November 6th, 2014
Ransomware, forms of malware that lock down your device and demand a payment, or ransom, to release your files, have seemingly increased in usage in the past year, but the earliest forms of ransomware have been around for longer than that. The FBI virus began infecting computers several years ago and uses the same scare tactics seen in freshly minted ransomware. As reported in a post on Spyware News, the FBI virus has now been adapted and evolved to infect Android smartphones and tablets.
Common methods of infection stem from malicious email attachments, or false alerts on websites asking you to update Adobe Flash, Java or a similar program.
Once the malware infects your device, it quickly locks it so you can’t access any apps or files and displays an alert claiming to be from the FBI. The alert demands $300 to be paid within 48 hours.
Although seeing this type of warning is surprising and jarring, there are many clues that this is a hoax. Most notably, the warning is littered with typos and poor grammar, which is a common characteristic of malware and malicious emails.
While it can be extremely difficult to by-pass this malware, under no circumstances should you pay the fine asked for. There’s no guarantee that your device will be unlocked if you do and that money goes to prolong this threat. The FBI Android virus, in fact, doesn’t actually encrypt your files so removing the malware should fully restore your system. So, how do you remove it?
- First, turn off your device and restart in Safe mode. To do so, turn it on and hold the menu button with one of, or both of, the volume buttons, depending on your device.
- Once in Safe mode, go to Settings, and click on Apps or Application Manager. Find any suspicious apps you don’t recognize. The FBI virus typically disguises itself as a video player or an app called ‘ScarePackage’ or ‘BaDoink’. Uninstall the suspicious app.
- Restart the device to see if it has been restored.
If these steps don’t work, it’s not a lost cause. You’ll just need a little more expertise.
If you’ve been infected by the FBI virus or any other type of malware, Geek Rescue will help. Come by or give us a call at 918-369-4335.
For your business needs, visit our parent company JD Young.
October 22nd, 2014
A new Android ransomware threat is spreading fast thanks to it adapting to become a worm spread through text messaging. The Koler Android trojan was discovered by AdaptiveMobile in the United States and managed to affect hundreds of users in just one day. John E. Dunn of TechWorld explained how the Koler trojan is spreading so rapidly.
Koler began infecting victims who visited untrusted websites like porn and gambling sites. Many examples of mobile malware stays quarantined to those areas and never becomes a large scale problem for the general public. Koler, however, transformed into an SMS worm, which means it sends a shortened and disguised link via text message to everyone in an infected user’s contacts. That link appears to be from the user, which results in many of their contacts clicking on it and being infected themselves.
Those that click on the link are sent to a Dropbox page and asked to install a photo viewing app in order to see some photos that “someone” has uploaded of them. Agreeing to this download results in the Koler trojan to take quick effect.
Almost immediately, the user’s screen is blocked by a message supposedly from the FBI. A ransom is demanded to unlock the phone. Meanwhile, that same link is sent to the user’s contacts.
The good news is that if the default security options are enabled on your Android device, the download of the malware should be blocked because it stems from a third-party. However, many users have already discovered that their security settings aren’t configured correctly to protect them from a threat like this.
The make-up of this attack isn’t complicated, which means it’s also fairly straightforward to disable it. Dropbox has already been asked to remove the download from its servers and disable to link. Attackers could easily move their malicious files elsewhere and continue to victimize Android users, however.
If your device becomes infected by malware, Geek Rescue will fix it. Stop by or give us a call at 918-369-4335.
For your business solutions needs, visit our parent company JD Young.
August 11th, 2014
Having your smartphone stolen is bad news for a number of reasons. Beyond the fact that you now have to replace your phone, you also run the risk of having valuable data stolen from it. Texts, pictures, passwords and other files are all vulnerable when your smartphone is stolen or even lost. But, there are ways to protect your data before this scenario plays out. At Gizmodo, David Nield explains a few methods for securing your smartphone’s data so a thief can’t access it.
Every smartphone includes the option to lock the screen, but an estimated half of users don’t use any type of lock function. This becomes especially problematic when your phone is stolen, or you just leave it behind or unattended for a few minutes. Many users are reluctant to put a lock in place because they don’t want to have to enter their PIN each time their screen goes to sleep. But, for Android users, there are apps available that only put locks in place when you leave your house or workplace. Or, you could use a lock pattern instead of a number combination. Anything is better than leaving your phone completely vulnerable.
Much like lock screen functions, remote features that both wipe your smartphone’s data and locate the device are available to all users. They just need to be set up or activated. Unfortunately, many users either don’t know about them, or fail to activate them before they need them. Apple, Android and even Windows phones all have the capability to be remotely wiped and located in the event they’re lost or stolen. Do some research and make sure you’re prepared with your device.
Keeping strangers from poking through your phone is half the battle, but the other half is getting that data back. If you regularly create back-ups of your most important files, you’ll never have to worry about losing them. This comes in particularly handy if you find yourself needing to remotely wipe your phone. You can do so even if you’re not positive it’s been stolen because you’ll have back-ups of everything readily available.
It’s also a good idea to change passwords on accounts you have an app for, like social media or banking apps, to keep strangers out. You can also look into two-factor authentication to make accounts safer, but that won’t help as much in the event that someone else has control of your device.
If you need help securing any of your devices, or your having other issues with them, call Geek Rescue at 918-369-4335.
For your business solutions needs, visit our parent company JD Young.
July 11th, 2014
Gmail is one of the most popular email clients around and iOS devices are likewise incredibly prevalent. It stands to reason, then, that millions of individuals access their Gmail accounts on their iPhone or iPad. As Jeremy Kirk reports for Computer World, doing so leaves users vulnerable to data theft.
At issue is a lack of a vital security technology that would keep attackers from spoofing security certificates and gaining access to the encrypted communications being sent through Gmail. Any website or application that has users sending potentially valuable personal information uses digital certificates to encrypt that data. Attackers have been able to fake these certificates, however, and decrypt the data.
Google would be able to put a stop to these man-in-the-middle style of attacks by implementing a technology called certificate “pinning”. This involves hard coding legitimate certificate details into an application. While Google has known about this vulnerability since late February, they’ve yet to implement pinning.
Making this more odd is that this vulnerability only affects iOS users because Gmail for Android uses certificate pinning. This is being referred to as “an oversight by Google”.
For the time being, using Gmail on your iPhone is unsafe. There’s always a possibility of your messages being intercepted by a third party.
At Geek Rescue, we offer a number of email solutions for home and business, as well as support for mobile devices, including iPhones and Androids. If you’re having issues with technology, call us at 918-369-435.
July 9th, 2014
When it’s time to upgrade to a newer smartphone, what should you do with your old phone? If it’s too old, or no longer functioning, you’ll probably look into recycling it. But, if it’s still in good shape, you can sell it for good money. The problem is that selling your phone might also mean giving someone else access to your data. AT ZDNet, Jack Schofield reports that a recent experiment by security company Avast revealed how vulnerable even deleted data is on smartphones.
Avast bought 20 previously owned Android smartphones off of eBay to find out how much data they could recover from the previous owner. Even though the phones had been wiped and returned to factory settings, the team was able to restore emails, text messages, images, contacts and even a completed loan application rich with valuable personal information.
All of this was possible through the use of available forensic software.
So, is selling your old smartphone really worth it if you’re risking losing control of your personal data? Probably not. There’s also an added worry with more employees using their personal smartphones for business. Their company’s data could be at risk also if they decide to sell their old smartphone for a few extra bucks.
There are plenty of apps available that claim to be able to effectively wipe your phone, but it’s hard to find out which are actually able to do the job. Many experts suggest that the only way to truly erase what’s stored on your phone is to destroy the hard drive completely.
This vulnerability is bad news for those who want to sell their old devices, but it could be good news for those who have accidentally deleted or lost access to important data. In those cases, it’s likely that those files can be restored through the right process.
At Geek Rescue, we’re able to recover lost, deleted or corrupted files from all devices. We also help secure your device, or reset it to factory settings. Whatever your need, give us a call at 918-369-4335.
June 19th, 2014
The way smartphones are used is changing. More users are willing to surf the web, and even make purchases with their phones than ever before. Unfortunately, this means that it’s more profitable than ever to launch malware attacks against these devices. At Dark Reading, Kelly Jackson Higgins explains one of the latest threats against Android users and how it could compromise users’ bank accounts.
The attack begins with a fake Google Play store app icon appearing on your device. If you look closely, this fake icon is easy to spot. It’s titled “Googl App Stoy”. This would be a dead giveaway that it’s a fake, but many users fail to look past the official looking logo.
It’s unclear how exactly the malware infects Android devices, but it’s likely done through a malicious app that’s either infiltrated the official Play store or the user downloaded from an unverified location.
The malware lay larges dormant on a device until the fake Play store app is clicked. At that point, it is activated and able to steal banking website log in information, as well as text messages.
What makes this malware particularly dangerous is how difficult it is to get rid of. Only three out of 51 antiviruses tested were able to detect its presence. That’s led to about 200 reported victims over the past 30 days. Complicating matters even further is the app’s supposed ‘Uninstall’ feature. While using ‘Uninstall’ seems to remove the app icon, it reappears and the malware continues to run when the device is restarted.
So far, this attack has only targeted Korean users, but that suggests that users in the US could be targeted soon by this or similar malware.
If your device is infected with malware, or you’d like to find out how to protect yourself better, call Geek Rescue at 918-369-4335.
May 19th, 2014
It’s a well-known concern that Android users are much more at risk for malware infections than iOS users. Just a month ago, a fake antivirus app made the rounds in the official Google Play store and victimized a number of users. Google has since offered refunds to those who mistakenly downloaded the malicious app, but it seems they haven’t sufficiently protected against a similar threat reappearing. Lucian Constantin reports at Network World that the Google Play store and the app store for Windows Phones have both recently had malware hidden behind recognizable brand names identified in their stores.
It’s a fairly recent development, but it seems criminal developers are launching malicious apps with well-known company names to further confuse users. This is a well-known tactic of email scams and phishing websites.
One developer account launched malicous apps under the names Avira Antivirus, Mozilla Firefox, Google Chrome, Opera Mobile, Internet Explorer and Safari. The same developer also has a Kaspersky Mobile antivirus app complete with the company’s logo. When downloaded, the app will even simulate a scan of the device’s files.
Making these fake apps more believable, and more costly to users, is that they aren’t free. The Kaspersky Mobile app costs about $4. Most users instinctively trust paid apps more than free ones. A number of free apps have been reported to be malicious, but there’s an implied value tied to something that costs money. It’s also much more believable to pay money for a high quality, big name security app than to get it for nothing.
Some of these apps have been downloaded more than 10-thousand times and even made it onto the “Top Paid” apps list that helps them be further distributed.
Because there has been no sufficient changes made to the Android and Windows Phone app stores, it’s likely that these fake apps will continue to pop-up. However, since many of them steal the exact name of legitimate apps from recognized industry leaders, there’s also likely to be more pressure put on both Google and Microsoft to enhance security.
If you’ve mistakenly downloaded a malicious app, or are having any other kind of trouble with one of your devices, call Geek Rescue at 918-369-4335.
April 25th, 2014
There have been plenty of warnings about malware targeting Android devices. The Android operating system, due in large part to its open source nature, has been plagued by security threats at a much higher rate than Apple’s iOS. Still, there’s never been a documented trojan capable of sending premium SMS messages victimize users in the United States. As Adam Greenberg of SC Magazine reports, a trojan known as FakeInst has now done just that.
FakeInst isn’t only capable of sending text messages that cost users money. It’s also able delete messages, steal them and respond to contacts.
Users in the US also are far from the only victims of the SMS trojan. In all, 66 countries have been affected, including Canada, Mexico, France, Spain and Italy.
Unlike some other more malicious threats that infect devices through no real fault of their users, FakeInst has a specific infection method. A phishing website is set up that attracts users who are on their Android smartphone looking for pornographic content. The site asks visitors to download an application. After installing the application, the user is then asked to send a text message to a service to access content. These actions allow the trojan to infect the device and decrypt the necessary information needed to take over SMS capabilities.
This ends with the malware sending premium text messages that cost about $2 each.
Researchers have tracked the trojan to Russian origins, where the first reports of infection were found.
Thankfully, for most users this threat is easy to avoid. Don’t install apps from outside of the official Google Play store and certainly don’t download apps from less than reputable websites.
If your smartphone or other device has been infected by any type of malware, bring it to Geek Rescue or call us at 918-369-4335.
April 16th, 2014
Users of Android smartphones are already at a significantly higher risk of malware infection than their iPhone counterparts. Experts, however, are warning of even more threats coming throughout 2014. One of those threats has already been identified and has infected millions of devices. Chris Smith of BGR reports on the Android malware threat called ‘Oldboot’ that is also being referred to as “the biggest threat to the operating system to date”.
Oldboot is capable of installing malicious apps on a device and can even remain hidden from detection or “fight” antivirus apps by modifying or uninstalling them. But, what makes it so dangerous is Oldboot’s ability to re-infect devices even after seemingly being removed. This malware is stored in the memory of devices and alters booting files. Infected devices then re-install malware in the early stages of their restarting process.
Oldboot is referred to as advanced malware because it has so many capabilities. It’s able to send text messages from a user’s device, modify the browser’s homepage, launch phishing attacks and more.
Perhaps the biggest problem is very little is known to date about what specific Android devices are at risk or even how devices are infected. Most Android malware infects devices through malicious apps. Occasionally, these malicious apps find their way into the official Google Play app store, but more often they’re downloaded from an untrusted source.
Other dangers include malicious text messages and emails and malicious websites visited on your smartphone.
If you think your device has been infected by any form of malware, bring it to Geek Rescue or give us a call at 918-369-4335.
April 16th, 2014
It’s no secret that malware is an ever-present threat to internet users. It’s also no secret that while defenses against malware are steadily improving, the number of malware being produced and its capabilities are growing. A recent study released by security firm Panda Labs confirmed the growing threat of malware, as Tony Bradley reports for PC World.
In their 2013 security report, Panda Labs found that about a fifth of the malware that exists was created last year. That speaks to the rapid growth of malware production. In 2013 alone, 30-million new threats were created, which breaks down to about 82-thousand per day.
Of these newly minted threats, about 70-percent are trojans, which are particularly troubling forms of malware capable of mining data and even controlling an infected computer while staying hidden from users and security tools. Total, Panda Labs discovered more than 20-million trojans. The rest of the malware was made up of a combination of worms, viruses and adware or spyware. Trojans were also responsible for the most successful infections and accounted for almost 80-percent of infections in 2013.
In terms of application vulnerabilities, Java was to blame for the most attacks. Exploits on a security flaw in Java led to successful attacks on Twitter, Facebook, Apple and Microsoft.
With so many forms of malware around, it’s amazing users aren’t victimized more often. Most users aren’t infected by malware often, but even becoming the victim of malware once each month would mean you avoided all but .0001 of all new threats. Given these statistics, it’s clear why experts warn that there’s no such thing as perfect security.
Panda Labs also agreed with the consensus that in the mobile world, Android is the most popular target for malware producers. They also sent a warning to users that more targeted attacks aimed at stealing data would be coming this year.
Users who are unprotected by security tools like antivirus programs run a significantly higher risk of becoming the victim of an attack. This could lead to the harm of your computer and the theft of your data.
For help securing your computer or recovering from an attack, call Geek Rescue at 918-369-4335.
