Pre-Installed Malware Found On 5 Million Popular Android Phones

Security researchers have discovered a massive continuously growing malware campaign that has already infected nearly 5 million mobile devices worldwide.

Dubbed RottenSys, the malware that disguised as a 'System Wi-Fi service' app came pre-installed on millions of brand new smartphones manufactured by Honor, Huawei, Xiaomi, OPPO, Vivo, Samsung and GIONEE—added somewhere along the supply chain.

All these affected devices were shipped through Tian Pai, a Hangzhou-based mobile phone distributor, but researchers are not sure if the company has direct involvement in this campaign.

According to Check Point Mobile Security Team, who uncovered this campaign, RottenSys is an advanced piece of malware that doesn't provide any secure Wi-Fi related service but takes almost all sensitive Android permissions to enable its malicious activities.

"According to our findings, the RottenSys malware began propagating in September 2016. By March 12, 2018, 4,964,460 devices were infected by RottenSys," researchers said.

To evade detection, the fake System Wi-Fi service app comes initially with no malicious component and doesn’t immediately start any malicious activity.

Instead, RottenSys has been designed to communicate with its command-and-control servers to get the list of required components, which contain the actual malicious code.

RottenSys then downloads and installs each of them accordingly, using the "DOWNLOAD_WITHOUT_NOTIFICATION" permission that does not require any user interaction.

Hackers Earned $115,000 in Just Last 10 Days

At this moment, the massive malware campaign pushes an adware component to all infected devices that aggressively displays advertisements on the device’s home screen, as pop-up windows or full-screen ads to generate fraudulent ad-revenues.

"RottenSys is an extremely aggressive ad network. In the past 10 days alone, it popped aggressive ads 13,250,756 times (called impressions in the ad industry), and 548,822 of which were translated into ad clicks," researchers said.

According to the CheckPoint researchers, the malware has made its authors more than $115,000 in the last 10 days alone, but the attackers are up to "something far more damaging than simply displaying uninvited advertisements."

Since RottenSys has been designed to download and install any new components from its C&C server, attackers can easily weaponize or take full control over millions of infected devices.

The investigation also disclosed some evidence that the RottenSys attackers have already started turning millions of those infected devices into a massive botnet network.

Some infected devices have been found installing a new RottenSys component that gives attackers more extensive abilities, including silently installing additional apps and UI automation.

"Interestingly, a part of the controlling mechanism of the botnet is implemented in Lua scripts. Without intervention, the attackers could re-use their existing malware distribution channel and soon grasp control over millions of devices," researchers noted.

This is not the first time when CheckPoint researchers found top-notch brands affected with the supply chain attack.

Last year, the firm found smartphone belonging to Samsung, LG, Xiaomi, Asus, Nexus, Oppo, and Lenovo, infected with two pieces of pre-installed malware (Loki Trojan and SLocker mobile ransomware) designed to spy on users.

How to Detect and Remove Android Malware?

To check if your device is being infected with this malware, go to Android system settings→ App Manager, and then look for the following possible malware package names:

• com.android.yellowcalendarz (每日黄历)
• com.changmi.launcher (畅米桌面)
• com.android.services.securewifi (系统WIFI服务)
• com.system.service.zdsgt

If any of above is in the list of your installed apps, simply uninstall it.

Warning – 3 Popular VPN Services Are Leaking Your IP Address

Researchers found critical vulnerabilities in three popular VPN services that could leak users' real IP addresses and other sensitive data.

VPN, or Virtual Private Network, is a great way to protect your daily online activities that work by encrypting your data and boosting security, as well as useful to obscure your actual IP address.

While some choose VPN services for online anonymity and data security, one major reason many people use VPN is to hide their real IP addresses to bypass online censorship and access websites that are blocked by their ISPs.

But what if when the VPN you thought is protecting your privacy is actually leaking your sensitive data and real location?

A team of three ethical hackers hired by privacy advocate firm VPN Mentor revealed that three popular VPN service providers—HotSpot Shield, PureVPN, and Zenmate—with millions of customers worldwide were found vulnerable to flaws that could compromise user's privacy.

The team includes application security researcher Paulos Yibelo, an ethical hacker known by his alias 'File Descriptor' and works for Cure53, and whereas, the identity of third one has not been revealed on demand.

PureVPN is the same company who lied to have a 'no log' policy, but a few months ago helped the FBI with logs that lead to the arrest of a Massachusetts man in a cyberstalking case.

After a series of privacy tests on the three VPN services, the team found that all three VPN services are leaking their users' real IP addresses, which can be used to identify individual users and their actual location.

Concerning consequences for end users, VPN Mentor explains that the vulnerabilities could "allow governments, hostile organizations [sic], or individuals to identify the actual IP address of a user, even with the use of the VPNs."

The issues in ZenMate and PureVPN have not been disclosed since they haven't yet patched, while VPN Mentor says the issues discovered in ZenMate VPN were less severe than HotSpot Shield and PureVPN.

The team found three separate vulnerabilities in AnchorFree's HotSpot Shield, which have been fixed by the company. Here's the list:

• Hijack all traffic (CVE-2018-7879) — This vulnerability resided in Hotspot Shield’s Chrome extension and could have allowed remote hackers to hijack and redirect victim's web traffic to a malicious site.
• DNS leak (CVE-2018-7878) — DNS leak flaw in Hotspot Shield exposed users' original IP address to the DNS server, allowing ISPs to monitor and record their online activities.
• Real IP Address leak (CVE-2018-7880) — This flaw poses a privacy threat to users since hackers can track user's real location and the ISP. the issue occurred because the extension had a loose whitelist for "direct connection." Researchers found that any domain with localhost, e.g., localhost.foo.bar.com, and 'type=a1fproxyspeedtest' in the URL bypass the proxy and leaks real IP address.

Here it must be noted that all the three vulnerabilities were in the HotSpot Shield's free Chrome plug-in, not in the desktop or smartphone apps.

The researchers also reported similar vulnerabilities in the Chrome plugins of Zenmate and PureVPN, but for now, the details of the bugs are being kept under wraps since both the manufacturers have not yet fixed them.

Researchers believe that most other VPN services also suffer from similar issues.

Apple Blocks Sites From Abusing HSTS Security Standard to Track Users

If you are unaware, the security standard HTTP Strict Transport Security (HSTS) can be abused as a 'supercookie' to surreptitiously track users of almost every modern web browser online without their knowledge even when they use "private browsing."

Apple has now added mitigations to its open-source browser infrastructure WebKit that underpins its Safari web browser to prevent HSTS abuse after discovering that theoretical attacks demonstrated in 2015 were recently deployed in the wild against Safari users.

HSTS—HTTP Strict Transport Security—is a great feature that allows websites to automatically redirects user's web traffic to secure page connections over HTTPS if the user accidentally opens an insecure URL and then remembers to route that user to the secure connection always.

Since HSTS does not allow websites to store any information/value on users web browser except remembering the redirect information about turning it on/off for future use, using this information, someone interested in tracking web users can create a so-called supercookie that can then be read by cross-site tracking servers to mark users across websites.

Here's How HSTS-Based Tracking Works:

To understand how HSTS supercookie tracking works, here's a simple example:

• To track each user, sites assign a unique random number to each visitor, for example, 909090, where 32 character binary conversion for 909090 is 00000000000011011101111100100010.
• To set this binary number for a specific user, the site sets HSTS policy for its 32 subdomains (tr01.example.com, tr02.example.com......and tr32.example.com) accordingly, where if HSTS for a subdomain is enabled then the value is 1 and if not then the value is 0.
• Now each time the user visits the same website, it silently opens invisible pixels from 32 of its subdomains in the background that represent the bits in the binary number, signalling the server which subdomains are opened via HTTPS (1) and which via HTTP (zero).
• Voila! Combining the above value reveals the user's unique binary value to the server, helping websites/advertisers to mark users across sites.

However, Apple has now added two mitigations to its Safari's WebKit engine that addresses both sides of the attack: where tracking identifiers are created, and the subsequent use of invisible pixels to track users.

Mitigation One addresses the super cookie-setting problem, where attackers use long URLs that encode the digits in subdomains of the main domain name and the practice of setting HSTS across a wide range of sub-domains at once.

Safari will now limit the HSTS state to either the loaded Hostname, or the Top Level Domain plus one (TLD+1), and "WebKit also caps the number of redirects that can be chained together, which places an upper bound on the number of bits that can be set, even if the latency was judged to be acceptable."

"This prevents trackers from efficiently setting HSTS across large numbers of different bits; instead, they must individually visit each domain representing an active bit in the tracking identifier," says Brent Fulgham, a developer who works on Safari WebKit engine. 

"While content providers and advertisers may judge that the latency introduced by a single redirect through one origin to set many bits is imperceptible to a user, requiring redirects to 32 or more domains to set the bits of the identifier would be perceptible to the user and thus unacceptable to them and content providers."

In Mitigation Two, Safari ignores HSTS State for Subresource Requests to Blocked Domains, where WebKit blocks things like invisible tracking pixels from forcing an HSTS redirect, causing HSTS supercookies to become a bit string of only zeroes.

However, Apple does not name any individual, organisation, or any advertising firm that was using HSTS supercookie tracking to target Safari users.

How To Unlock Locked iPhone iCloud Account?

SUMMARY: Do you have your iCloud locked? If your iPhone has an iCloud lock on it, it means that regardless of how much you paid for your second-hand phone, the previous owner can still block you from using it. They can do this by keeping the device locked to their iCloud account and not allowing you to log into the phone.

The only way around this is to get an iCloud account unlocked. It frees your phone from the previous owner’s account and allows you to setup your account on that phone, meaning you can start making calls, sending messages, and using apps.

Of the 9 iCloud activation unlock services we found and 3 we tested, the fastest, cheapest, and best supported provider is iPhone IMEI. They unlocked all 6 accounts we sent them, for the least money, and did it in the fastest time.

Im going to introduce new method of unlocking icloud lock making your own server for bypass the lock.

if some one interest about this, dont hesitate to contact me via email or send a massage to our official facebook fan page. hit a like on below link...

https://www.facebook.com/blackhathacking123/

Ways to Encrypt Data to Store in Cloud

For very many people, security is one of the most important issues when it gets to sending their files into the cloud. They worry that their files will be seen or even compromised by other persons because that is what took place in the past. The user accounts used to be hacked, cloud storage systems failed and personal files and data were exposed. Therefore, how can you successfully prevent that from ever happening even when the account gets hacked or something happens to your provider of cloud storage?

The answer to that question is encryption

Encryption can be defined as the process of making one’s files unreadable with a pass phrase or an encryption key so that even when another person gains access to the files, it does not matter because the intruder will only be able to see gibberish. To be able to see very properly what is in the file, one must have a key.

This article contains the two different ways through which one can make his or her files secure and be able to safely use cloud storage without any worries.

Available options

Essentially, when it gets to encrypting files in the cloud, one has two options from which he or she can choose, that is:

• He or she may choose the cloud storage with a built in encryption.
• Make use of a service which encrypts folders and/or files for him or her.

Cloud storage service with built-in encryption

Regardless of your choice, both of the ways to encrypt data to store in cloud have advantages and disadvantages. If you decide to go with the dedicated secure cloud service, you might be required to change the entire setup of transferring files to that specific service, familiarize yourself with the way it works and probably give up on a certain third party support, mainly if you come from the most well-liked cloud storage and syncing service, that is “Dropbox”. Alternatively, you have got everything under one hood and you do not have to worry any more about file security and integrity.

Service for encryption only

If you are using a service which is dedicated to encrypting your files, you will be having more control over which files you would like to encrypt and where you would like them to be stored. For instance, you may choose Dropbox, if at all you like the service; and not give up after encrypting the files properly. Conversely, your files might take longer to be properly synced in case you are getting them encrypted using third party apps.

Conclusion

Either way, it is believed to be very necessary to protect one’s files using the most proper encryption, most especially if he or she is using Dropbox for managing his or her critical files such as contracts, password databases, or any other personal or business files which may be considered to be very important.

Depending on an individual, some would like to install another software on their computers just for the purpose of encryption, while others not. Those who don’t may take advantage of the idea of signing up for a dedicated cloud solution which has built-in local encryption for all the files. Some of such solutions available include SpiderOak, Wuala and Cubby. If online viruses are among the things troubling you, you may also consider making use of the Norton Contact Phone number so as to inquire about how you can be helped.

another easy way to get protect your cloud data with below app. its for totally free & you can download for windows, Android & ios devies from below link.

 

Hacking 101: Hacking Guide for the Absolute Beginner

If you are an absolute beginner in the field of hacking or don’t really know where to start off, this hacking 101 guide can help you kick start your hacker’s journey. Before taking up any hacking course or tutorial, it is necessary to understand what hacking or hacker really means.

As opposed what most people think, hackers are not criminals who break into bank accounts or do all the nasty things on the computer and the Internet. In fact, these criminals who cause damage to cyber space or third party systems are not hackers but are referred to as crackers. For more information of different types of hackers and how they differ from each other, your may refer to our hacking FAQs section.

On the other hand, a hacker (sometimes referred to as ethical hacker) is a person who has developed in-depth expertise or knowledge in the subject of information security. He or she is specialized in penetration testing or other testing methodologies to ensure a company’s information system is secure. Such people are hired and paid by companies to discover vulnerabilities in their system and fix the same before a cracker finds and exploits them.

Hacking 101: Start From the Basics

The best way to start learning is begin with the basics of hacking. Later as your experience grows, gradually advance to the next higher levels so as to master the art of hacking. If you want a beginner’s guide with all the hacking resources available at one place, our book Hacking Secrets Exposed is what you need.

---

1. Learn About Computer Network and Protocols

If you already have an understanding of how computer network works and its basic protocols, you are good to go. If not, it is necessary to learn more about this topic as its understanding makes it easy to comprehend the concepts of network hacking. To start off you can refer this link for more information on basic concepts of computer network.

2. Programming: Is it Necessary?

Once you master the basics of hacking and want to take it as your career or go more deeply, having a knowledge of programming becomes a must. If you are a computer science student, you may already be aware of some of the markup and programming languages such as HTML, C++, Java, PHP, Python etc.

Since there are are hundreds of programming languages it would be impossible for any hacker to master all of them. However, as a hacker you ought to have a working knowledge of at least a few basic languages like HTML, C++ or PHP. This would make it easier to interpret and handle any code that you may come across in the future of your hacking career.

3. Learn Both Windows and UNIX

If you are just like any other computer user who knows only one operating system which is Microsoft Windows, your options to hack and expand knowledge would remain highly limited. This is because most web servers and web applications run on Unix. More and more companies are now switching to Unix based operating systems as it is a freeware and also considering it more secure than Windows.

So, this is why most professional hackers always use Unix as their primary operating system. Even though it is still possible to do most things on Windows itself it still isn’t secure and complete as Unix. This makes it incomplete to use it for hacking and penetrating testing. So, if you are new to it, I recommend you start learning Unix before you try to hack anything of the Web.

Need All the Hacking Resource at One Place?

Well, if you do not have much time to do all the research and learn hacking from multiple sources, you have a better option. We have come up with a complete hacking guide that will teach you everything right from the basics in a step-by-step and easy to follow manner.

This guide contains all the information you need in one place and is called “Hacking Secrets Exposed”. You can download it from the link below:

---

Windows TCP/IP Utilities

The following are the IP utilities available in Windows that help in finding out the information about IP Hosts and domains. These are the basic IP commands that every beginner in the field of hacking must know!

Please note that the the term Host used in this article may also be assumed as a Website for simple understanding purpose.

1. PING

PING is a simple application (command) used to determine whether a host is online and available. PING command sends one or more ICMP “Echo message” to a specified host requesting a reply. The receiver (Target Host) responds to this ICMP “Echo message” and returns it back to the sender. This confirms that the host is online and available. Otherwise the host is said to be unavailable.

Syntax: C:\>ping gohacking.com

2. TELNET

Telnet command is used to connect to a desired host on a specified port number. Just like a house having several doors, a host or a server has different ports running different services. For example port 80 runs HTTP, port 23 runs TELNET while port 25 SMTP. Like this there are several ports on a server through which it is possible for a remote client to establish a connection.

For a connection to be established, the port has to be open. For example, in the following command, we are trying to establish a connection with the Yahoo server on port 25.:

Syntax: C:\>telnet yahoo.com 25 C:\>telnet yahoo.com

The default port number is 23. When the port number is not specified the default number is assumed.

NOTE: If you are using Vista or Windows 7, Telnet feature may not be available by default. To enable it, you can refer my other post: How to enable Telnet feature in Vista and Windows 7?.

3. NSLOOKUP

Many times, we think about finding out the IP address of a given site. Say for example google.com, yahoo.com, microsoft.com etc. But how to do this? There are several websites out there that can be used to find out the IP address of any given website. However, in the Windows operating itself, we have an inbuilt tool to do this job for us. It is called “nslookup”.

This tool can be used for resolving a given domain name into its IP address (determine the IP of a given site name). Not only this, it can also be used for reverse IP lookup. That is, if the IP address is given it determines the corresponding domain name for that IP address.

Syntax:
C:\>nslookup google.com

4. NETSTAT

The netstat command can be used to display the current TCP/IP network connections. For example, the following “netstat” command displays all the currently established connections and their corresponding listening port numbers on your computer.

Syntax:
C:\>netstat -a
Type "Ctrl+Z" to exit.

This command can be used to determine the IP address/Host names of all the applications connected to your computer. If a hacker is connected to your system even the hacker’s IP is displayed. So, the “netstat” command can be used to get an idea of all the active connections of a given system.