Android security apps: do you need them?

<div class="ex"><p> </p><p> </p><figure data-url="/images/zoom/1076731-a/1"><img alt="Android security apps: do you need them?" class="aligncenter" height="196" src="http://www.new-technology-news.net/wp-content/uploads/2012/04/tablet-security-580-75.jpg" width="348"><p></p><figcaption>There are plenty of apps like Norton Tablet Security – but do you really need them?</figcaption> </figure> <p> </p><p> </p><div><p>Malware, malware, viruses, attacks, phone numbers being stolen, lives put at risk, solar flares wiping out the communications grids and so on. All of those scenarios have been blamed on Android recently, as anti-virus companies pitch Google’s mobile OS as the next worst thing that’ll ruin your life.</p><p>But is Android malware an actual real thing? Or is it largely a myth, proven only in exploits performed under laboratory conditions?</p><p>Chet Wisniewski, from anti-virus firm Sophos, told us: “It is not terribly widespread outside of China, but the number of malicious apps is increasing dramatically.”</p><div><strong>You might also like…</strong><p></p><figure><img alt="60 best free Android apps 2012" class="aligncenter" height="196" src="http://www.new-technology-news.net/wp-content/uploads/2012/04/best_free_android_apps-580-100.jpg" width="348"></figure> </div><p>“In 2010 we saw around 40 threats, in 2011 more than 400. Evidence for 2012 suggests that number will continue to increase. To date the majority of threats are on unofficial/pirate markets, but we have seen several apps make it onto the Google Play store, only to later be discovered and deleted.”</p><h4>Why is Android vulnerable?</h4><p>“The ability for users to load software ‘off market’ opens the door for malicious applications to be distributed without the need for a vulnerability,” says Wisniewski, meaning anyone can write an app and anyone can install anything on their Android phone, granting it permission to go wild with their personal data.</p><p>Google’s main defence is the Android Permissions notifier, which tells you exactly which phone features an app will be able to access once installed. The problem is, no one reads these permissions. It’s a boring list of things most of us don’t understand. How is the everyday man expected to know if it’s right or wrong for a particular app to require access to his contacts details?</p><p>There’s also the problem of software updates, which has been the bane of Android over the last year or two, as Google relentlessly releases new OS versions and the networks struggle to keep up.</p><p> </p><figure><img alt="Google Play" class="aligncenter" height="196" src="http://www.new-technology-news.net/wp-content/uploads/2012/04/google_play-580-90.jpg" width="348"><p></p><figcaption>Google Play: plenty of security apps are available through the store</figcaption> </figure> <p> </p><p>“The other factor that increases the risk for Android users is the lack of patches that fix the vulnerabilities that are discovered,” says Wisniewski. “Even if Google fixes the flaws in the core version of Android, most carriers and phone makers lag far behind integrating the fixes, if they bother at all.”</p><p>Which all sounds very worrying, but then again it’s common practise and advice throughout the tech world – always update to the latest version of any software. If you’ve been stranded with an unsupported Android model that’s sitting on version 1.6 of the software, you may well be more vulnerable. The hackers have had longer to work on exploits.</p><h4>Do you need an Android security app?</h4><p>Wisniewski thinks so, explaining: “Not all security applications are the same, some are more of a marketing effort than a true security application. As the number of attacks increase it is likely we will need to provide protection on the device as well as more carefully screening applications submitted to the marketplaces.”</p><p>At the other end of the spectrum, a famous rant published on Google+ by Google man Chris DiBona, who’s the Open Source Programs Manager at Google, said: “Virus companies are playing on your fears to try to sell you bs protection software for Android, RIM and IOS. They are charlatans and scammers.”</p><p> </p><figure><img alt="Chris DiBona" class="aligncenter" height="261" src="http://www.new-technology-news.net/wp-content/uploads/2012/04/chris-dibona-580-90.jpg" width="348"><p></p><figcaption>Google’s Chris DiBona: security companies</figcaption> </figure> <p> </p><p>Most Android malware scare stories are based around one of two extreme premises – theoretical breaches discovered by researchers in their offices but not actually spotted in the real world, or apps that spawn numerous pop-up adverts designed to pull in ad revenue for the few days they’re allowed to run riot on Google’s Play Store.</p><p>The latter is by far the most common. In the run up to the Android launch of iPhone smash Temple Run, numerous clones popped up on the Play Store. Some were rather malicious, redirecting users’ browsers to ad-covered web sites and inserting bookmarks, but they didn’t have the power to break your phone beyond repair – nor were they technically malware, as they were only doing what users had granted them permission to do so.</p><p>No security or anti-virus app will stop something you’re specifically handing permission to, so they are, in cases like this, entirely useless.</p><p>So while there’s certainly a lot of boundary-pushing, invasive software that can legitimately take its place on Google’s Play Store, actual reports of phone-breaking data-thievery are extremely rare to come across.</p><h4>Is my phone infected?</h4><p>Sophos’ most recent Android malware report concerned a game called ‘The Roar of the Pharoah’ which, it claimed, contained a trojan that could gather your phone number and IMEI code, with the ability to send SMS messages to premium rate services.</p><div><strong>Reviewed and rated</strong><p></p><figure><img alt="Ice Cream Sandwich review" class="aligncenter" height="196" src="http://www.new-technology-news.net/wp-content/uploads/2012/04/GalaxyNexus-02-580-100.jpg" width="348"></figure> </div><p>Only problem is, this app wasn’t found on the Google Play Store. Sophos found it on unnamed “unofficial download sites,” so it’s entirely possible that no users whatsoever were infected by this apparent threat that gained a lot of internet column inches over the past month.</p><p>Another common Android malware fighter and evangelist is McAfee. Its 2011 threat update [PDF] made for worrying reading, claiming that two new viruses – Android/NickiSpy.A and Android/GoldenEagle.A – were found on Android phones in the last quarter of 2011.</p><p> </p><figure><img alt="Android Nikispy" class="aligncenter" height="196" src="http://www.new-technology-news.net/wp-content/uploads/2012/04/nikispy-580-90.jpg" width="348"><p></p><figcaption>Android/NickiSpy.A came to the fore late last year</figcaption> </figure> <p> </p><p>Symantec supplies some data on the number of infections, which show that the Android.Nickispy trojan, which is claimed to have the ability to record users’ phone calls, has infected between 0-49 devices. Which is statistically about zero when Google’s selling 700,000 Android gadgets every day.</p><h4>Will it get worse?</h4><p>Anti-virus firms say yes it will, while Google has recently introduced an app-scanning tool it calls Bouncer, designed to detect common forms of malicious code uploaded to its Android Market and delete them before they can inflict pain on users.</p><div><strong>Buying Guide</strong><p></p><figure><img alt="15 best Android tablets in the world" class="aligncenter" src="http://www.new-technology-news.net/wp-content/uploads/2012/04/samsung-GALAXY%20Tab%202%2810.1%29-580-100.jpg"></figure> </div><p>With over 200 million Android devices out there today, and a rather patchwork approach to updating their software, it’s inevitable that some older models will be exploited and found more</p><p>The rule of thumb is to keep it official, only downloading apps through Google’s Play Store, as at least that way you have some form of safety net and the backing of Android’s own army of app-checking reporters. And check those permissions when installing an app, as boring a task as it may be. They’re your first indication that something’s trying to work its way a little too deeply into your phone.</p><p>And while anti-virus apps from the big name PC software protection companies are on the rise on Google’s Play Store, they won’t stop the adware spam apps and fakes, as they rely on you granting them permission to run.</p><p>As with most things in life, the sad fact is you’re going to have to start paying more attention to the small print if you want to stay exploit free.</p></div><p>  <!--END--></p><div style="clear: both;"></div><div class="snap_nopreview sharing robots-nocontent"><ul><li class="sharing_label">Want to share?:</li><li class="share-email share-regular share-service-visible"><a class="share-email share-icon" href="http://www.new-technology-news.net/android-security-apps-do-you-need-them/?share=email&nb=1" rel="nofollow" target="_blank" title="Click to email this to a friend">Email</a></li><li class="share-print share-regular"><a class="share-print share-icon" href="http://www.new-technology-news.net/android-security-apps-do-you-need-them/#print" rel="nofollow" target="_blank" title="Click to print">Print</a></li><li class="share-digg share-regular"><a class="share-digg share-icon" href="http://www.new-technology-news.net/android-security-apps-do-you-need-them/?share=digg&nb=1" rel="nofollow" target="_blank" title="Click to Digg this post">Digg</a></li><li class="share-facebook share-regular"><a class="share-facebook share-icon" href="http://www.new-technology-news.net/android-security-apps-do-you-need-them/?share=facebook&nb=1" rel="nofollow" target="_blank" title="Share on Facebook">Facebook</a></li><li class="share-reddit share-regular"><a class="share-reddit share-icon" href="http://www.new-technology-news.net/android-security-apps-do-you-need-them/?share=reddit&nb=1" rel="nofollow" target="_blank" title="Click to share on Reddit">Reddit</a></li><li class="share-stumbleupon share-regular"><a class="share-stumbleupon share-icon" href="http://www.new-technology-news.net/android-security-apps-do-you-need-them/?share=stumbleupon&nb=1" rel="nofollow" target="_blank" title="Click to share on StumbleUpon">StumbleUpon</a></li><li class="share-twitter share-regular"><div class="twitter_button"><iframe allowtransparency="true" src="http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fwww.new-technology-news.net%2Fandroid-security-apps-do-you-need-them%2F&counturl=http%3A%2F%2Fwww.new-technology-news.net%2Fandroid-security-apps-do-you-need-them%2F&count=horizontal&text=Android%20security%20apps%3A%20do%20you%20need%20them%3F:%20" style="width: 97px; height: 20px;" frameborder="0" scrolling="no"></iframe></div></li><li class="share-end"></li></ul><div class="sharing-clear"></div></div></div>

Android security apps: do you need them?

    There are plenty of apps like Norton Tablet Security – but do you really need them?     Malware, malware, viruses, attacks, phone numb...

Continue Reading>>

In Depth: Learn from the hackers: how to avoid website exploits

<div align="center"><img src="http://img337.imageshack.us/img337/7928/pcp302make8bodyimage320.jpg" /></div>When large data breaches are announced, the media can go overboard with its portrayal of hackers as uber-geeks with flashing fingers and skills that are almost supernatural in origin. In fact, nothing could be further from the truth. <br /> By using basic tools and a logical approach, hackers turn websites into playgrounds full of interesting servers to explore, subvert and destroy. There are databases to plunder; there are pages to deface. <br /> But just what is their approach, and how can we learn to avoid it?<br /> <strong>Footprints on the web </strong><br /> Once a hacker finds a website that could be worth exploring, their first task is to create a detailed profile of the target, called a footprint. This identifies the basic building blocks of the site and enables the hacker to draw a map of how everything fits together. <br /> Unfortunately, the way websites work provides hackers with lots of useful information without them having to do much. If there's a login process, for example, they know there's a database containing usernames and passwords. If the site has an ecommerce element, they know there's a shopping cart product in use, or some handcrafted and potentially vulnerable code to try to subvert. <br /> Similarly, a catalogue of products indicates another database, which could link to a stock control server and possibly also a re-ordering application containing information about trade accounts. The hacker will also survey links to ad servers that feed content into the site. They will also consult the DNS records for the domain.<br /> DNS is the only way to keep track of what's on the internet and where it all is. But it also gives information about all the publicly accessible servers owned by a domain, regardless of whether their addresses and names are meant for public consumption. <br /> When I began working as a network security consultant, I found that it was easy to shock clients by showing them their DNS records, and then drawing a map of how I believed their servers were plumbed together. Some network admins had been naïve enough to think that all their important servers needed public IP addresses, making them easy to profile prior to an attack. <br /> <strong>DNS information </strong><br /> Windows and Linux have tools capable of interrogating DNS, but they're fiddly command line utilities. Luckily, plenty of websites provide easy access to DNS information, including <a href="http://www.kloth.net/services/dig.php">Kloth.net</a>. Enter the name of a domain you're interested in (such as pcplus.co.uk) and press [Enter]. In the answers section that appears, you'll see lines containing the domain name and associated IP addresses. <br /> <div align="center"><img alt="Kloth.net" src="http://img257.imageshack.us/img257/3756/pcp302make8bodyimage142.jpg" width="420" /></div>To search for a possible web server, add www. to the start of the domain and press [Enter]. This time you'll see the domain's web server. If you change the query type to 'MX' and click 'Look it up', the answers section will contain the name of the computer acting as the local mail server (technically called the mail exchanger). <br /> This name may be the same as the web server, but if it has a different name, enter it into the 'Domain' input box to see its details. <br /> Another important part of this process is the use of a port scanner such as nmap to discover what services are running on each internet-facing server. See nmap in action at <a href="http://nmap-online.com/">www.nmap-online.com</a>. The default IP address is your own computer. <br /> <div align="center"><img alt="Nmap" src="http://img822.imageshack.us/img822/3461/pcp302make8bodyimage242.jpg" width="420" /></div>To scan it for open ports, click the 'I agree with terms of service' and then click 'Scan now'. Enter an email address for the site to notify when the scan is complete, along with a password to access the results. <br /> Nmap sends carefully crafted packets to each potentially open port and analyses the information returned to discover not only what's running, but sometimes even detailed information about the running operating system and its TCP/IP stack. This can aid hackers in profiling a website and formulating a coming attack. <br /> If a mail server is also running port 80, there's a good chance that connecting to it via a web browser will reveal a web mail interface that may have exploitable bugs. However, if the hacker is met by a default Apache web server installation page, it may be that system administrator installed the web server but has forgotten about it. It's likely that the software has never been patched and is vulnerable to a range of exploits. <br /> By examining the verbiage returned with the web page, the hacker can determine the exact release of the software and any extra modules installed. Finding a NetBIOS service running (ports 137 and 139) indicates that the server runs Windows. An SQL service (port 1143) indicates that there's a database engine running, and so on. <br /> <div align="center"><img alt="detailed map" src="http://img191.imageshack.us/img191/8518/pcp302make8diagram24201.jpg" width="420" /></div>It's possible to build a detailed map of a domain's capabilities and vulnerabilities from this process. <br /> Once the hacker has constructed a detailed footprint of the website's hardware and basic software, their attention turns to the web applications. Computer science says that above a certain level of complexity, no program can ever be free of bugs. Luckily for the hacker, less skilled programmers keep making the same basic assumptions and mistakes in the logic of web applications. <br /> The first task is to map out how the apps work. The hacker begins with a simple click-through of the site to note the names of the pages and what they contain – which ones need authentication, for example. This tells them a great deal, but they can also delve deeper by mapping out the actual directory structure on the server. <br /> Directory mapping is a matter of noting down the paths in the URL bar of the browser during the click-through. This reveals a lot of detail about the structure of the site, and can give indications about the skill of the web designer. Some structures reveal the hand of a site-builder program at work, in which case a hacker can consult a list of known exploits for sites made with that program. <br /> <div align="center"><img alt="Hack this site" src="http://img403.imageshack.us/img403/3706/pcp302make8box1image142.jpg" width="420" /></div>The hacker notes the methods pages use to pass data from input boxes to PHP scripts. Do they use the GET or POST methods? Each implies the type of processing used by the site's scripts, and may provide ideas about testing for weaknesses in the way rogue input values are dealt with. <br /> The web is set up to serve the index file of any URL you enter, so the hacker will try adding likely directory names to the domain name to see what he can find. For example, for www.victimsite.com, they might try 'www.victimsite.com/admin' to see if they can access an administration page. <br /> Another great source of hidden directories is the 'robots.txt' file. This is a plain text file that sits in the root directory of websites and contains directives to search engines about which directories are OK to index and which aren't. The 'robots.txt' file has to contain a list of all the directories that the hacker shouldn't know about, which highlights the need to avoid putting anything on a site that you wouldn't want to find on Google. Where you can't avoid this, don't give files obvious names. <br /> So-called helper files are also a useful source of information for the hacker. Cascading style sheets, Java classes and embedded JavaScript all give an indication of the skill level of the person who coded the site. This gives an idea of the kinds of errors to expect. <br /> One of the biggest mistakes made in trying to secure a site is to have users validate themselves using JavaScript embedded in the login page. To the developer, the ease of use, compatibility across browsers and speed all seem like benefits, but the advantages are all on the side of the hacker. <br /> <strong>The attack begins </strong><br /> The hacker now has a footprint of your site, a list of hidden directories and a map of how the scripts fit together to make up the site's applications. What now? <br /> They have many options to choose from. The simplest is to point a password-cracker at the administrator account and leave it to gain entry for the purposes of stealing information that can be sold on, or to simply deface the site. This childish activity is normally associated with 'script kiddies' – teenagers who consider themselves hackers, but just run scripts developed by others. <br /> Real hackers will begin to explore weaknesses in the services identified as part of the footprint. On discovering an SQL service, for example, they can try connecting a telnet client to the port to gain command line access to the database management system (DBMS). Similarly, FTP and Telnet services are easily attacked using password crackers and by exploiting bugs in their software with buffer overflow attacks that can give command line access to the server. <br /> A more knowledgeable hacker still will try to break or bypass the validation code applied to an input field on a web page to see what happens. Validation code is supposed to take the values of input fields and sanitise them, rejecting data that's clearly wrong. <br /> If an input field is supposed to contain a number, for example, its validation should reject input if it contains anything other than the digits 0-9. If the hacker enters letters and doesn't get an error message, he can tell that the validation code is lacking. If the input field is for a part number, it may form the basis of a query to a back-end SQL database. <br /> That being the case, the hacker will ask what happens if they enter the SQL statement termination symbol (the ' symbol), followed by their own query. If this works, they could then ask the database for a list of tables. If they find ones that store customer details and credit card information, it's game over.<br /> <br /> <a href="http://www.techradar.com/" rel="nofollow" target="_blank">Source.</a>

In Depth: Learn from the hackers: how to avoid website exploits

When large data breaches are announced, the media can go overboard with its portrayal of hackers as uber-geeks with flashing fingers and sk...

Continue Reading>>