Connect with us

Sci-Tech

Android spyware ‘Mandrake’ hidden in apps on Google Play since 2022

Published

on

Android spyware ‘Mandrake’ hidden in apps on Google Play since 2022


Android spyware ‘Mandrake’ hidden in apps on Google Play since 2022

A new version of the Android spyware ‘Mandrake’ has been found in five applications downloaded 32,000 times from Google Play, the platform’s official app store.

Bitdefender first documented Mandrake in 2020, with the researchers highlighting the malware’s sophisticated spying capabilities and noting that it has operated in the wild since at least 2016.

Kaspersky now reports that a new variant of Mandrake that features better obfuscation and evasion sneaked into Google Play through five apps submitted to the store in 2022.

Those apps remained available for at least a year, while the last one, AirFS, which was the most successful in terms of popularity and infections, was removed at the end of March 2024.

AriFS on Google Play
AirFS on Google Play
Source: Kaspersky

Kaspersky identified the five Mandrake-carrying apps as follows:

  • AirFS – File sharing via Wi-Fi by it9042 (30,305 downloads between April 28, 2022, and March 15, 2024)
  • Astro Explorer by shevabad (718 downloads from May 30, 2022 to to June 6, 2023)
  • Amber by kodaslda (19 downloads between February 27, 2022, and August 19, 2023)
  • CryptoPulsing by shevabad (790 downloads from November 2, 2022, to June 6, 2023)
  • Brain Matrix by kodaslda (259 downloads between April 27, 2022 and June 6, 2023)

The cybersecurity firm says most downloads come from Canada, Germany, Italy, Mexico, Spain, Peru, and the UK.

Four apps that drop Mandrake on the victim's device
Four apps that drop the Mandrake malware on the victim’s device
Source: Kaspersky

Evading detection

Unlike typical Android malware, which places malicious logic in the app’s DEX file, Mandrake hides its initial stage in a native library, ‘libopencv_dnn.so,’ which is heavily obfuscating using OLLVM.

Upon the malicious app’s installation, the library exports functions to decrypt the second-stage loader DEX from its assets folder and load it into memory.

The second stage requests permissions to draw overlays and loads a second native library, ‘libopencv_java3.so,’ which decrypts a certificate for secure communications with the command and control (C2) server.

Having established communication with the C2, the app sends a device profile and receives the core Mandrake component (third stage) if deemed suitable.

Once the core component is activated, Mandrake spyware can perform a wide range of malicious activities, including data collection, screen recording and monitoring, command execution, simulation of user swipes and taps, file management, and app installation.

Notably, the threat actors can prompt users to install further malicious APKs by displaying notifications that mimic Google Play, hoping to trick users into installing unsafe files through a seemingly trusty process.

Kaspersky says the malware also uses the session-based installation method to bypass Android 13’s (and later) restrictions on the installation of APKs from unofficial sources.

Like other Android malware, Mandrake can ask the user to grant permission to run in the background and hide the dropper app’s icon on the victim’s device, operating stealthily.

The malware’s latest version also features batter evasion, now specifically checking for the presence of Frida, a dynamic instrumentation toolkit popular among security analysts.

It also checks the device root status, searches for specific binaries associated with it, verifies if the system partition is mounted as read-only, and checks if development settings and ADB are enabled on the device.

The Mandrake threat remains alive, and while the five apps identified as droppers by Kaspersky are no longer available on Google Play, the malware could return via new, harder-to-detect apps.

Android users are recommended only to install apps from reputable publishers, check user comments before installing, avoid granting requests for risky permissions that seem unrelated to an app’s function, and make sure that Play Protect is always active.

Google shared the following statement about the malicious apps found on Google Play.

“Google Play Protect is continuously improving with each app identified. We’re always enhancing its capabilities, including upcoming live threat detection to help combat obfuscation and anti-evasion techniques,” Google told BleepingComputer.

“Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.”




Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Sci-Tech

Cristiano Ronaldo first to hit 1bn social media followers

Published

on

Cristiano Ronaldo first to hit 1bn social media followers


Cristiano Ronaldo has hit 1bn total followers across his various social media accounts – making him the first person to reach that mind-boggling figure.

The number is calculated by combining his total number of followers across Instagram, Facebook, Twitter, YouTube, and Chinese social media sites Weibo and Kuaishou.

It does not equate to one billion individual followers, as many people will follow him across multiple platforms, and some will be fake accounts, known as bots.

Nonetheless social media expert Paolo Pescatore, from PP Foresight, described it as a “staggering number” that media and brands would pay close attention to.

“What an achievement, and it further underlines the fundamental shift taking place in media.”

It showed “the power to reach new, younger audiences thanks to technology”, he told the BBC.

On the pitch, Ronaldo was famed for his rivalry with Argentinian star Lionel Messi.

But off it, there is no competition for who is winning the social media contest – Messi has a mere 623 million followers.

Some of the other celebrities with the biggest presence on social media are:

  • 690m: Selena Gomez, actor/singer
  • 607m: Justin Bieber, singer
  • 574m: Taylor Swift, singer

Other notable names the BBC looked into include The Rock (557m), Kylie Jenner (551m ) and Ariana Grande (508m).

MrBeast, the top YouTuber in the world, has 543m total followers, while WWE, often considered to have an enormous social media presence, can only point to reaching a quarter of the audience of Cristiano Ronaldo with 268m combined followers.

The footballer will have reached this milestone thanks to his decision to join YouTube last month, where his channel rocketed to 50 million subscribers within a single week.

So far, the channel consists mainly of conversations between Ronaldo and his wife Georgina Rodríguez, as well as his former Manchester United colleague Rio Ferdinand.

He announced the news in a post shared across his various social media platforms.

Cristiano Ronaldo has made a career out of breaking records.

His successes include being top scorer in Uefa Champions League history, having the most goals in the European Championship, and making more international appearances than anyone else.

Last week he became the first footballer to score 900 top-level career goals.

As with his playing career, he still has scope to improve his numbers on social media too, as unlike some of his rivals, he is not on TikTok or Threads.

All of which is likely to add to another figure he dominates: earnings.

According to Forbes, his total earnings now stand at $260 million – the highest of any athlete.



Source link

Continue Reading

Sci-Tech

Musk and Zuckerberg have ‘polluted culture’

Published

on

Musk and Zuckerberg have ‘polluted culture’


Meta boss Mark Zuckerberg and X owner Elon Musk are “the worst polluters in human history”, Stephen Fry has said.

The actor and comedian made the claim during a lecture at Kings College, London.

“You and your children cannot breathe the air or swim in the waters of our culture without breathing in the toxic particulates and stinking effluvia that belch and pour unchecked from their companies into the currents of our world,” he said of the pair.

The BBC has approached the two men’s companies for comment.

Mr Fry has a track record of being an early adopter of technology – and was once a regular poster on X, when it was known as Twitter.

He stopped posting in 2022, a few months after the platform was purchased by Mr Musk, but has retained his account. He is no longer active on any social networks.

“I’m the chump who thought social media could change the world,” he told his audience at the Digital Futures Institute.

He said he was at first enthusiastic about the potential of social media to unite people around the world and bring about positive change in society, citing the Arab Spring protests which were coordinated online as an example – but added that he had been proved wrong.

He described what he considered to be a fatal flaw in attempts by early Facebook algorithms to “maximise engagement”, saying nobody had predicted that engagement would be “most maximised by… the worst passions” such as anger, shock and horror.

“We are decidedly hopeless at knowing where technology will take us or what it will do to us,” he said.

He returned to the theme several times throughout his one hour speech, in which he also considered the future of artificial intelligence.

Mr Fry argued that AI was “poised to disrupt every space we have”.

He said he hoped corporate greed would not corrupt the development of AI tech at the expense of safety.

“The best I can do is this – Einstein and Russell said in their manifesto on nuclear weapons – we appeal as human beings to human beings, remember your humanity and forget the rest,” he said.

Mr Fry’s broadside was not the only attack on Mr Musk.

Earlier on Thursday, senior Meta executive Sir Nick Clegg, talking at Chatham House, in London, had been similarly scathing of Mr Musk’s platform X.

The former deputy prime minister called it “a tiny, elite, news-obsessed, politics-obsessed app” and added that in his view the social network had become “a one-man hyper-partisan hobby horse.”

In March 2024 X claimed to have 550 million monthly visitors. Facebook has just over 3bn.

Additional reporting by Liv McMahon



Source link

Continue Reading

Sci-Tech

Vodafone clashes with UK’s competition watchdog over Three merger

Published

on

Vodafone clashes with UK’s competition watchdog over Three merger


Vodafone and Three have rejected claims by the UK’s competition watchdog that their proposed merger would lead to higher prices for millions of mobile users.

The Competition and Markets Authority (CMA) has “provisionally concluded” the deal would weaken competition between mobile networks.

It has particular concerns that customers who are least able to afford mobile services would be most affected.

The findings are the latest from the CMA’s ongoing probe into the merger, which it launched in January.

The regulator will now consult on its findings and potential solutions to its worries over competition.

These solutions could include legally binding investment commitments, and measures to protect both retail and wholesale customers.

Vodafone’s CEO for European Markets, Ahmed Essam, told the Today programme, on BBC Radio 4, that he still believed the merger would make a better network for customers, and add to the competition in the market.

“We’ve made a significant commitment to an £11bn investment,” he said.

“We’re willing to make sure that this is legally binding, and we undertake a commitment to deploy this.”

He also said the firm had already traded part of its radio spectrum with a competitor.

But the CMA said it is “not convinced” that it would be good for consumers.

“The main knockback to the merging parties is that the CMA considers claims of superior network quality post integration to be “overstated”,” said Kester Mann from analysis firm CCS Insight.

But he said the regulator was not shutting the door on the deal.

“Vodafone and Three should be encouraged by the tone of the CMA’s report, which appears more open to the merger than I was expecting.”

But Rocio Concha, director of policy and advocacy at consumer group Which?, took a different view.

“The regulator’s finding has set a high bar for the merger to proceed,” she said.

“It is clear from those findings that the planned merger between Vodafone and Three could have a negative impact on millions of consumers.”

But she warned it would be “challenging” for the regulator to find remedies for its concerns.

Vodafone and Three revealed plans to merge their UK-based operations in June last year, creating the biggest mobile network in the UK with around 27 million customers.

But the CMA provisionally concluded on Wednesday that such a deal would lead to a “substantial lessening in competition”.

In addition to worries over price and service levels, the regulator is also concerned that the deal may make it more difficult for smaller players such as Lyca Mobile, Sky Mobile and Lebara – who rent space from the bigger operators – to get a good deal.

Vodafone and Three have said the tie-up would lead to an additional investment of £11bn in the UK.

The CMA found that a merger of the two could improve the quality of mobile networks and accelerate next generation 5G networks and services, as claimed by the companies.

But it considered these claims were “overstated”, and that the merged firm would not necessarily have the incentive to carry out planned investment after the merger.

In a statement, Vodafone and Three said they disagreed with the CMA’s findings.

“By all measures, the merger is pro-growth, pro-customer and pro-competition. It can, and should, be approved by the CMA,” they said.

The CMA will issue a final report into the deal in December.

The firms added they would be working with the regulator to secure approval for the tie-up.



Source link

Continue Reading
Advertisement

Trending

paribahis bahsegel bahsegel bahsegel bahsegel resmi adresi

Copyright © 2024 World Daily Info. Powered by Columba Ventures Co. Ltd.