Author: admin

Don’t delay. Get these updates today.

The never-seen malware strains have “professionally coded sophistication” and were launched by a well-resourced APT using nearly 50 domains, one hijacked.

The security flaw tracked as CVE-2021-22893 is being used by at least two APTs likely linked to China, to attack U.S. defense targets among others.

On Monday, Apple released a quartet of unscheduled updates for iOS, macOS, and watchOS, slapping security patches on flaws in its WebKit browser engine.

The privilege-escalation bug remained hidden for 12 years and has been present in all Dell PCs, tablets and notebooks shipped since 2009.

Jason Kent, hacker in residence at Cequence Security, says most retailers are applying 1970s solutions to the modern (and out-of-control) shopping-bot problem, and offers alternative ideas.

An intense hunt for corporate account credentials will continue into next quarter, researchers predict.

This is an impressive hack:

Security researchers Ralf-Philipp Weinmann of Kunnamon, Inc. and Benedikt Schmotzle of Comsecuris GmbH have found remote zero-click security vulnerabilities in an open-source software component (ConnMan) used in Tesla automobiles that allowed them to compromise parked cars and control their infotainment systems over WiFi. It would be possible for an attacker to unlock the doors and trunk, change seat positions, both steering and acceleration modes — in short, pretty much what a driver pressing various buttons on the console can do. This attack does not yield drive control of the car though.

That last sentence is important.

News article.

McAfee is tracking an increase in the use of deceptive popups that mislead some users into taking action, while annoying many others.  A significant portion is attributed to browser-based push notifications, and while there are a couple of simple steps users can take to prevent and remediate the situation, there is also some confusion about how these should be handled.

How does this happen?

In many cases scammers use deception to trick users into Allowing push notifications to be delivered to their system.

In other cases, there is no deception involved.  Users willingly opt-in uncoerced.

What happens next?

After Allowing notifications, messages quickly start being received.  Some sites send notifications as often as every minute.

Many messages are deceptive in nature.  Consider this fake alert example.  Clicking the message leads to an imposter Windows Defender alert website, complete with MP3 audio and a phone number to call.

In several other examples, social engineering is crafted around the McAfee name and logo.  Clicking on the messages lead to various websites informing the user their subscription has expired, that McAfee has detected threats on their system, or providing direct links to purchase a McAfee subscription.  Note that “Remove Ads” and similar notification buttons typically lead to the publishers chosen destination rather than anything that would help the user in disabling the popups.  Also note that many of the destination sites themselves prompt the user to Allow more notifications.  This can have a cascading effect where the user is soon flooded with many messages on a regular basis.

 

How can this be remediated?

First, it’s important to understand that the representative images provided here are not indications of a virus infection.  It is not necessary to update or purchase software to resolve the matter.  There is a simple fix:

1. Note the name of the site sending the notification in the popup itself. It’s located next to the browser name, for example:

Example popup with a link to a Popup remover

2. Go to your browser settings’ notification section

• For Chrome, go here: chrome://settings/content/notifications
• For Edge, go here: edge://settings/content/notifications

3. Search for the site name and click the 3 dotes next to the entry.

Chrome’s notification settings

4. Select Block

Great, but how can this be prevented in the future?

The simplest way is to carefully read such authorization prompts and only click Allow on sites that you trust.  Alternatively, you can disable notification prompts altogether.

As the saying goes, an ounce of prevention is worth a pound of cure.

What other messages should I be on the lookout for?

While there are thousands of various messages and sites sending them, and messages evolve over time, these are the most common seen in April 2021:

• Activate Protection Now?|Update Available: Antivirus
• Activate your free security today – Download now|Turn On Windows Protection
• Activate your McAfee, now! |Click here to review your PC protection
• Activate your Mcafee, now! |Reminder From McAfee
• Activate your Norton, now! |Click here to review your PC protection
• Activate Your PC Security |Download your free Windows protection now.
• Antivirus Gratis Installieren|Bestes Antivirus–Kostenlos herunterladen
• Antivirus Protection|Download Now To Protect Your Computer From Viruses & Malware Attacks
• Best Antivirus 2020 – Download Free Now|Install Your Free Antivirus
• Check here with a Free Virus Scan|Is Windows slow due to virus?
• Click here to activate McAfee protection|McAfee Safety Alert
• Click here to activate McAfee protection|Turn on your antivirus
• Click Here To Activate McAfee Protection|Upgrade Your Antivirus
• Click here to activate Norton protection|Turn on your antivirus
• Click here to clean.|System is infected!
• Click here to fix the error|Protect your PC now !
• Click here to fix the error|System alert!
• Click here to protect your data.|Remove useless files advised
• Click Here To Renew Subscription|Viruses Found (3)
• Click here to review your PC protection| Your Mcafee has Expired
• Click here to Scan and Remove Virus|Potential Virus?
• Click To Renew Your Subscription|Viruses Found (3)
• Click to turn on your Norton protection|New (1) Security Notification
• Critical Virus Alert|Turn on virus protection
• Free Antivirus Update is|available.Download and protect system?
• Install Antivirus Now!|Norton – Protect Your PC!
• Install FREE Antivirus now|Is the system under threat?
• Install free antivirus|Protect your Windows PC!
• Jetzt KOSTENLOSES Antivirus installieren|Wird das System bedroht?
• McAfee Safety Alert|Turn on your antivirus now [Activate]
• McAfee Total Protection|Trusted Antivirus and Privacy Protection
• Norton Antivirus|Stay Protected. Activate Now!
• Norton Expired 3 Days Ago! |Renew now to stay protected for your PC!
• PC is under virus threat! |Renew Norton now to say protected
• Protect Your Computer From Viruses| Activate McAfee Antivirus
• Renew McAfee License Now!|Stay Protected. Renew Now!
• Renew McAfee License Now!|Your McAfee Has Expired Today
• Renew Norton License Now!|Your Norton Has Expired Today
• Renew Now For 2021|Your Norton has Expired Today?
• Renew now to stay protected!| Your Mcafee has Expired
• Scan Report Ready|Tap to reveal
• Turn on virus protection|Viruses found (3)
• Your Computer Might be At Risk | Renew Norton Antivirus!

General safety tips

• Scams can be quite convincing. It’s better to be quick to block something and slow to allow than the opposite.
• When in doubt, initiate the communication yourself.
  • Manually enter in a web address rather than clicking a link sent to you.
  • Confirm numbers and addresses before reaching out, such as phone and email.
• McAfee customers utilizing web protection (including McAfee Web Advisor and McAfee Web Control) are protected from known malicious sites.

The post How to Stop the Popups appeared first on McAfee Blogs.

Google’s Android operating system has been a boon for the average consumer. No other operating system has given so much freedom to developers and hardware manufacturers to make quality devices at reasonable prices. The number of Android phones in the world is astounding. That success comes with a price, however.

A recent report from our own McAfee Mobile Research team has found malicious apps with hundreds of thousands of downloads in the Google Play store. This round of apps poses as simple wallpaper, camera filters, and picture editing, but they hide their nature till after they’ve been installed on your device.

Figure 1. Infected Apps on Google Play

On the bright side, Google Play performs a review for every app to ensure that they are legitimate, safe, and don’t contain malware before they’re allowed on the Play store. However, enterprising criminals regularly find ways to sneak malware past Google’s security checks.

Figure 2. Negative reviews on Google Play

 

How attackers sneak malware into the Play store.

When developers upload their apps to the Play store for approval, they have to send supporting documents that tell Google what the app is, what it does and what age group it’s intended for. By sending Google a “clean” version of their app, attackers can later get their malicious code into the store via a future update where it sits and waits for someone to download it. Once installed, the app contacts a remote server, controlled by the attackers, so it can download new parts of the app that Google has never seen. You can think of it as a malware add-on pack that installs itself on your device without you realizing it. By contacting their own server for the malware files, attackers sneak around Google security checks and can put anything they want on your device. 

What does the malware do? 

The current round of malware we’re seeing hijack your SMS messages so they can make purchases through your device, without your knowledge. Through a combination of hidden functionality and abuse of permissions like the ability to read notifications, that simple looking wallpaper app can send subscription requests and confirm them as if it were you. These apps will regularly run up large bills through purchasing subscriptions to premium rate services. The more troubling part is how they can read any message that you receive, possibly exposing your personal information to attackers. 

How can I protect myself? 

To start, a comprehensive and cross-platform solution like McAfee Total Protection can help detect threats like malware and alerts you if your devices have been infected. I’d also like to share some tips our Research team has shared with me. 

How to spot suspicious apps before you install them 

1. Check the reviews 

Before you hit that install button, take a good look at an app’s reviews. Do they look like they were written by real people? Do the account names of the reviewers make sense? Are people leaving real feedback, or are the majority of comments things like, “Works great. Loved it.” with no other information? 

Scammers can easily generate fake reviews for an app to make it look like people are engaging with the developers. Look out for vague reviews that don’t mention the app or what it does, nothing but five-star reviews, and generic sounding account names like, “girl345834”. They’re probably bots, so be wary. 

2. Look up the app developers 

Search for the app developers’ company and see if they have a website. Having a website doesn’t guarantee an app is legitimate, but it’s another good indicator of how trustworthy a company’s app is. Through their website, you should be able to find out where their team is based, or at least some personal information about the company. If they’re hiding that information, or there’s no site at all, that might be a good sign to try a different app. 

3. Don’t replace apps you already have 

A lot of malicious apps offer features that your phone already provides, like a flashlight or photo viewer. Unless there’s a very specific reason why you need a separate app to do something your device already does, it’s not recommended to use a third-party app. Especially if it’s free. 

4. Check the app permissions 

App permissions must be clearly stated on the app’s page in order to get into the Google Play store. They’re found near the bottom of the page, along with developer information. Check the permissions every app asks for before you install it and ask yourself if they make sense. For example, a photo editor doesn’t need access to your contacts list, and wallpapers don’t need to have access to your location data. If the permissions don’t make sense for the type of app, steer clear. 

5. Add antivirus to your mobile device 

Mobile devices are vulnerable to malware and viruses, just like your computer. By installing McAfee protection to your mobile device, you can secure your mobile data, protect your privacy, and even find lost devices. 

Protect yourself, and your loved ones 

Android is one of the most popular operating systems on the planet, which means the rewards for creating malware for Android devices are well worth it. It’s unlikely that Android malware is going away any time soon, so staying safe means being cautious with the things you install on your devices. 

You can protect yourself by installing McAfee Total Protection on your mobile device and reading the permissions apps ask for when you install them. There’s no good reason for a wallpaper app to have SMS permissions, but that request should ring some alarm bells that something isn’t right and stop you from installing it. 

Stay Updated  

To stay updated on all things McAfee and on top of the latest consumer and mobile security threats, follow @McAfee_Home on Twitter, subscribe to our newsletter, listen to our podcast Hackable?, and ‘Like’ us on Facebook.  

The post Fraudulent Apps that Automatically Charge you Money Spotted in Google Play appeared first on McAfee Blogs.