Mobile Security

New TGLoader Android Malware Found in Alternative Markets

Alternative mobile app markets have become a great place to find new games, utilities and other apps. But mostly they’re great if you’re looking for the latest stealthy Android malware. The newest example is a piece of malware called TGLoader that is showing up in repackaged legitimate apps and has the ability to get root privileges on victims’ phones and also cost them quite a bit of money by sending SMS messages to premium-rate numbers.

iOS JavaScript Bug Can Lead to Spoofed Sites

Apple’s iOS thus far has proven to be fairly resistant to malware and some other forms of attack, but that doesn’t mean that it is completely in the clear. A new vulnerability discovered by a researcher at a German security firm enables an attacker to take advantage of some odd JavaScript behavior and spoof a URL and present a user with an absolutely authentic-looking forged Web site.

IBM Report: Mobile Attacks, Phishing Attacks Mount in 2011

Spam volume is down, there are fewer unpatched software holes and oftware application developers did a better job of writing secure code over the last year. But IBM’s X-Force Trend and Risk Report still found plenty to worry about in 2011, according to a copy of the report released this week.  

Threatpost spent much of the last year chasing after Greg Hoglund, the founder and CEO of HB Gary. First, it was to get his reaction to the bruising encounter his firm had with the hacking group Anonymous. Then it was an endless series of requests on the aftermath of that hack, including the departure of HBGary Federal CEO Aaron Barr, and the company’s decision to pull out of the RSA Conference in 2011. When Greg finally did speak out it wasn’t to us.So we were happy when Hoglund, whose firm was recently acquired by the company Mantech International Corp., agreed to speak at the Kaspersky Lab Security Analysts’ Summit in Cancun, Mexico in February. His talk there on “Lateral Movement and Other APT Interaction Patterns Within the Enterprise” reinforced Hoglund’s reputation as one of the top experts on malicious code.Threatpost editor Paul Roberts caught up with Hoglund after the speech. And, while Anonymous and HBGary Federal were not up for discussion on the record, Hoglund offered some great insights into the delicate art of tracking down remote access trojans (or RATs) after they have a foothold in your network, as well as the mistakes companies make in trying to prevent and respond to security incidents.

Malware that targets Android phones has been on a steady rise for the last couple of years, and much of it has come in the form of compromised apps or outright malicious apps disguised as games or utilities. But now researchers have come across a new Android threat that is designed specifically to steal users’ online banking credentials and create persistent, silent access to the compromised handset.

Those multi-gesture passcode locks on Android phones that give users (and their spouses) fits apparently present quite a challenge for the FBI as well. Frustrated by a swipe passcode on the seized phone of an alleged gang leader, FBI officials have requested a search warrant that would force Google to “provide law enforcement with any and all means of gaining access, including login and password information, password reset, and/or manufacturer default code (“PUK”), in order to obtain the complete contents of the memory of cellular telephone”. 

VIEW SLIDESHOW: Weird Science: 10 Forms of Biometric Authentication In the past twenty years, we’ve gone from using amber-tinted dumb terminals connected to refrigerator-sized mainframe computers to sleek tablet computers and smart phones tucked into our pockets. Despite those changes, one technology has stubbornly persisted: passwords. Indeed, the explosion in computing devices and Web-based services has made us more dependent on passwords than ever.

VANCOUVER–The shift to mobile computing platforms in recent years has made life much easier for many users, but it’s also made life a lot more difficult for security researchers. Working on any software or hardware product carries with it a number of potential legal challenges, but mobile and embedded devices have their own special set of pitfalls that are beginning to present problems for researchers.

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.