\n\n

KashmirBlack expands by scanning the internet for sites using outdated software and then using exploits for known vulnerabilities to infect the site and its underlying server. <\/p>\n\n\n\n

The exploits allowed KashmirBlack operators to attack sites running CMS platforms like WordPress, Joomla!, PrestaShop, Magneto, Drupal, vBulletin, osCommerce, OpenCart, and Yeager. Some exploits attacked the CMS itself, while others attacked some of their inner components and libraries.<\/p>\n\n\n\n

Based on multiple clues it found, Imperva researchers said they believed the botnet was the work of a hacker named Exect1337, a member of the Indonesian hacker crew PhantomGhost.<\/p>\n\n\n\n

Source<\/a><\/p>\n\n\n\n

<\/div>\n\n\n\n<\/a>\n\n\n

There is a new TrickBot Linux variant deployed in the wild<\/strong><\/h2>\n\n\n

No longer than two weeks ago a joined forces of Microsoft\u2019s Defender team, FS-ISAC, ESET, Lumen\u2019s Black Lotus Labs, NTT, and Broadcom\u2019s cyber-security division Symantec tried to take down the command and control infrastructure of the TrickBot botnet.<\/p>\n\n\n\n

Microsoft has taken down:<\/p>\n\n\n\n

  1. 120 of the 128 servers that were composing the Trickbot infrastructure.<\/li>
  2. 62 of the original 69 TrickBot C&C servers – seven servers that could not be brought down were Internet of Things devices.<\/li>
  3. And after the botnet operators tried to resume the operations, MS brought down 58 of the 59 servers the operators attempted to bring online.<\/li><\/ol>\n\n\n\n

    But according to the newest report published by Netscout, TrickBot\u2019s operators have started to use a new variant of their malware in an attempt to Linux systems and expand the list of its targets.<\/p>\n\n\n\n

    Researchers analysed the communication flow between the bot and the C2 server. The client sends \u201cc2_command 0\u201d to the server along with information about the compromised system and the bot ID, the server, in turn, responds with the message \u201csignal \/1\/\u201d back to the bot. The infected host responds by sending the same message back to the C2, which in turn sends the command to be executed by the bot.<\/p>\n\n\n\n

    \u201cThe complexity of Anchor\u2019s C2 communication and the payloads that the bot can execute reflect not only a portion of the Trickbot actors\u2019 considerable capabilities but also their ability to constantly innovate, as evidenced by their move to Linux.\u201d<\/em> we read in the report.<\/p>\n\n\n\n

    Once executed the command, the bot sends the result of the execution to the C2 server.<\/p>\n\n\n\n

    Source<\/a><\/p>\n\n\n\n

    <\/div>\n\n\n\n<\/a>\n\n\n