The IT Nerd

ThreatFabric has disclosed a new Android banking RAT called Hirudo that can replace legitimate banking apps with modified copies designed to manipulate their own security checks, including app-signing validation, Accessibility detection and Play Integrity responses.

Rather than simply stealing credentials or displaying overlays, Hirudo can make a compromised banking app appear trustworthy to itself and to controls that rely on signals generated on the device.

In response, mobile app security expert Ted Miracco, CEO of Approov, offers comments:

“Hirudo doesn’t break the bank’s defenses. The trojan deletes the genuine app, installs a copy signed with a public test key, and loads a hooking engine inside that app’s process. From then on that app asks Android who signed it and hears the right answer. It asks which accessibility services are running and hears none. Its Play Integrity request is routed through the attacker’s server and comes back clean.

“The conclusion is uncomfortable but simple: an app running on a phone you don’t control cannot be a witness in its own defense. Integrity signals have to be produced and judged somewhere the attacker can’t reach, tied to the session and to the specific payment, with revocation actually checked. ThreatFabric found the operators using a leaked keybox holding certificates Google had already revoked. A bank checking server-side would have caught that. A bank trusting the verdict on the handset could not.

“The uncomfortable part for the industry is that this engine isn’t bank-specific. It’s a reusable tool pointed at eight Indonesian apps today, with target lists in the code already naming five other countries.”

This is not a good development as I expect this to be repurposed to fit any use case. Which is bad for all of us.

Google announced today a new cross-platform feature that allows for file sharing between iPhones And Pixel 10 devices called Quick Share:

We built this with security at its core, protecting your data with strong safeguards that were tested by independent security experts. It’s just one more way we’re bringing better compatibility that people are asking for between operating systems, following our work on RCS and unknown tracker alerts.

We’re looking forward to improving the experience and expanding it to more Android devices.

This addresses a major pain point that has always bugged iPhone and Android users. And when it spreads to more Android phones, this will be huge. I have to ask if you’re surprised as I am that this is even a thing. Post a comment below and share your thoughts.

Bad news if you have an Android phone, particularly a Pixel phone. A company named iVerify has discovered an extremely serious vulnerability in those versions:

The vulnerability makes the operating system accessible to cybercriminals to perpetrate man-in-the-middle attacks, malware injections, and spyware installations. The potential impact of this Android security vulnerability is unknown and could result in millions of dollars in data loss and breaches.

iVerify, in concert with the information security team at Palantir Technologies, initially identified and investigated a vulnerability in an Android app package called Showcase.apk. The application runs at the system level and can fundamentally change the phone’s operating system. Since the application package is installed over unsecured HTTP protocols, this opens a backdoor, making it easy for cybercriminals to compromise the device. iVerify notified Google of the vulnerability and submitted a detailed report after discovering it on customer devices that did not pass iVerify’s behavior-based detections. It’s unclear if Google will issue a patch or remove the software from the phones to mitigate the potential risks.

Furthermore, users cannot remove this app because it is part of the firmware image, and Google does not allow end-users to alter the firmware image for security reasons. 

This is bad as at present, users of Android phones cannot mitigate this vulnerability on their own. They have to wait for Google to do it for them. Which Google has said that they will do. At least with Pixel phones that aren’t the Pixel 9 as that doesn’t have the .apk file in question. Google has said that it will notify other OEMs about this vulnerability. That means that it will potentially take longer for this issue to be addressed on non Pixel phones.

Google’s latest Android operating system update, Android 9 Pie, has been officially released to customers. Here’s a video that shows you what this new version of Android brings to the table:

Here’s a quick list of notable features:

• A new gesture-based system interface that’s similar to the interface of the iPhone X
• There’s a new Android Dashboard, designed to tell you how much time you’re spending on your device. Which sounds like Apple’s Screen Time feature that’s coming in iOS 12.
• A new Do Not Disturb option called “Shush” which silences Android devices when placed facedown
• A Wind Down option lets Android users select a specific bedtime to turn the interface gray to discourage smartphone usage at night.
• An Adaptive Battery feature that maximizes battery power by prioritizing the apps you’re most likely to use next,
• App Actions for predicting what you’ll want to do next. Which to me sounds a lot like Siri Suggestions,
• There’s a future feature Slices which is a feature that brings up information from your favorite apps right in search.

Android Pie is available to Pixel phones today. For everyone else, you may get an update if your device is recent enough. But as typical for Android devices, your ability to get a major update to Android largely depends on who makes your phone, what carrier it is on, and how old it is as many devices use customized versions of the Android OS. Which means that both device manufacturers and/or carriers have the ultimate say as to what updates users get. Thus it is entirely possible that you may never get this update on your phone, and you may need to get a new phone to get Android Pie.