LTE Security Flaw Reveals All Android Devices' are Vulnerable

The Upside
As much as we like to move to newer and latest App, Android or iPhone or Samsung some of us are so at it that we are the first front. We have heard of midnight queues to get the first hands on latest release. Having newer technology and devices feels awesome thats is from experience i imagine. It feeds well rather than waiting to hear from your friend how fast or superb their machine runs

When LTE was launched by my mobile provider, i quickly moved on from the 3G surrounding my iPad, iPhone and the Router. I quickly upgraded to to this new phenomena and the speeds it can offer. LTE  (Long Term Evolution) or mostly marketed as 4G, is a standard for wireless communication of high-speed data for mobile phones and data terminals. Its a natural path for upgrades for Mobile Telecommunication carriers using GSM/UMTS networks and CDMA2000 networks.

The Downside
However this endless satiation has its downside for the "i beta tested" and rather not wait class as the recent CERT report shows; 

Long Term Evolution (LTE) mobile networks are currently deployed through the world. These LTE mobile networks make use of full packet switching and the IP protocol, unlike previous iterations of the mobile network. This change from circuit switching to packet switching allows new attacks not previously possible. Some implementations of LTE networks and mobile applications are currently vulnerable to several issues which may result in loss of privacy, incorrect billing, and data spoofing. 

Map showing the red countries commercially using LTE, blue deploying and grey in the trial phase

The leading team advisory of Korean origin found the following vulnerabilities. Depending on the carrier implementation one or all of the vulnerabilities may be found with the network. Though Apple reports that the iOS is not affected.

---------------------------CERT Vulnerability Note VU#943167------------------------

Incorrect Permission Assignment for Critical Resource
Call_Phone permission can be overruled with only the INTERNET permission by directly sending SIP/IP packets. A call made in such a manner would not provide any feedback to the user. Continually making such calls may result in overbilling or lead to denial of service. 

Improper Access Control
Some networks allow two phones to directly establish a session rather than being monitored by a SIP server, thus such communication is not accounted for by the provider. This may be used to either spoof phone numbers or obtain free data usage such as for video calls.


Improper Authentication
for every SIP-Session Initiation Protocol- message, allowing the possibility of spoofing of phone numbers.


Session Fixation
Networks allows a user to attempt to establish multiple SIP sessions simultaneously rather than restricting a user to a single voice session, which may lead to denial of service attacks on the network. An attacker may also use this to establish a peer-to-peer network within the mobile network.

------------------------------------------------------------------------------------

As you are using LTE on an Android powered device you risk a remote attacker

1. Establish a peer-peer communication, spoofing your phone call and

2. Retrieve data from your mobile

3. Denial of service and overbilling

3. A malicious mobile app may be able to silently place phone calls without the user's knowledge.

Solution is none at the moment as alerted by the advisory team, but here is a go on, if you feel things aint right try to restrict device to 3G and see how things move.

UK Hit By Serious Cyber Attack - Dridex Malware

Though Dridex has been known to be around for a while UK is more often hit by this threat perversion of online banking crime dating back to 2014 when it spread through a serious annoying spam campaign . Dridex is an evolution of the Cridex malware, which itself is based on the ZeuS Trojan Horse malware. Dridex is a peer-to-peer (P2P) bank credential-stealing malware. It uses a decentralised network infrastructure of compromised personal computers and web servers to execute command-and-control (C2). 

What is Dridex Malware? 

It is also known as Bugat and Cridex, has been developed by technically skilled cyber criminals in Eastern Europe to harvest online banking details, which are then exploited to steal money from individuals and businesses around the world. Global financial institutions and a variety of different payment systems have been particularly targeted, with UK losses estimated at £20m. The National Crime Agency warned.

Computers become infected with Dridex malware when users receive and open documents in seemingly legitimate emails. 

Example of Email Content soliciting for a Dridex Infection

The NCA assesses there could be thousands of infected computers in the UK, the majority being Windows users. The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation (FBI) and the Department of Justice (DOJ), have also issued warning and Technical Alert to provide further information about the Dridex botnet. These kind of emails have also spread and seen in Africa with reports of such from Zambia

TIPS FOR PROTECTION AGAINST DRIDEX:

• Ensure your computers have up-to-date Security Software, Operating System and Applications. Malware exploits vulnerabilities in the existing software before an update is done. 

• Use legitimate Anti Malware tools 

• Don't click on any suspicious or unknown links and attachments. The cyber criminals are using technics to lure users into clicking on malware infested links 
  

• Reduce the value of a criminal knowing your passwords by ensuring you use unique complex passwords for accessing web sites and online banking, and remember to use a different password for each site/account.

• To limit the surface attack area make your passwords more secure. They should be at least 15 characters long with a mix of letters, numbers and special characters 
• If you fear a password has been compromised promptly change it on all other web sites where you may have used the same password.

• Don't click on any suspicious or unknown links and attachments. Don't install unknown software and applications requested from emails.

Tools for Removing Dridex

       F-Secure

       https://www.f-secure.com/en/web/home_global/online-scanner(link is external)

       McAfee

       http://www.mcafee.com/uk/downloads/free-tools/stinger.aspx(link is external)

       Microsoft

       http://www.microsoft.com/security/scanner/en-us/default.aspx(link is external)

       Sophos

       https://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx(link is external)

       Trend Micro

       http://housecall.trendmicro.com/(link is external)