New malware with extensive spyware capabilities steals data from infected Android devices and is designed to automatically trigger whenever new info is read to be exfiltrated. The spyware can only be installed as a 'System Update' app available via third-party Android app stores as it was never available on Google's Play Store. This drastically limits the number of devices it can infect, given that most experienced users will most likely avoid installing it in the first place. The malware also lacks a method to infect other Android devices on its own, adding to its limited spreading capabilities.
However, when it comes to stealing your data, this remote access trojan (RAT) can collect and exfiltrate an extensive array of information to its command-and-control server. Zimperium researchers who spotted it observed it while "stealing data, messages, images and taking control of Android phones."
What happens when malicious software is installed
"Once in control, hackers can record audio and phone calls, take photos, review browser history, access WhatsApp messages, and more," they added. Zimperium said its extensive range of data theft capabilities includes:
- Stealing instant messenger messages;
- Stealing instant messenger database files (if the root is available);
- Inspecting the default browser's bookmarks and searches;
- Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser;
- Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx);
- Inspecting the clipboard data;
- Inspecting the content of the notifications;
- Recording audio;
- Recording phone calls;
- Periodically take pictures (either through the front or back cameras);
- Listing of the installed applications;
- Stealing images and videos;
- Monitoring the GPS location;
- Stealing SMS messages;
- Stealing phone contacts;
- Stealing call logs;
- Exfiltrating device information (e.g., installed applications, device name, storage stats).
How does it work?
Once installed on an Android device, the malware will send several pieces of info to its Firebase command-and-control (C2) server, including storage stats, the internet connection type, and the presence of various apps such as WhatsApp. The spyware harvests data directly if it has root access or will use Accessibility Services after tricking the victims into enabling the feature on the compromised device. It will also scan the external storage for any stored or cached data, harvest it, and deliver it to the C2 servers when the user connects to a Wi-Fi network. Unlike other malware designed to steal data, this one will get triggered using Android's contentObserver and Broadcast receivers only when some conditions are met, like the addition of a new contact, new text messages, or new apps being installed.
"Commands received through the Firebase messaging service initiate actions such as recording of audio from the microphone and exfiltration of data such as SMS messages," Zimperium said.
"The Firebase communication is only used to issue the commands, and a dedicated C&C server is used to collect the stolen data by using a POST request."
Camouflage
The malware will also display fake "Searching for the update.." system update notifications when it receives new commands from its masters to camouflage its malicious activity. The spyware also conceals its presence on infected Android devices by hiding the icon from the drawer/menu. To further evade detection, it will only steal thumbnails of videos and images it finds, thus reducing the victims' bandwidth consumption to avoid drawing their attention to the background data exfiltration activity. Unlike other malware that harvests data in bulk, this one will also make sure that it exfiltrates only the most recent data, collecting location data created and photos taken within the last few minutes.
If you would like to read more helpful articles and tips about various software and hardware visit errortools.com daily.
Check for a poorly functioning background process
The final solution. Contact Firefox about these errors on your browser. Oftentimes, these errors occur when you attempt to visit particular websites. Mark the offending websites' URLs and include them in your communications with Firefox.
Sometimes you can also contact the website owner yourself and request them to check their website's code.
Following are additional measures you can take to resolve the Unresponsive Script error.
Next-generation of RAM, DDR5 supposed to hit shelves around late summer or fall in 2021if everything goes as planned.
Its goal is to increase speed and efficiency, wants to pack more memory in a single stick, and have better power management.
Now before you go on the bandwagon on bashing Intel itself take note that it is not Intel’s fault at all. The issue that arises is mostly due to DRM software and how it works. As you might know or not, Alder Lake has two sets of cores, standard performance cores, and power cores, and with Intel’s Thread Director on-chip right cores will be used for the right tasks, and here lies the issue.
DRM software might detect Thread Director as something suspicious and malicious, and then cut access to the game because of this. Intel, of course, has reached DRM manufacturers and places documentation about how software should be developed with this hybrid technology in mind.
Of course, newer games will be updated if needed and everything will work fine, also games on GOG will work fine because of GOG’s policy of no DRM store but some older ones might be left in limbo. They could work fine but DRM might be triggered and prevent them from loading, usually, game developer itself removes DRM protection after some time but that is not really always the case and there is a chance that some games might simply just not work on Alder Lake CPU only because of DRM protection.
