Social Items

Showing posts with label Mobile Web. Show all posts
Showing posts with label Mobile Web. Show all posts
Google has launched Android Partner Vulnerability Initiative (APVI) program to tackle Android security issues, especially those affecting many of the Android OEMs.

While APVI aims to provide transparency at driving remediation on security issues discovered by Google that affect any phone model that is shipped by Android partners.

The program will also alert users of the security vulnerabilities in their Android phones manufactured by third-party companies, with all the detected security issues made available on Google’s catalog, and tips on how to migitage against those vulnerabilities.

How APVI will improve Android OEM devices' security



APVI targets Google-discovered security issues on Android that could potentially affect the security of any device running Android or its user and it's aligned to ISO/IEC 29147:2018 Information technology, which security techniques include vulnerability disclosure recommendations.



Also, the initiative covers issues impacting device code which is not particularly serviced or maintained by Google; it aims to close the security gap, by adding another layer of security for targeted set of Android OEMs. This is perhaps the first time Google is providing a clear way to process Google-discovered security issues outside the AOSP code that can impact a much smaller set of specific Android OEMs.

The company had earlier made it possible to report vulnerabilities in Android code through the Android Security Rewards Program (ASR), and vulnerabilities in third-party Android apps via the Google Play Security Rewards Program, and also, releases ASR reports in Android Open Source Project (AOSP) based code via the Android Security Bulletins (ASB).

How APVI Protects Android users



APVI has currently processed several security issues that affect Android users, including protection against permissions bypasses, code execution in the kernel, and credential leaks, among others.

Google is working hard to incorporate industry-leading security features with the partnership of developers and device OEMs to keep the Android ecosystem secure and safe for users.

Google launches APVI to tackle Android Security Issues On Non-Pixel Phones

Android Malware


ThreatFabric researchers have discovered a new strain of Android malware targeting not only banking apps, but also non-banking ones, to steal login data and credentials, including social networking, and cryptocurrency apps.

The malware, dubbed BlackRock, is a variant of Xerxes banking malware, which is a strain of the LokiBot Android banking trojan that was first discovered in 2016. BlackRock's major exploits includes: intercepting SMS messages, notifications, and also recording keystrokes from targeted apps, as well as being capable of running undetected by antivirus software.

It contains a number of social networking, communication and dating apps that haven't been previously observed in any target lists for other banking Trojans.

How BlackRock Steals Data from Non-Banking Apps



BlackRock steals data by abusing Android's Accessibility Service privileges, which seeks users' permissions under the guise of purported Google updates once it is launched for the first time on the Android device.

BlackRock Malware


It then goes on to grant additional permissions to itself and establish a connection with a remote command-and-control (C&C) server to execute its malicious activities by injecting overlays on the targeted apps' login and payment screens.

BlackRock is different from other malware, in that the sheer number of the applications targeted are enormous, which go beyond the mobile banking apps typically singled out by related Android malware.

What Android users can do to be Safe from BlackRock



If you notice unusual notifications and screen activites on your Android device, or suspect that it has any malware-infected apps, quickly uninstall the app from your device, and also make sure the operating system and apps on your device are up to date.

It is recommended that Android users should always scrutinize the permissions granted to every app installed on their device.

Non-Banking Apps now targeted by New Android Malware to steal Passwords

unc0ver-5.0.0


Jailbreak is akin to rooting on Android, it's a privilege escalation that exploit known flaws in iOS to gain root access and thus, grant users full control over their devices.

While the popular jailbreaking tool, known as "unc0ver" has released a new version of the software dubbed unc0ver v5.0.1 which is capable of unlocking any iPhone, including those running iOS 13.5. This tool allows iOS users to remove restrictions imposed by Apple, thereby allowing them access to additional customization and to run prohibited apps.

The developers also highlighted the extensive testings carried out to ensure compatibility on a broad range of iOS devices, from iPhone 6S to even the newer iPhone 11 models, which encompasses version iOS 11.0 through iOS 13.5; though versions 12.3 to 12.3.2 and 12.4.2 to 12.4.5 are excluded.

How Jailbreaking actually Works?



Jailbreaking is simply the removal of software restrictions imposed by Apple, thereby allowing users access to additional features like customization and use of otherwise prohibited apps.

It tend to be device specific and based on previously known vulnerabilities, therefore, jailbreaking is very much dependent on the iPhone model and iOS version, in order to be successfully replicated. However, it also weakens a device's security, which opens the door to all kinds of malware attacks.

The security risks, coupled with Apple's hardware and software lockdown, have made it pretty difficult a decision to jailbreak devices deliberately.

Downloading the new Unc0ver v5.0.1 Jailbreak



The new Unc0ver v5.0.1 jailbreak leverages a yet-unknown zero-day vulnerability, which the iPhone maker will eventually roll out a security update for likely in the coming weeks to patch the hole exploited by unc0ver.

But until then, the jailbreak can be downloaded and installed using an iOS, macOS, Linux, and Windows devices from the official website. And the usage instructions are available on the unc0ver website as well.

Unc0ver v5.0.1 can Jailbreak any iPhone, even with latest iOS 13.5 version



The ad fraud scheme is a practice that bad actors leverage by exploiting the system to deliver unsolicited ads, allowing the threat actors to effectively steal advertising funds from enterprises.

While the practice is increasingly finding its way into the mobile ecosystem, as over 50 apps on the Google Play Store, with about a million downloads have been caught using new tricks to secretly self-click ads without the knowledge of smartphone owners, according to security firm Check Point.

The ad fraud actors use a piece of malware called "Tekya" which runs in the apps to imitate users' actions by clicking ads from ads networks like Google’s AdMob, AppLovin’, Facebook, and Unity.

How the Mobile Ad Fraud actors evade Google Play Protect



The piece of malware, Tekya obfuscates the native code to avoid detection by Google Play Protect, which is part of an inbuilt Android defense system against malware, and utilizes the ‘MotionEvent’ mechanism in Android to imitate the user’s actions to generate ad clicks.

According to the researchers, the Tekya malware was undetected by even some known antivirus software such as VirusTotal and Google Play Protect, which ultimately made it available for download in over 50 applications on Google Play Store.

The ad fraud campaign seems to clone legitimate popular applications to gain more audience, mostly kid-friendly apps, with a larger chunk of the applications running Tekya malware serving as children’s games.

How to protect your Device from Tekya malware



This ad fraud highlights once again that Google Play Store can still be tricked into hosting malicious apps, with nearly 3 million apps available on the store; it is far more difficult to manually check that every app is safe.

Therefore, users should not rely on Google Play’s security measures alone to ensure that their devices are protected. If you suspect that your device have any of the infected apps, quickly uninstall the application from your device, and make sure your device operating system and apps are up to date.

Furthermore, enterprises should make sure that the devices used by their employees are free from malware by enforcing the use of antivirus software to secure them against sophisticated mobile attacks.

How Mobile Ad Fraud actors evade Google Play Protect with Tekya Clicker



Huawei, the Chinese technology giant was banned by the US government in May 2019, from accessing some US-patented technologies, including most of the Google Mobile Services (GMS) on its mobile phones.

While GMS is a bundle of Google apps and APIs that Android phones need for downloading of apps, security and so many other functionalities. Huawei went ahead to create an alternative to Google Mobile Services (GMS), named Huawei Mobile Services (HMS), having previously launched HarmonyOS as a new operating system to replace android.

Huawei Mobile Services will be offered on all its devices allowing users to access important information on the devices, including other Huawei services or products. If you're using a Huawei smartphone, this HMS is the perfect way to manage your account and access all Huawei services.

What major apps are bundled with Huawei Mobile Services?



Huawei has been actively improving on the Huawei Mobile Services (HMS), which currently includes the following app bundles: Huawei ID, Cloud, AppGallery, Themes, Huawei Video, Browser and Assistant.


  • HUAWEI ID: This is in the center of everything, conveniently linked to all applications so that users can access everything securely with just a tap.
  • HUAWEI MOBILE CLOUD: Enable users to backup and restore data and phone settings wireless, or synchronize and transfer data across HUAWEI devices, as well as access files safely using Cloud Drive.
  • HUAWEI APPGALLERY: AppGallery features four-layer malware detection mechanism that ensures all apps are safe to download and use, and offers some exclusive benefits like AppGallery gifts.
  • HUAWEI VIDEO: HUAWEI Video makes your smartphone screen the window to the world, with high definition, immersive and diverse content such as TV series, films and documentaries.
  • HUAWEI THEMES: With tens of thousands of stylish themes, and wallpapers available to help you create a personalized look and feel for your smartphone. HUAWEI Themes offers a stunning gallery of art and design right in your pocket, to customize your phone anytime.
  • HUAWEI BROWSER: Huawei Browser is a dedicated web agent that provides high-speed Internet browsing, conveniency, and comprehensive privacy protection for smartphones and tablet users.


The company has invested a whopping $3 billion to HMS development to free itself from Google's clutches. However, it isn't entirely ditching Android, as Huawei could still get its hand on AOSP (the open-source Android version minus Google services), which is available for anyone to use.

Huawei Mobile Services as a viable alternative for Google Mobile Services (GMS)



The decades old mobile technology standard, USSD remains relevant today, even more than it was back in the days. Anyone using a mobile phone can't escape dialing *123# to either check airtime balance or some other service prompt; but nowadays, USSD have gone beyond network providers' native services.

USSD, which stands for Unstructured Supplementary Service Data has got a mainstream appeal because it doesn't require data, nor airtime to access, as mobile operators typically use USSD for their native services such as airtime balance checks, top-ups, data services and promotional offers.

It’s perhaps the most basic mobile phone-based service – which potentially, have made some big strides in fintech services inclusion of the unbanked Nigeria, who are mostly living in the rural areas where network data services are abysmal or utterly unavailable.

Why the USSD Service was Introduced



As the mobile industry realized the need to facilitate easy machine-to-machine communications to take care of some basic tasks that requires the mobile device to query the network, the USSD protocol was born to supplement the existing GSM standards that mostly focused on person-to-person communications.

While network operators utilized STK (Sim Toolkit) technology in order to facilitate the reselling and subscription service offerings, the STK technology allows the operators to code a set of commands into their SIM cards which defines how the SIM cards interact with the device.



However, for STK to work, it's essential that the SIM card inserted in the mobile device is burned with the menu. Then, the application is normally protected by pin, either SIM card pin or phone lock pin and whenever the phone is locked or no sim inserted into the phone the service won't be possible.

Whereas, the USSD technology is network-deployed and not resident on the mobile device, the service is located in the mobile network and users who switched to the network will have access to the network's USSD menu. Whenever a user requests a menu, it initiates a real-time session between the USSD application platform and the mobile user once the service is invoked.

Mobile Apps vs USSD



Despite the predictions by several experts in financial services that app-powered mobile banking would be replacing USSD, it has remained the most widely adopted and successfully integrated mobile technology in emerging markets, including Nigeria.

Albeit, the USSD service has not necessarily rendered app-based services, such as banking redundant, as they’re quite different in their offerings, with different customers and market segments.

While some customers would prefer one, others might not. There are currently multiple variables that determines individual preferences, like data access, mobile device and educational background, plus of course, income. And certainly, not every customer have a smartphone and most devices don’t have data support or Wi-Fi connectivity in the rural areas.

In considerations to the factors, any financial service providers (FSPs) looking to enter the Nigerian market with mobile banking solutions should as a necessity incorporate USSD service, if they really want to succeed, as only USSD works for everyone.

Why Mobile Apps won't be replacing USSD in Nigeria anytime soon

The next version of Google's mobile software, Android P - which at the moment is only available as a developer preview version brings upgrades in security and indoor mapping, among other nifty additional visual changes.

While still in the first developer preview version, Android P is very likely getting more enhancements — and as obvious some of the features already documented might look different in the next preview.

Google is toeing the line of Apple's iPhone X feature, the notch, with little cutout at the top of phones screens that take up about the whole screen. And that's perhaps the biggest changes in the software at the moment, and some manufacturers are already building notch compliant devices.



Since the new OS is optimized for notches which cuts into the top display area, Google has changed the position of notifications right next to the time. And about four different app icons will be displayed; which Android P shows a simple dot to let users know more items are waiting on sliding down the notification tray.

Also, the layout of items is a bit altered, and the grayscale icons of Oreo replaced by colorful circles.



Additionally, it presents the option to use Smart Replies, Google's AI-powered responses to texts that are already available in Gmail and its chat app Allo. And you'll find images in notifications which is helpful to quickly show who's on chat.

The new software focuses more on improving security as it restrict access to your phone's microphone and camera while apps are running in the background, which could help thwart the effort of hackers.

Albeit, Android P remains unfinished and the preview only serve to to give software developers a template to work on before the actual release.

As Google's tradition of naming its new mobile software flavors alphabetically and after something edible, it's expected Android P will also get a delicious moniker. The company will definitely unveil more features at its annual developer conference, Google I/O, in May and perhaps the new name choice, too.

Android P: What to expect from the next version of Google's mobile software



Google Lens, hitherto was only available to users of the Photos app on the latest Pixel phones, but now, Google is rolling out the feature to all Android users. Lens offers users a visual search engine that can recognize what’s in their images and scan business cards, among other image processing capabilities.



While the feature isn't yet foolproof, Lens can be both useful and frustrating at times, as it’s easier to take a picture of a landmark or restaurant to get more information than searching for it with a keyword.

Though you probably won’t need Lens to tell you when you're standing in front of the Burj Al Arab, the fact that it can show you more information about places of note, is actually quite handy.

And the ability to scan a business card can be pretty useful, though, most of us have done away with the good old business cards a long time ago. But users can also create a contact from a business card and certain phones will eventually be able to access Lens through Google Assistant.

Perhaps, Google’s visual search function could be improved upon to easily identify and annotate all objects, later in the future. Google had promise to bring Lens on Google Photos for iOS users soon, but no particular time frame has been set for it to happen.

Google Lens now available to all users of its Photos on Android

Subscribe to: Posts (Atom)