Malwares pré-instalados roubam dados de usuários de países pobres


Uma investigação da empresa de segurança digital Secure-D, publicada pelo site BuzzFeed News, revelou que um software embutido em smartphones da marca chinesa Transsion está roubando dados – e dinheiro – de usuários de países pobres, especialmente na África.Com aparelhos que custam na faixa de US$ 30 (R$ 168 em conversão direta), a empresa lançou seu primeiro smartphone em 2014, e cresceu até se tornar a principal vendedora de celulares no continente africano, batendo os ex-líderes de mercado local, como Samsung e Nokia. A Transsion é a quarta maior fabricante de celulares do mundo, atrás da Apple, Samsung e Huawei, mas é a única desse grupo a focar exclusivamente nos mercados de baixa renda.Em um dos casos reportados pelo Buzzfeed, um aparelho Tecno W2 foi infectado com os malwares xHelper e Triada, que baixaram apps que faziam o usuário assinar serviços pagos sem seu conhecimento. O xHelper é conhecido entre os analistas de segurança como um "super malware", por possuir um sistema que se reinstala caso seja removido, tornando a sua eliminação praticamente impossível.O sistema da Secure-D bloqueou 844 mil transações conectadas a malware pré-instalado em telefones Transsion entre março e dezembro de 2019. De acordo com o diretor da empresa, Geoffrey Cleaves, a maior parte das vítimas é da África do Sul, Etiópia, Camarões, Egito, Gana, Indonésia e Mianmar. "O tráfego de transmissão representa 4% dos usuários que vemos na África. Ainda assim, contribui com mais de 18% de todos os cliques suspeitos", afirma o executivo.Questionado pelo Buzzfeed, um porta-voz da Transsion disse que alguns dos aparelhos da empresa continham os programas ocultos por culpa de um "fornecedor não identificado no processo da cadeia de abastecimento".A empresa garante que sempre atribuiu "grande importância à segurança dos dados dos consumidores e dos produtos", e que "cada software instalado em cada dispositivo passa por uma série de verificações de segurança rigorosas, como nossa própria plataforma de varredura de segurança, Google Play Protect, GMS BTS e teste VirusTotal".A Transsion ainda disse que criou uma correção para o Triada em março de 2018, depois que relatórios identificaram sua presença nos smartphones W2. A fabricante chinesa disse que também enviou uma correção para o xHelper no final de 2019 - em ambos os casos, os proprietários de telefones precisaram baixar as correções e atualizar seus telefones.Brasil também é alvoNo ano passado, a Secure-D descobriu malwares pré-instalado em telefones Alcatel no Brasil, Malásia e Nigéria. "Ele coleta e transmite localizações geográficas, endereços de e-mail, IMEIs para um servidor na China e possui várias permissões de invasão de privacidade no dispositivo", escreveu a empresa sobre o software malicioso.Se não tivesse sido bloqueado, o app teria conseguido "inscrever usuários de telefones Alcatel em países como Brasil, Malásia e Nigéria em serviços pagos pelos quais os usuários teriam sido cobrados mais de US $ 1,5 milhão", segundo a Secure-D. Essa atividade ocorria em segundo plano e não era detectada pelos usuários."Em muitos casos, é o primeiro smartphone [do consumidor] e a primeira vez que essas pessoas têm acesso à internet", explica Guy Krief, membro do conselho da Upstream Systems, empresa do Reino Unido que opera Secure-D. "Os dados consumidos pelo malware são uma parte muito importante da receita dessas empresas", completa.Via: BuzzFeed News

from Olhar Digital :: Segurança https://ift.tt/34tZgvP

Comments

Post a Comment

Popular posts from this blog

AR18-312A: JexBoss – JBoss Verify and EXploitation Tool

Image
Original release date: November 08, 2018 Summary JBoss Verify and EXploitation tool (JexBoss) is an open-source tool used by cybersecurity hunt teams (sometimes referred to as “red teams”) and auditors to conduct authorized security assessments. Threat actors use this tool maliciously to test and exploit vulnerabilities in JBoss Application Server (JBoss AS)—now WildFly—and a variety of Java applications and platforms. JexBoss automates all the phases of a cyberattack, making it a powerful and easy-to-use weapon in a threat actor’s cyber arsenal. This report provides a detailed analysis of JexBoss’ functionality, along with detection, response, prevention, and mitigation recommendations. Description JexBoss JexBoss is a tool used to test and exploit vulnerabilities in Java applications and platforms, including the JBoss AS/WildFly web server framework. JexBoss is written in the Python programming language using standard Python libraries. JexBoss is run from the command-line inter...
Keep reading

SB18-141: Vulnerability Summary for the Week of May 14, 2018

Original release date: May 21, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium severity ...
Keep reading

SB18-029: Vulnerability Summary for the Week of January 22, 2018

Original release date: January 29, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium sever...
Keep reading

Learn Python Programming – 7 Courses Video Training Bundle

Image
It's no secret that learning how to code is one of the most important things you can do when it comes to the beginning or furthering practically any career in programming and technology. The only problem a beginner often faces is that there are seemingly countless programming languages to choose from, which makes it exceedingly difficult for aspiring or even seasoned programmers to know which from The Hacker News http://bit.ly/2Ug9eJ8
Keep reading

SB18-043: Vulnerability Summary for the Week of February 5, 2018

Original release date: February 12, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium seve...
Keep reading

SB18-057: Vulnerability Summary for the Week of February 19, 2018

Original release date: February 26, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium seve...
Keep reading

SB18-008: Vulnerability Summary for the Week of January 1, 2018

Original release date: January 08, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium sever...
Keep reading

Vulnerability Summary for the Week of March 2, 2020

Original release date: March 9, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD . In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apple -- multiple_products   A denial of service issue was addressed with improved input validation. 2020-02-28 7.8 CVE-2019-8741 MISC MISC MISC MISC MISC MISC MISC centreon -- centreon   An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance parameter. 2020-03-05 7.5 CVE-2019-17647 CONFIRM CONFIRM CONFIRM MISC CONFIRM CONFIRM centreon -- centreon   Centreon 19.10 allows remote authen...
Keep reading

STJ se restabelece após ransomware, mas PF investiga cópia de dados

Image
Os estragos causados pelo ataque com ransomware ao Superior Tribunal de Justiça (STJ) ainda não são totalmente conhecidos. A Polícia Federal assumiu a investigação do caso, não só para compreender a extensão dos danos, como para averiguar o acesso aos arquivos, que pode incluir até mesmo uma cópia indevida dos dados.Segundo comunicado do STJ, aos poucos os sistemas começam a ser retomados após o ataque. A retomada começou na terça-feira (10), com a retomada de algumas das funcionalidades mais acessadas do portal. As centrais telefônicas voltaram a operar parcialmente na quarta-feira (11) e em sua totalidade na quinta (12). Agora, o Tribunal também informa que a restauração dos sistemas de informática já está praticamente finalizada.O STJ diz que há ainda dois pontos a serem resolvidos. Um deles é o Sistema Integração, que deve ser restabelecido durante o fim de semana. Além disso, até segunda-feira (16), a Secretaria de Tecnologia da Informação e Comunicação deve finalizar a disponibi...
Keep reading

LibSSH Flaw Allows Hackers to Take Over Servers Without Password

Image
A four-year-old severe vulnerability has been discovered in the Secure Shell (SSH) implementation library known as Libssh that could allow anyone to completely bypass authentication and gain unfettered administrative control over a vulnerable server without requiring a password. The security vulnerability, tracked as CVE-2018-10933, is an authentication-bypass issue that was introduced in from The Hacker News https://ift.tt/2NJHOaM
Keep reading