KEMBAR78 | Portal Berita

KEMBAR78

Google Online Security Blog: April 2017

Security Blog

The latest news and insights from Google on security and safety on the Internet

Next Steps Toward More Connection Security

April 27, 2017

Posted by Emily Schechter, Chrome Security Teambegan our questIncognito mode

Treatment of HTTP pages in Chrome 62

Our planchange in Chrome 56

Treatment of HTTP pages with user-entered data in Chrome 62easier and cheaper than ever beforeset-up guides

New Research: Keeping fake listings off Google Maps

April 6, 2017

Posted by Doug Grundman, Maps Anti-Abuse, and Kurt Thomas, Security & Anti-Abuse ResearchGoogle My Businesscharge exorbitant service fees for services“Pinning Down Abuse on Google Maps” International World Wide Web ConferenceWhat is a fake listing?selling knock-off products onlineHow does Google My Business verify information?Keeping deceptive businesses out — by the numberspiloting an advanced verification process

We detect and disable 85% of fake listings before they even appear on Google Maps.

We’ve reduced the number of abusive listings by 70% from its peak back in June 2015.

We’ve also reduced the number of impressions to abusive listings by 70%.

An Investigation of Chrysaor Malware on Android

April 3, 2017

Posted by Rich Cannings, Jason Woloz, Neel Mehta, Ken Bodzak, Wentao Chang, Megan RuthvenPotentially Harmful Applications targeted attackWhat is Chrysaor?NSO Group Technologiesfirst identified on iOSCitizen LabLookoutVerify AppsWhat is the scope of Chrysaor?

How we protect you

Identify PHAs using people, systems in the cloud, and data sent to us from devices

Warn users about or blocking users from installing PHAs

Continually scan devices for PHAs and other harmful threats

What do I need to do?

Install apps only from reputable sources: Install apps from a reputable source, such as Google Play. No Chrysaor apps were on Google Play.

Enable a secure lock screen: Pick a PIN, pattern, or password that is easy for you to remember and hard for others to guess.

Update your device: Keep your device up-to-date with the latest security patches.

Verify Apps: Ensure Verify Apps is enabled.

Locate your device: Practice finding your device with Android Device Manager because you are far more likely to lose your device than install a PHA.

How does Chrysaor work? ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

Installing itself on the /system partition to persist across factory resets

Removing Samsung’s system update app (com.sec.android.fotaclient) and disabling auto-updates to maintain persistence (sets Settings.System.SOFTWARE_UPDATE_AUTO_UPDATE to 0)

Deleting WAP push messages and changing WAP message settings, possibly for anti-forensic purpose.

Starting content observers and the main task loop to receive remote commands and exfiltrate data.

Repeated commands: use alarms to periodically repeat actions on the device to expose data, including gathering location data.

Data collectors: dump all existing content on the device into a queue. Data collectors are used in conjunction with repeated commands to collect user data including, SMS settings, SMS messages, Call logs, Browser History, Calendar, Contacts, Emails, and messages from selected messaging apps, including WhatsApp, Twitter, Facebook, Kakoa, Viber, and Skype by making /data/data directories of the apps world readable.

Content observers: use Android’s ContentObserver framework to gather changes in SMS, Calendar, Contacts, Cell info, Email, WhatsApp, Facebook, Twitter, Kakao, Viber, and Skype.

Screenshots: captures an image of the current screen via the raw frame buffer.

Keylogging: record input events by hooking IPCThreadState::Transact from /system/lib/libbinder.so, and intercepting android::parcel with the interface com.android.internal.view.IInputContext.

RoomTap: silently answers a telephone call and stays connected in the background, allowing the caller to hear conversations within the range of the phone's microphone. If the user unlocks their device, they will see a black screen while the app drops the call, resets call settings and prepares for the user to interact with the device normally.

Via a command from the server

Autoremove if the device has not been able to check in to the server after 60 days

Via an antidote file. If /sdcard/MemosForNotes was present on the device, the Chrysaor app removes itself from the device.

Samples uploaded to VirusTotal

Additional digests with links to Chrysaor

here

Labels

Archive

2025
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2024
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2023
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2022
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2021
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2020
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2019
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2018
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2017
- Dec
- Nov
- Oct
- Sep
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2016
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2015
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2014
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- Apr
- Mar
- Feb
- Jan

2013
- Dec
- Nov
- Oct
- Aug
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2012
- Dec
- Sep
- Aug
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2011
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb

2010
- Nov
- Oct
- Sep
- Aug
- Jul
- May
- Apr
- Mar

2009
- Nov
- Oct
- Aug
- Jul
- Jun
- Mar

2008
- Dec
- Nov
- Oct
- Aug
- Jul
- May
- Feb

2007
- Nov
- Oct
- Sep
- Jul
- Jun
- May

Feed

Give us feedback in our Product Forums.

Google
Privacy
Terms