First widely distributed Android bootkit Malware infects more than 350,000 Devices

A New Android Trojan which is said to be the first Android Bootkit has been discovered by the Russian security firm Doctor Web.

The malware resides in the memory of the infected devices and launches itself early on in the OS loading stage and makes it hard to remove from the device.

The trojan, identified as Android.Oldboot.1.origin, installs one of its components into the boot partition of the file system. It also modifies the init script - a specialized program for initializing elements of the Android system.

When the device is turned on, the script is get executed and installs other malware components as a typical application.

Android virus which can't be removed by your Antivirus:
This malware is considered as most dangerous of android malware because even if you remove it, once the device is rebooted, the component residing in the protected memory area will re-infect the device.

Researchers believe the threat gets into the device when user reflash their smartphones with the modified firmware containing this Trojan.

The malware has reportedly been infected more than 350,000 mobile devices around. 92% of the infected devices are appeared to be from China.

To prevent yourself from being victim to such kind of threats, make sure that you are not installing firmware from unreliable sources. Users are also advised not to buy devices from unknown origin

Comments

Click-jacking or UI Redressing

Hi! Just want to share my finding, I have found Click-jacking or UI Redressing Vulnerability in on Google Map , enjoy ;-) This bug was reported to Google Security Team, fixed immediately. About Title: ClickJacking or UI Redressing on Google Map Business Risk: Normal Discovery Date: October 8, 2013 Author: Jitendra Jaiswal (me) Poc Details Impact On victim : 1. attacker change victim profile pic by useing his webcam and upload 2. update status acording to attacker Best, Jeet Jaiswal

Microsoft remotely deleted Tor-based 'Sefnit Botnet' from more than 2 Million Systems

In October 2013, Microsoft adopted a silent, offensive method to tackle infection due to a Tor-based botnet malware called ' Sefnit '. In an effort to takedown of the Sefnit botnet to protect windows users, Microsoft r emotely removes the older versions of installed Tor Browser software and infection from 2 Million systems, even without the knowledge of the system's owner. Last year in August, after Snowden revelations about the National Security Agency's ( NSA ) Spying programs, the Internet users were under fear of being spied. During the same time Tor Project leaders noticed almost 600% increase in the number of users over the anonymizing networks of Tor i.e. More than 600,000 users join Tor within few weeks. In September, researchers identified the major reason of increased Tor users i.e. A Tor-based botnet called ' Sefnit malware ', which was infecting millions of computers for click fraud and bitcoin ...

Facebook Web Security Bug Bounty: Directory Traversal Vulnerability / RCE In Parse.com

http://parse.com directory traversal vulnerability Little Insight: http://parse.com was vulnerable to a directory traversal / RCE vulnerability. As a result, it was possible for an attacker to load web server-readable files from the local filesystem. or Run commend on That Well this is my 4th reward form facebook Directory Traversal or RCE Vulnerability That give me 5th position in Facebook white-hat Page Report Date :23 July 2014 Reward For Directory Traversal or RCE Vulnerability : 20000$ How This work......? As we discussed earlier on my old post Flowdock Directory Traversal Vulnerability exposed files outside of Rails’ view paths. '%5C' turns into '\' after decoding. Using Rack::Protection it only rejects '/../' segments in the request path. patch apply for Rack::Protection acording CVE-2014-0130 and also Reject now '%5C' turns into '\' af...

Hacking Concepts

Search This Blog