Android flaw allows hackers to surreptitiously modify apps

A screenshot of an Android device that's been hacked by modifying the device manufacturer's application. The hack gives access to all permissions on the device.

Researchers said they've uncovered a security vulnerability that could allow attackers to take full control of smartphones running Google's Android mobile operating system.

The weakness involves the way legitimate Android applications are cryptographically signed to ensure they haven't been modified by parties other than the trusted developer, according to a blog post published Wednesday by researchers from mobile security startup Bluebox. The flaw has existed since at least the release of Android 1.6 almost four years ago. Hackers who exploit the vulnerability can modify app code to include backdoors, keyloggers, or other malicious functionality without changing the verification signature.

Malicious apps that exploit the vulnerability would enjoy the same system privileges as the legitimate one. That access could be especially dangerous if the app that's modified originated with the handset manufacturer or third parties that partner with the manufacturer, Wednesday's blog post said. That's because such apps are typically granted elevated privileges within the Android OS.

Read 4 remaining paragraphs | Comments Spreads Bad on Information on Securing WordPress

When it comes the security of WordPress there are unfortunately a lot of people out there spreading bad information. We were on the receiving end of one of these in the past few days. We received an email from trying to get us to promote an infographic on WordPress security from their website You can tell how much they care about security when you see is Running WordPress 3.5.1Keeping WordPress up to date is one the basic security measures that you need to doing to make sure your website is secure. If you are website about WordPress you have no excuse for not keeping it up to date, especially when the release notice for the new version, that was released last month, warns:

This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

Amazingly their security advice includes making sure to keep WordPress up to date, but they don’t follow their own advice and you shouldn’t either.

It really isn’t worth going through all of the bad information they managed to pack in to their infographic, but here are a couple of really bad pieces of advice:

One of their security recommendations is “Do not install WordPress themes that are available for free.”.  Something being free doesn’t make it insecure and something costing money doesn’t make it secure. WordPress is free, would that make it insecure? Do they think that the free themes on the WordPress website are insecure?

The second one is doozy. They claim that one of the “most common ways that result in the site being hacked” is “approving comments that are non relevant”. This isn’t even a way to be hacked, much less a common one. If adding a comment could lead to your website being hacked that would be a huge security vulnerability and the solution wouldn’t be to not approve irrelevant comments. What would stop someone from exploiting the vulnerability with a relevant comment instead?

Unfortunately their bad advice isn’t just on their website. A lot of websites have taken up their offer to spread the thing, including noupe, WP Daily Themes, and WP Daily. Incidentally, WP Daily titled their post on WordPress 3.5.2 UH OH. WP 3.5.2 SECURITY UPDATE. DO THIS NOW. and yet they didn’t:

WP Daily Website is Running WordPress 3.5.1

A Step To Actually Improve WordPress Security

Currently if a plugin in the Plugin Directory is found to have a security vulnerability and it is not fixed the plugin is removed from the Plugin Directory. Unfortunately anyone who is already using the plugin is not provided any alert that the plugin is known to be insecure. We have been pushing for this situation to be handled properly for some time. Until an alert is added in WordPress itself, you can get a more limited version of this functionality using our No Longer in Directory plugin.

Rampant Apache website attack hits visitors with highly malicious software

A campaign that forces sites running the Apache Web server to install highly malicious software on visitor's PCs has compromised more than 40,000 Web addresses in the past nine months, 15,000 of them in the month of May alone.

The figures, published Tuesday by researchers from antivirus provider Eset, are the latest indication that an attack on websites running the Internet's most popular Web server continues to build steam. Known as Darkleech, the rogue Apache module gets installed on compromised servers and turns legitimate websites into online mine fields that expose unsuspecting visitors to a host of dangerous exploits. More than 40,000 domains and website IPs have been commandeered since October, 15,000 of which were active at the same time in May, 2013 alone. In just the last week, Eset has detected at least 270 different websites exposing users to attacks.

Sites that come under the spell of Darkleech redirect certain visitors to malicious websites that host attack code spawned by the notorious Blackhole exploit kit. The fee-based package available in underground forums makes it easy for novices to exploit vulnerabilities in browsers and browser plug-ins. Web visitors who haven't installed updates patching those flaws get silently infected with a variety of dangerous malware titles. Among the malware that Darkleech pushes is a "Nymaim" piece of ransomware that demands a $300 payment to unlock encrypted files from a victim's machine. Other malware titles that get installed include Pony Loader and Sirefef.

Read 9 remaining paragraphs | Comments


The Java Autorun Worm, Java.Cogyeka (3 of 3)

As I wrote in parts one and two of this series of blogs, Java.Cogyeka uses an autorun.inf file to propagate and download an additional module. I was able to get the downloaded module, based on a Java application, even though it took over a week because of the difficulty in establishing a connection with the server. The downloaded module, like the main module, tries to protect itself through obfuscation with Zelix KlassMaster. After investigating the downloaded module, I discovered that the purpose of Java.Cogyeka is to steal information from a video game on the compromised computer.

The targeted game
The game being targeted by Java.Cogyeka is League of Legends, a free-to-play video game published by Riot Games. While the game is free-to-play, users can purchase additional characters and character skins with real money. Java.Cogyeka may target League of Legends because of these real money transactions.

The downloaded module attempts to steal the League of Legends player’s account information and keystrokes to gain control of their account. While the purpose of the threat is to steal information related to the League of Legends game, it may also steal additional information because of its keystroke-stealing capabilities.

Stealing keystrokes
The downloaded module drops two types of DLL files, a 32-bit version and a 64-bit version. This is done using the same technique that the threat uses for obtaining the drive letters of the removal drive in the main module, as described in the second Java.Cogyeka blog. The Java system does not permit Java applications to obtain keystroke information from other processes. The malware may steal passwords, but it needs a native call, so it drops the Windows DLL file from the Java application.

The SetWindowsHookEx API is used to log keystrokes and mouse operations while WH_KEYBOARD_LL and WH_MOUSE_LL are used as hook types. The stolen keystrokes and mouse operations are then sent to a remote server.


Figure 1. Downloaded module steals keystrokes and mouse operations

Stealing account information
The malware steals keystrokes in the hopes of obtaining a player's League of Legends user name and password. However, the League of Legends login window has an option to remember a player's user name and, if a player has selected this option, Java.Cogyeka cannot obtain the player's user name. To get around this, the malware also attempts to steal a file that contains the user's account information.


Figure 2. League of Legends login screen

To steal the user's account information, the malware tries to search for the following folder on all drives:

  • Riot Games/League of Legends/RADS/projects/lol_air_client/releases

This folder contains a folder with the name of the version number of the game, for example “” The malware traverses folders at the version folder searching for the following path:

  • deploy/preferences/global/

This file contains the game settings as well as the player's user name that is used to log in to the game.

Sending the stolen information
Once the downloaded module has obtained the login information, it sends it to the domain on TCP port 1087.

This server name has been deactivated and is no longer accessible. However, both the server name and port number are hardcoded into the module unlike the command-and-control server name and port number, and the stolen information is encrypted.


Figure 3. Malware observed worldwide as the targeted game is played all over the world

In this series of blogs, I have discussed the propagation and information-stealing functions of Java.Cogyeka and how it uses an obfuscation tool to protect itself from detection by security scanners. While the malware has a specific target, the video game League of Legends, other information may also be stolen through the captured keystrokes and mouse operations. Java.Cogyeka may also update itself because it downloads an additional Java module. We will continue to observe and investigate this malware.

I am left wondering why the malware requires the USB spreading functionality. The purpose of this malware is to steal information from an online game. The League of Legends is a type of game whereby users connect to a game server in order to play online. There is a possibility that it attempts to infect computers at Internet cafés. In this case, game players or administrators of the Internet café may use a USB storage device. On the other hand, a user may play the game with his or her friends at the same place and use USB storage devices to share files. It is possible that the malware aims to take advantage of such a situation.

Symantec detects these files as Java.Cogyeka, Java.Cogyeka!autorun, and Java.Cogyeka!gen1. We recommend  that users keep their security software up to date.